会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 1. 发明申请
    • Methodology, system and computer readable medium for streams-based packet filtering
    • 用于基于流的包过滤的方法学,系统和计算机可读介质
    • US20050240993A1
    • 2005-10-27
    • US10830978
    • 2004-04-22
    • William TreadwellEric Cole
    • William TreadwellEric Cole
    • G06F21/00H04L9/00H04L29/06
    • H04L63/0236G06F21/55G06F21/554
    • A packet filtering system for use with a host computer implementing a streams sub-system comprises a configuration component for maintaining a collection of configuration parameters based on user input, and a streams interface component for managing bi-directional transmission of packets according to the collection of configuration parameters. The configuration parameters may include sets of authorized port, protocol and address designations. The streams interface component preferably includes corresponding modules for port filtering, protocol filtering and address filtering whereby inbound and outbound packets which are not blocked by any of filtering modules are, respectively, passed upstream and downstream between an associated network device and the stream head. A computerized method for managing bi-directional transmission of packets, as well as a computer-readable medium having executable instructions for managing packet transmission, are also provided.
    • 用于与实现流子系统的主计算机一起使用的分组过滤系统包括用于基于用户输入维护配置参数的集合的配置组件,以及用于管理分组的双向传输的流接口组件, 配置参数。 配置参数可以包括授权端口,协议和地址指定的集合。 流接口组件优选地包括用于端口过滤,协议过滤和地址过滤的相应模块,由此未被任何过滤模块阻塞的入站和出站分组分别在相关联的网络设备和流头之间的上游和下游传递。 还提供了一种用于管理分组的双向传输的计算机化方法,以及具有用于管理分组传输的可执行指令的计算机可读介质。
    • 3. 发明申请
    • Methodology, system, computer readable medium, and product providing a security software suite for handling operating system exploitations
    • 方法学,系统,计算机可读介质和提供用于处理操作系统利用的安全软件套件的产品
    • US20050229250A1
    • 2005-10-13
    • US10789460
    • 2004-02-26
    • Sandra RingEric Cole
    • Sandra RingEric Cole
    • G06F11/00G06F12/00G06F12/14G06F21/00
    • G06F21/57
    • Various embodiments are provided relating to security of a computer, namely, a security software product, a computer-readable medium, a computerized method, and a computer security system. Illustrative is one embodiment of a security software product for use on a host computer to monitor for, and respond to, activity corresponding to a rootkit exploitation which renders the host computer's operating system insecure. The security software product comprises computer readable media having a suite of interfaced software components, such as loadable kernel modules. An exploitation detection component detects the activity corresponding to the rootkit exploitation. A forensics data collection component collects forensics data characteristic of the rootkit exploitation so that it may be transferred to a removable storage device. An OS restoration component restores the operating system to a secure condition in response to detection of the exploit.
    • 提供了关于计算机的安全性,即安全软件产品,计算机可读介质,计算机化方法和计算机安全系统的各种实施例。 说明性的是用于在主机计算机上使用的安全软件产品的一个实施例,用于监视和响应与使用主机操作系统不安全的rootkit利用相关的活动。 安全软件产品包括具有一组接口的软件组件的计算机可读介质,诸如可加载的内核模块。 利用检测组件检测与rootkit利用相对应的活动。 取证数据收集组件收集rootkit开发特征的取证数据,以便将其传输到可移动存储设备。 操作系统恢复组件将操作系统恢复到安全状态以响应漏洞的检测。
    • 4. 发明申请
    • Methodology, system, and computer-readable medium for collecting data from a computer
    • 用于从计算机收集数据的方法学,系统和计算机可读介质
    • US20050193173A1
    • 2005-09-01
    • US10804469
    • 2004-03-18
    • Sandra RingEric Cole
    • Sandra RingEric Cole
    • G06F11/00G06F12/00G06F12/14G06F21/00
    • G06F21/57
    • A computerized method for collecting suspected data of interest from a computer comprises searching the computer's shot-term memory to locate at least one target memory range containing the suspected data of interest, and copying the suspected data of interest within the target memory range to an alternate data storage location in a manner which avoids writing the suspected data to the computer's long-term memory. Alternatively, the suspected data of interest can be copied to a previously unused data storage location while preserving integrity of non-volatile memory resources. A computer-readable medium and a system for collecting target forensics data are also provided.
