专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

WO2013074152A3 METHOD, APPARATUS AND PROGRAM FOR DETECTING SPOOFED NETWORK TRAFFIC 审中-公开
公开(公告)号：WO2013074152A3
公开(公告)日：2013-05-23
申请号：PCT/US2012/040354
申请日：2012-06-01
申请人： TELCORDIA TECHNOLOGIES, INC. , KDDI CORPORATION , VAIDYANATHAN, Ravichander , GHOSH, Abhrajit , NAIDU, Aditya , YAMADA, Akira , KUBOTA, Ayumu , SAWAYA, Yukiko , MIYAKE, Yutaka
发明人： VAIDYANATHAN, Ravichander , GHOSH, Abhrajit , NAIDU, Aditya , YAMADA, Akira , KUBOTA, Ayumu , SAWAYA, Yukiko , MIYAKE, Yutaka
IPC分类号： G06F11/00
摘要： A method, an apparatus and a program for detecting spoofed internet Protocol (IP) traffic directed to a network having a plurality of autonomous systems (AS) is provided. The method comprises receiving an incoming packet through an AS, the incoming packet containing a source IP address and a destination IP address, acquiring a corresponding source and destination IP address prefixes, converting the corresponding source and destination IP address prefixes into a source AS number and a destination AS number, determining if the incoming packet arrived from an unexpected source based upon the corresponding destination IP address prefix and the converted source and destination AS number using an unexpected pair tuple table generated from network routing information and generating an alert indicating that the incoming packet is not allowed to enter the network.

2. 发明申请

WO2014011828A2 SYSTEM AND METHOD FOR CREATING BGP ROUTE-BASED NETWORK TRAFFIC PROFILES TO DETECT SPOOFED TRAFFIC 审中-公开
标题翻译：用于创建基于路由的网络交通配置文件以检测交付流量的系统和方法
公开(公告)号：WO2014011828A2
公开(公告)日：2014-01-16
申请号：PCT/US2013/050002
申请日：2013-07-11
申请人： TELCORDIA TECHNOLOGIES, INC. , KDDI CORPORATION
发明人： VAIDYANATHAN, Ravichander , GHOSH, Abhrajit , YAMADA, Akira , SAWAYA, Yukiko , KUBOTA, Ayumu
IPC分类号： H04L29/06
CPC分类号： H04L63/1425 , H04L63/1483
摘要： An inventive system and method for creating source profiles to detect spoofed traffic comprises obtaining a routing path for data to traverse nodes using traffic profiles, each routing path comprising at least a target AS, initializing one or more AS sets with last hop ASes, enhancing the AS sets by connecting the AS sets to routers, for each enhanced AS set, filtering observed traffic flows, and using the filtered flows to associate enhanced AS sets with network monitoring points to create the source profiles. In one aspect, filtering flows comprise TCP session filtering and/or destination bogon filtering. In one aspect, the routers are border gateway protocol routers. In one aspect, the last hop ASes are one hop away from the target AS.
摘要翻译：用于创建用于检测欺骗性流量的源简档的创新系统和方法包括获得用于使用流量简档遍历所述节点的数据的路由路径，每个路由路径至少包括目标AS，用最后一跳AS初始化一个或多个AS集， AS集合通过将AS集合连接到路由器，针对每个增强型AS集，过滤观察到的业务流，以及使用过滤的流将增强型AS集与网络监控点相关联以创建源简档。在一个方面，过滤流包括TCP会话过滤和/或目的地bogon过滤。一方面，路由器是边界网关协议路由器。一方面，最后一跳ASs距目标AS一跳。

3. 发明申请

WO2013074152A8 METHOD, APPARATUS AND PROGRAM FOR DETECTING SPOOFED NETWORK TRAFFIC 审中-公开
公开(公告)号：WO2013074152A8
公开(公告)日：2013-05-23
申请号：PCT/US2012/040354
申请日：2012-06-01
申请人： TELCORDIA TECHNOLOGIES, INC. , KDDI CORPORATION , VAIDYANATHAN, Ravichander , GHOSH, Abhrajit , NAIDU, Aditya , YAMADA, Akira , KUBOTA, Ayumu , SAWAYA, Yukiko , MIYAKE, Yutaka
发明人： VAIDYANATHAN, Ravichander , GHOSH, Abhrajit , NAIDU, Aditya , YAMADA, Akira , KUBOTA, Ayumu , SAWAYA, Yukiko , MIYAKE, Yutaka
IPC分类号： G06F21/55
摘要： A method, an apparatus and a program for detecting spoofed internet Protocol (IP) traffic directed to a network having a plurality of autonomous systems (AS) is provided. The method comprises receiving an incoming packet through an AS, the incoming packet containing a source IP address and a destination IP address, acquiring a corresponding source and destination IP address prefixes, converting the corresponding source and destination IP address prefixes into a source AS number and a destination AS number, determining if the incoming packet arrived from an unexpected source based upon the corresponding destination IP address prefix and the converted source and destination AS number using an unexpected pair tuple table generated from network routing information and generating an alert indicating that the incoming packet is not allowed to enter the network.

