会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 5. 发明申请
    • SYSTEMS AND METHODS FOR DETECTING AND RESPONDING TO SECURITY THREATS USING APPLICATION EXECUTION AND CONNECTION LINEAGE TRACING
    • 使用应用执行和连接线追踪检测和应对安全威胁的系统和方法
    • WO2017100364A1
    • 2017-06-15
    • PCT/US2016/065450
    • 2016-12-07
    • PRISMO SYSTEMS INC.
    • VENKATRAMANI, AnjanCHAO, Chihwei
    • G06F3/048G06F12/14H04J1/16
    • H04L63/1416H04L63/0272H04L63/1425H04L63/20
    • Systems and methods for detecting and responding to security threats using application execution and connection lineage tracing in accordance with embodiments of the invention are disclosed-. In one embodiment, a process for detecting suspicious activity in a network and in a computer server system includes receiving at a collector server a first piece of activity data including a first set of attributes, each attribute having a particular value, combining a first set of context information with the first piece of activity data to generate a first activity record, comparing the first activity record to a set of baseline signatures, where each baseline signature includes a second set of attributes, each attribute having a particular value and each baseline signature being unique in the combination of values of its attributes, and incrementing a count of a first matching baseline signature from the set of baseline signatures.
    • 公开了使用根据本发明实施例的应用执行和连接沿袭跟踪来检测和响应安全威胁的系统和方法。 在一个实施例中,用于检测网络中和计算机服务器系统中的可疑活动的过程包括在收集器服务器处接收包括第一组属性的第一活动数据,每个属性具有特定值,组合第一组 上下文信息与第一活动数据一起生成第一活动记录,将第一活动记录与一组基准签名进行比较,其中每个基准签名包括第二组属性,每个属性具有特定值并且每个基准签名是 在其属性值的组合中是唯一的,并且增加来自该组基准签名的第一匹配基线签名的计数。
    • 6. 发明申请
    • DEVICE FINGERPRINTING FOR CYBER-PHYSICAL SYSTEMS
    • 装置指纹识别系统
    • WO2016144793A1
    • 2016-09-15
    • PCT/US2016/020985
    • 2016-03-04
    • GEORGIA TECH RESEARCH CORPORATION
    • BEYAH, Abdul, RaheemFORMBY, DavidSRINIVASAN, Preethi
    • G06F12/08G06F15/16H04J1/16
    • H04L43/0876G06F15/16H04L43/065H04L63/0876H04L63/1408
    • Disclosed are various embodiment's for fingerprinting devices that are part of a network. A network monitoring device monitors traffic between devices in the network. A fingerprint is generated based upon response times of the devices in the network. Embodiment's of the present disclosure provide for device fingerprinting in cyber-physical system, such as a control system environment. Embodiment's of the present disclosure can be used in conjunction with traditional intrusion detection system (IDS) in a control systems environment. Embodiment's of the present disclosure can be used to achieve device fingerprinting from software, hardware, and physics-based perspectives. Embodiment's of the present disclosure can prevent security compromises by accurately fingerprinting devices in a control system environment, and other networked environments, as may be appreciated. Embodiment's of the present disclosure can generate fingerprints of a device which reflects identifiable characteristics of a device, such as, e.g., processing speed, processing load, memory speed, and protocol stack implementation.
    • 公开了作为网络一部分的指纹设备的各种实施例。 网络监控设备监控网络中设备之间的流量。 基于网络中设备的响应时间生成指纹。 本公开的实施例提供了诸如控制系统环境的网络物理系统中的设备指纹识别。 本公开的实施例可以与控制系统环境中的传统入侵检测系统(IDS)结合使用。 本公开的实施例可以用于从软件,硬件和基于物理的角度实现设备指纹识别。 本公开的实施例可以通过在控制系统环境和其他网络环境中精确地指纹化设备来防止安全性损害,如可以理解的。 本公开的实施例可以生成反映设备的可识别特征的设备的指纹,例如处理速度,处理负载,存储器速度和协议栈实现。
    • 10. 发明申请
    • DETECTION OF NONCONFORMING NETWORK TRAFFIC FLOW AGGREGATES FOR MITIGATING DISTRIBUTED DENIAL OF SERVICE ATTACKS
    • 检测非协调网络业务流集合以减轻分布式拒绝服务攻击
    • WO2008036748A9
    • 2008-05-08
    • PCT/US2007078903
    • 2007-09-19
    • UNIV MARYLANDKHANDANI MEHDI KALANTARISHAYMAN MARK A
    • KHANDANI MEHDI KALANTARISHAYMAN MARK A
    • H04J1/16H04L12/56
    • H04L47/10H04L47/326H04L63/1416H04L63/1458
    • An estimate of a portion of network traffic that is nonconforming to a communication transmission control protocol is used to signal that a distributed denial of service attack may be occurring. Traffic flows are aggregated and packets are intentionally dropped from the flow aggregate in accordance with an assigned perturbation signature. The flow aggregates are observed to determine if the rate of arrival of packets that have a one-to-one transmission correspondence with the dropped packets are similarly responsive to the perturbation signature. By assigning orthogonal perturbation signatures to different routers, multiple routers may perform the test on the aggregate and the results of the test will be correctly ascertained at each router. Nonconforming aggregates may be redefined to finer granularity to determine the node on the network that is under attack, which may then take mitigating action.
    • 使用不符合通信传输控制协议的网络流量的一部分的估计来表示可能正在发生分布式拒绝服务攻击。 根据分配的扰动签名,业务流被聚合并且数据包有意从流聚合中丢弃。 观察流集合以确定与丢弃的分组具有一对一传输对应关系的分组的到达速率是否类似地响应于扰动签名。 通过将正交扰动签名分配给不同的路由器,多个路由器可以在集合上执行测试,并且将在每个路由器处正确确定测试结果。 可以将不合格的聚合重新定义为更精细的粒度,以确定网络中受到攻击的节点,然后可以采取缓解措施。