    • 一种用于从计算机收集感兴趣的疑似数据的计算机化方法,包括:搜索计算机的射击术存储器,以定位至少一个目标存储器范围,该目标存储器范围包含所关注的疑似数据,并将目标存储器范围内的可疑数据复制到另一个 数据存储位置,避免将怀疑的数据写入计算机的长期内存。 或者,可疑的可疑数据可被复制到先前未使用的数据存储位置,同时保持非易失性存储器资源的完整性。 还提供了计算机可读介质和用于收集目标取证数据的系统。
    • 7. 发明申请
    • Security Enhanced Methods And System For IP Address Allocation
    • IP地址分配安全增强方法与系统
    • US20060195610A1
    • 2006-08-31
    • US10906632
    • 2005-02-28
    • Eric ColeHuy Vu
    • Eric ColeHuy Vu
    • G06F15/16
    • H04L61/2015H04L63/1441H04L63/1491
    • The present invention relates to methods and a system for enhancing DHCP to promote a more secure IP address allocation model. The invention advantageously accomplishes this through the utilization of an address generator which is compatible with the existing DHCP protocol, and which incorporates an algorithm for use in producing a selected IP address as one of a sub-set of allocable addresses that are non-sequentially distributed within an address pool. As such, the invention offers robust security and allows for the rapid detection of unauthorized activity such as network intrusion, worms, virus propagation, network scanners, and SPAM.
    • 本发明涉及用于增强DHCP以促进更安全的IP地址分配模型的方法和系统。 本发明有利地通过使用与现有DHCP协议兼容的地址生成器来实现,并且其包含用于将所选择的IP地址生成为非顺序分配的可分配地址的子集之一的算法 在地址池内。 因此,本发明提供了强大的安全性,并允许快速检测未经授权的活动,例如网络入侵,蠕虫,病毒传播,网络扫描器和垃圾邮件。
    • 9. 发明申请
    • Detector and computerized method for determining an occurrence of tunneling activity
    • 用于确定隧道活动发生的检测器和计算机化方法
    • US20060031928A1
    • 2006-02-09
    • US10915686
    • 2004-08-09
    • James ConleyEric Cole
    • James ConleyEric Cole
    • G06F15/16
    • H04L63/0236H04L63/029H04L63/1408
    • Devices and methods are provided to ascertain an existence of tunneling activity through a network firewall. According to one methodology, a set of norms is established for network traffic and a series of data packets transmitted through the firewall are monitored. Data packet attributes are analyzed to determine an absence or an existence of tunneling activity based on whether the attributes conform to the norms. A device is also provided in the form of a detector which is situated behind a network firewall and incorporates a data capture component for passively monitoring network traffic through the firewall and for producing detection data, and a data analysis component for comparing the detection data to a set of network traffic norms that are characteristic of an absence of tunneling activity. Tunneling activity potentially exists if the detection data fails to conform to any one of the set of norms.
    • 提供设备和方法以确定通过网络防火墙存在隧道活动。 根据一种方法,为网络流量建立了一套规范,并监控了通过防火墙传输的一系列数据包。 分析数据分组属性以根据属性是否符合规范来确定是否存在隧道活动。 设备还以检测器的形式提供,该检测器位于网络防火墙后面,并且包括用于被动地监视通过防火墙的网络流量并用于产生检测数据的数据捕获组件,以及用于将检测数据与 一组没有隧道活动特征的网络流量规范。 如果检测数据不符合该组规范中的任何一个,隧道活动可能存在。