4. 发明申请

WO2014011799A1 SYSTEM AND METHOD FOR SPAMMER HOST DETECTION FROM NETWORK FLOW DATA PROFILES 审中-公开
标题翻译：用于从网络流量数据配置文件进行垃圾邮件主机检测的系统和方法
公开(公告)号：WO2014011799A1
公开(公告)日：2014-01-16
申请号：PCT/US2013/049964
申请日：2013-07-10
申请人： TELCORDIA TECHNOLOGIES, INC. , KDDI CORPORATION
发明人： VASHIST, Akshay , GOTTLIEB, Yitzchak, M. , GHOSH, Abhrajit , SAWAYA, Yukiko , KUBOTA, Ayumu
IPC分类号： H04L29/06
CPC分类号： H04L63/101 , H04L51/12 , H04L63/1425
摘要： A system and method for spammer host detection from network flow data profiles comprises constructing one or more cluster profiles and detecting spammer hosts. Construction cluster profiles comprises observing network flow data from one or more hosts; for each host, representing the network flow data associated with the host as a multidimensional vector; clustering the vectors of the hosts into the plurality of cluster profiles; annotating each cluster profile using at least one of black lists and white lists; and calculating a confidence in each cluster profile annotation. Detecting spammer hosts comprises observing the network flow data from a new host; representing the network flow data associated with the new host as a multidimensional vector, and placing the new multidimensional vector of the new host into one cluster profile of the one or more cluster profiles.
摘要翻译：用于从网络流数据简档发送垃圾邮件主机检测的系统和方法包括构建一个或多个集群简档并检测垃圾邮件发送者主机。构建集群配置文件包括观察来自一个或多个主机的网络流数据; 对于每个主机，将与主机相关联的网络流数据表示为多维向量; 将主机的向量聚类成多个集群简档; 使用黑名单和白名单中的至少一个来标注每个群集简档; 并计算每个聚类配置文件注释的置信度。检测垃圾邮件发送者主机包括观察来自新主机的网络流数据; 将与新主机相关联的网络流数据表示为多维向量，以及将新主机的新多维向量放置到一个或多个集群简档的一个集群简档中。

5. 发明申请

WO2013074152A2 METHOD, APPARATUS AND PROGRAM FOR DETECTING SPOOFED NETWORK TRAFFIC 审中-公开
标题翻译：检测网络交通流量的方法，装置和程序
公开(公告)号：WO2013074152A2
公开(公告)日：2013-05-23
申请号：PCT/US2012/040354
申请日：2012-06-01
申请人： TECLCORDIA TECHNOLOGIES, INC. , KDDI CORPORATION , VAIDYANATHAN, Ravichander , GHOSH, Abhrajit , NAIDU, Aditya , YAMADA, Akira , KUBOTA, Ayumu , SAWAYA, Yukiko , MIYAKE, Yutaka
发明人： VAIDYANATHAN, Ravichander , GHOSH, Abhrajit , NAIDU, Aditya , YAMADA, Akira , KUBOTA, Ayumu , SAWAYA, Yukiko , MIYAKE, Yutaka
IPC分类号： G06F21/55
CPC分类号： G06F21/00 , H04L63/1466
摘要： A method, an apparatus and a program for detecting spoofed internet Protocol (IP) traffic directed to a network having a plurality of autonomous systems (AS) is provided. The method comprises receiving an incoming packet through an AS, the incoming packet containing a source IP address and a destination IP address, acquiring a corresponding source and destination IP address prefixes, converting the corresponding source and destination IP address prefixes into a source AS number and a destination AS number, determining if the incoming packet arrived from an unexpected source based upon the corresponding destination IP address prefix and the converted source and destination AS number using an unexpected pair tuple table generated from network routing information and generating an alert indicating that the incoming packet is not allowed to enter the network.
摘要翻译：提供了一种用于检测针对具有多个自治系统（AS）的网络的欺骗性互联网协议（IP）流量的方法，装置和程序。该方法包括：通过AS接收输入的分组，该分组包含源IP地址和目的IP地址，获取相应的源和目的IP地址前缀，将相应的源和目的IP地址前缀转换为源AS号，目的AS号码，根据网络路由信息生成表示基于相应的目的地IP地址前缀和转换后的源和目的地AS号码，确定传入分组是否从意外的源到达，并产生一个警报，数据包不允许进入网络。

6. 发明申请

WO2013188611A2 SYSTEM AND METHOD FOR REAL-TIME REPORTING OF ANOMALOUS INTERNET PROTOCOL ATTACKS 审中-公开
标题翻译：实时报告异常互联网协议攻击的系统和方法
公开(公告)号：WO2013188611A2
公开(公告)日：2013-12-19
申请号：PCT/US2013/045551
申请日：2013-06-13
申请人： TT GOVERNMENT SOLUTIONS, INC. , KDDI CORPORATION
发明人： GOTTLIEB, Yitzchak , NAIDU, Aditya , GHOSH, Abhrajit , YAMADA, Akira , SAWAYA, Yukiko , KUBOTA, Ayumu
IPC分类号： H04L29/06
CPC分类号： H04L63/1416 , H04L63/1458
摘要： A system and a method for detecting anomalous attacks in Internet network flow operate by counting a number of Internet traffic messages that are detected as anomalous attacks to provide a count; computing a running average of the number of messages that are detected as anomalous attacks; and comparing the count to the running average to provide an anomalous attack alarm if the count is greater than a multiple of the running average. The attacks can include at least one of spoofing attacks or denial of service attacks. A computer readable storage medium stores instructions of a computer program, which when executed by a computer system, results in performance of steps of the method.
摘要翻译：用于检测因特网网络流量异常攻击的系统和方法通过对被检测为异常攻击的多个因特网流量消息进行计数来提供计数来进行操作; 计算被检测为异常攻击的消息数量的运行平均值; 并且将计数与运行平均值进行比较，以在计数大于运行平均值的倍数时提供异常攻击报警。这些攻击可以包括至少一种欺骗攻击或拒绝服务攻击。计算机可读存储介质存储计算机程序的指令，该计算机程序在由计算机系统执行时导致执行该方法的步骤。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式