专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

WO2005048022A3 METHOD AND SYSTEM FOR ADDRESSING INTRUSION ATTACKS ON A COMPUTER SYSTEM 审中-公开
标题翻译：用于处理计算机系统中的入侵攻击的方法和系统
公开(公告)号：WO2005048022A3
公开(公告)日：2006-04-27
申请号：PCT/US2004033311
申请日：2004-10-08
申请人： CISCO TECH IND , WILEY KEVIN L , HALL MICHAEL L , LATHEM GERALD S , GLEICHAUF ROBERT E
发明人： WILEY KEVIN L , HALL MICHAEL L , LATHEM GERALD S , GLEICHAUF ROBERT E
IPC分类号： G06F20060101 , G06F21/00 , H04L9/32 , H04L29/06 , G06F11/00 , G06F11/22 , G06F11/30 , G06F11/32 , G06F11/34 , G06F11/36 , G06F12/14 , G06F12/16 , G06F15/18 , G08B23/00
CPC分类号： H04L63/1416 , G06F21/554 , H04L63/1433
摘要： According to one embodiment of the invention, a computerized method for addressing intrusion detection attacks directed at a computer includes receiving a data stream corresponding to a potential attack on the computer [304] and calculating an event risk rating for the data stream [314]. Calculating the event risk rating includes determining at least one component of the risk rating. In one embodiment, the component risk ratings are: a signature fidelity rating indicative of the likelihood the potential attack will affect the computer in the absence of knowledge regarding the computer [308], an attack relevance rating indicative of the relevance of the potential attack to the computer [310], and a target value rating indicative of the perceived value of the computer [312]. The method also includes responding to the potential attack based on the calculated risk rating.
摘要翻译：根据本发明的一个实施例，用于解决针对计算机的入侵检测攻击的计算机化方法包括接收与计算机[304]上的潜在攻击相对应的数据流，并计算数据流[314]的事件风险等级。计算事件风险评级包括确定风险等级的至少一个组成部分。在一个实施例中，组件风险评级是：指示在没有关于计算机的知识的情况下潜在攻击将影响计算机的可能性的签名保真度等级，指示潜在攻击的相关性的攻击相关性等级计算机[310]和指示计算机感知值的目标值评估[312]。该方法还包括根据计算出的风险等级来应对潜在的攻击。

2. 发明申请

WO2006019701A2 INLINE INTRUSION DETECTION USING A SINGLE PHYSICAL PORT 审中-公开
标题翻译：使用单个物理端口进行INLINE INTRUSION检测
公开(公告)号：WO2006019701A2
公开(公告)日：2006-02-23
申请号：PCT/US2005/024592
申请日：2005-07-12
申请人： CISCO TECHNOLOGY, INC. , HALL, Michael, Lee, Jr. , WILEY, Kevin, L. , HOSSAIN, Munawar , SIRRIANNI, Joseph, M.
发明人： HALL, Michael, Lee, Jr. , WILEY, Kevin, L. , HOSSAIN, Munawar , SIRRIANNI, Joseph, M.
IPC分类号： H04L12/56
CPC分类号： H04L63/1408 , H04L63/1416
摘要： In accordance with one embodiment of the present invention, a method for inline intrusion detection includes receiving a packet at a physical interface of an intrusion detection system. The packet is tagged with a first VLAN identifier associated with an external network. The network further includes buffering the packet at the physical interface, communicating a copy of the packet to a processor, and analyzing the copy of the packet at the processor to determine whether the packet includes an attack signature. The method also includes communicating a reply message from the processor to the interface indicating whether the packet includes an attack signature. If the packet does not contain an attack signature the buffered copy of the packet is retagged with a second VLAN identifier associated with a protected network and re-tagged packet is communicated to the protected network.
摘要翻译：根据本发明的一个实施例，用于在线入侵检测的方法包括在入侵检测系统的物理接口处接收分组。该分组被标记有与外部网络相关联的第一VLAN标识符。网络还包括在物理接口处缓冲分组，将分组的副本传送到处理器，以及在处理器处分析分组的副本以确定分组是否包括攻击签名。该方法还包括将来自处理器的应答消息传送到指示分组是否包括攻击签名的接口。如果分组不包含攻击签名，则使用与受保护网络相关联的第二VLAN标识来重新标记分组的缓冲副本，并将重新标记的分组传送到受保护的网络。

