专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

WO2010151723A2 DISTRIBUTED METHODOLOGY FOR APPROXIMATE EVENT COUNTING 审中-公开
标题翻译：用于大量事件计数的分布式方法
公开(公告)号：WO2010151723A2
公开(公告)日：2010-12-29
申请号：PCT/US2010/039913
申请日：2010-06-25
申请人： ACCELOPS, INC. , BHATTACHARYA, Partha , CHEN, Sheng , ZHU, Hongbo
发明人： BHATTACHARYA, Partha , CHEN, Sheng , ZHU, Hongbo
IPC分类号： G06F17/30
CPC分类号： H04L41/069
摘要： In a method and system for aggregating event information, events are received at a first plurality of nodes in a distributed system. For the events received at each node aggregated attribute information is determined in accordance with two or more rules and stored in distinct first tables, each table storing aggregated attribute information for a respective rule of the two or more rules. At each node of the first plurality of nodes, the two or more distinct first tables are transmitted to a respective node of a second set of nodes in the distributed system. At each node of the second set of nodes, two or more distinct second tables are generated by merging the aggregated attribute information in the tables transmitted to the node. Each rule of the two or more rules is evaluating using the aggregated attribute information obtained from a corresponding table of the second tables.
摘要翻译：在用于聚合事件信息的方法和系统中，在分布式系统中的第一多个节点处接收事件。对于在每个节点处接收到的事件，根据两个或更多个规则确定聚合属性信息并存储在不同的第一表中，每个表存储用于两个或更多个规则的相应规则的聚合属性信息。在第一多个节点的每个节点处，两个或多个不同的第一表被发送到分布式系统中的第二组节点的相应节点。在第二组节点的每个节点处，通过将发送到节点的表中的聚合属性信息合并来生成两个或更多个不同的第二表。两个或更多个规则的每个规则是使用从第二表的相应表获得的聚合属性信息进行评估。

2. 发明申请

WO2010105146A1 MULTIPLE RELATED EVENT HANDLING BASED ON XML ENCODED EVENT HANDLING DEFINITIONS 审中-公开
标题翻译：基于XML编码事件处理定义的多个相关事件处理
公开(公告)号：WO2010105146A1
公开(公告)日：2010-09-16
申请号：PCT/US2010/027124
申请日：2010-03-12
申请人： PROSPECTHILLS, INC. , BHATTACHARYA, Partha , CHEN, Sheng , ZHU, Hongbo
发明人： BHATTACHARYA, Partha , CHEN, Sheng , ZHU, Hongbo
IPC分类号： G06F17/27
CPC分类号： G06F17/2247 , G06F11/3466 , G06F17/227 , G06F2201/86
摘要： In a method and system for collecting event information, XML documents specifying event parsing logic for respective groups of related events are loaded. Representations for the parsing logic contained in the plurality of XML documents are stored in one or more parsing trees. Events are received, including events in a plurality of groups of events. The received events are processed in accordance with the event parsing logic in the one or more parsing trees. The received events are also processed in accordance with stored program instructions that are independent of the parsing logic for the plurality of groups of events. Event information for the received events is stored. The stored event information includes information determined in accordance with the event parsing logic in at least one or more parsing trees.
摘要翻译：在用于收集事件信息的方法和系统中，加载指定相关事件组的事件解析逻辑的XML文档。包含在多个XML文档中的解析逻辑的表示被存储在一个或多个解析树中。收到事件，包括多组事件中的事件。接收的事件根据一个或多个解析树中的事件解析逻辑进行处理。所接收的事件还根据与多个事件组的解析逻辑无关的存储的程序指令进行处理。存储接收事件的事件信息。所存储的事件信息包括根据至少一个或多个解析树中的事件解析逻辑确定的信息。

3. 发明申请

WO2005026900A2 METHOD AND SYSTEM FOR DISPLAYING NETWORK SECURITY INCIDENTS 审中-公开
标题翻译：用于显示网络安全事故的方法和系统
公开(公告)号：WO2005026900A2
公开(公告)日：2005-03-24
申请号：PCT/US2004/029185
申请日：2004-09-03
申请人： PROTEGO NETWORKS, INC. , BHATTACHARYA, Partha , LEE, Imin, T. , JOSEPH, Aji , STEVENS, Eli , NARAMREDDY, Diwakar
发明人： BHATTACHARYA, Partha , LEE, Imin, T. , JOSEPH, Aji , STEVENS, Eli , NARAMREDDY, Diwakar
IPC分类号： G06F
CPC分类号： H04L63/1416
摘要： A network security monitor system groups a plurality of security events into network sessions, correlates the network sessions according to a set of predefined network security event correlation rules and generates a security incident for the network sessions that satisfy one of the network security event correlation rules. The system then presents the information of the network sessions and security incidents to a user of the system in an intuitive form. The user is able to not only learn the details of a possible network attack, but also creates new security event correlation rules intuitively, including drop rules for dropping a particular type of events.
摘要翻译：网络安全监控系统将多个安全事件分组为网络会话，根据一组预定义的网络安全事件相关规则关联网络会话，并为满足网络安全事件相关规则之一的网络会话生成安全事件。然后，系统以直观的形式向系统的用户呈现网络会话和安全事件的信息。用户不仅可以学习可能的网络攻击的细节，还可以直观地创建新的安全事件关联规则，包括删除特定类型的事件的删除规则。

4. 发明申请

WO2005001655A2 METHOD AND SYSTEM FOR DETERMINING INTRA-SESSION EVENT CORRELATION ACROSS NETWORK ADDRESS TRANSLATION DEVICES 审中-公开
标题翻译：用于确定网络地址转换设备中的会话内事件相关性的方法和系统
公开(公告)号：WO2005001655A2
公开(公告)日：2005-01-06
申请号：PCT/US2004/020361
申请日：2004-06-18
申请人： PROTEGO NETWORKS, INC. , BHATTACHARYA, Partha , LIAO, Yu
发明人： BHATTACHARYA, Partha , LIAO, Yu
IPC分类号： G06F
CPC分类号： H04L63/0236 , H04L29/12518 , H04L61/2514 , H04L61/2571 , H04L63/1416
摘要： An intra-session network correlation system receives a stream of network events and then group them into different network session according to each event's event parameters and the corresponding network address translation (NAT) information. An event in the stream is first matched against any existing session, and then categorized using the information about a NAT device that translates a message the event is related to. Finally, at a predefined time, a categorized event is processed to identify other categorized events in accordance with a NAT message or an expiry timer associated with the categorized event, and the categorized event and identified other categorized events are grouped into the same network session.
摘要翻译：会话内网络关联系统接收网络事件流，然后根据每个事件的事件参数和相应的网络地址转换（NAT）信息将它们分组到不同的网络会话中。首先将流中的事件与任何现有会话进行匹配，然后使用有关NAT设备的信息进行分类，该NAT设备将翻译与该事件相关的消息。最后，在预定义时间，根据与分类事件相关联的NAT消息或期满计时器来处理分类事件以识别其他分类事件，并且将分类事件和所识别的其他分类事件分组到相同网络会话中。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式