专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

WO2017100364A1 SYSTEMS AND METHODS FOR DETECTING AND RESPONDING TO SECURITY THREATS USING APPLICATION EXECUTION AND CONNECTION LINEAGE TRACING 审中-公开
标题翻译：使用应用执行和连接线追踪检测和应对安全威胁的系统和方法
公开(公告)号：WO2017100364A1
公开(公告)日：2017-06-15
申请号：PCT/US2016/065450
申请日：2016-12-07
申请人： PRISMO SYSTEMS INC.
发明人： VENKATRAMANI, Anjan , CHAO, Chihwei
IPC分类号： G06F3/048 , G06F12/14 , H04J1/16
CPC分类号： H04L63/1416 , H04L63/0272 , H04L63/1425 , H04L63/20
摘要： Systems and methods for detecting and responding to security threats using application execution and connection lineage tracing in accordance with embodiments of the invention are disclosed-. In one embodiment, a process for detecting suspicious activity in a network and in a computer server system includes receiving at a collector server a first piece of activity data including a first set of attributes, each attribute having a particular value, combining a first set of context information with the first piece of activity data to generate a first activity record, comparing the first activity record to a set of baseline signatures, where each baseline signature includes a second set of attributes, each attribute having a particular value and each baseline signature being unique in the combination of values of its attributes, and incrementing a count of a first matching baseline signature from the set of baseline signatures.
摘要翻译：公开了使用根据本发明实施例的应用执行和连接沿袭跟踪来检测和响应安全威胁的系统和方法。在一个实施例中，用于检测网络中和计算机服务器系统中的可疑活动的过程包括在收集器服务器处接收包括第一组属性的第一活动数据，每个属性具有特定值，组合第一组上下文信息与第一活动数据一起生成第一活动记录，将第一活动记录与一组基准签名进行比较，其中每个基准签名包括第二组属性，每个属性具有特定值并且每个基准签名是在其属性值的组合中是唯一的，并且增加来自该组基准签名的第一匹配基线签名的计数。

IPRDB

热门服务

关于我们

友情链接

联系方式