3. 发明申请

WO2005048022A2 METHOD AND SYSTEM FOR ADDRESSING INTRUSION ATTACKS ON A COMPUTER SYSTEM 审中-公开
标题翻译：用于处理计算机系统中的入侵攻击的方法和系统
公开(公告)号：WO2005048022A2
公开(公告)日：2005-05-26
申请号：PCT/US2004/033311
申请日：2004-10-08
申请人： CISCO TECHNOLOGY, INC. , WILEY, Kevin, L. , HALL, Michael, L. , LATHEM, Gerald, S. , GLEICHAUF, Robert, E.
发明人： WILEY, Kevin, L. , HALL, Michael, L. , LATHEM, Gerald, S. , GLEICHAUF, Robert, E.
IPC分类号： G06F
CPC分类号： H04L63/1416 , G06F21/554 , H04L63/1433
摘要： According to one embodiment of the invention, a computerized method for addressing intrusion attacks directed at a computer includes receiving a data stream corresponding to a potential attack on the computer and calculating an event risk rating for the data stream. Calculating the event risk rating includes determining at least one component risk rating. In one embodiment, the component risk ratings are: a signature fidelity rating indicative of the likelihood the potential attack will affect the computer in the absence of knowledge regarding the computer, an attack relevance rating indicative of the relevance of the potential attack to the computer, and a target value rating indicative of the perceived value of the computer. The method also includes responding to the potential attack based on the calculated risk rating.
摘要翻译：根据本发明的一个实施例，用于解决针对计算机的入侵攻击的计算机化方法包括接收对应于计算机上的潜在攻击的数据流并且计算数据流的事件风险等级。计算事件风险评级包括确定至少一个组件风险评级。在一个实施例中，组件风险等级是：指示在没有关于计算机的知识的情况下潜在攻击将影响计算机的可能性的签名保真度等级，指示潜在攻击与计算机的相关性的攻击相关性等级，以及指示计算机的感知值的目标值等级。该方法还包括根据计算出的风险等级来应对潜在的攻击。

4. 发明申请

WO2006019701A3 INLINE INTRUSION DETECTION USING A SINGLE PHYSICAL PORT 审中-公开
标题翻译：使用单个物理端口进行INLINE INTRUSION检测
公开(公告)号：WO2006019701A3
公开(公告)日：2006-10-05
申请号：PCT/US2005024592
申请日：2005-07-12
申请人： CISCO TECH INC , HALL MICHAEL LEE JR , WILEY KEVIN L , HOSSAIN MUNAWAR , SIRRIANNI JOSEPH M
发明人： HALL MICHAEL LEE JR , WILEY KEVIN L , HOSSAIN MUNAWAR , SIRRIANNI JOSEPH M
IPC分类号： H04L12/28 , H04L12/56
CPC分类号： H04L63/1408 , H04L63/1416
摘要： In accordance with one embodiment of the present invention, a method for inline intrusion detection includes receiving a packet at a physical interface of an intrusion detection system (120). The packet is tagged with a first VLAN identifier (108) associated with an external network. The network further includes buffering the packet at the physical interface, communicating a copy of the packet to a processor, and analyzing the copy of the packet at the processor to determine whether the packet includes an attack signature. The method also includes communicating a reply message from the processor to the interface indicating whether the packet includes an attack signature. If the packet does not contain an attack signature the buffered copy of the packet is re-tagged with a second VLAN identifier (108) associated with a protected network and re-tagged packet is communicated to the protected network.
摘要翻译：根据本发明的一个实施例，一种用于在线入侵检测的方法包括在入侵检测系统（120）的物理接口处接收分组。该分组被标记有与外部网络相关联的第一VLAN标识符（108）。网络还包括在物理接口处缓冲分组，将分组的副本传送到处理器，以及在处理器处分析分组的副本以确定分组是否包括攻击签名。该方法还包括将来自处理器的应答消息传送到指示分组是否包括攻击签名的接口。如果分组不包含攻击签名，则使用与受保护网络相关联的第二VLAN标识符（108）重新标记分组的缓冲副本，并将重新标记的分组传送到受保护网络。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式