公开(公告)号：US20150381639A1

公开(公告)日：2015-12-31

申请号：US14846188

申请日：2015-09-04

申请人： THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK

发明人： Salvatore J. Stolfo ,  Tal Malkin ,  Angelos D. Keromytis ,  Vishal Misra ,  Michael Locasto ,  Janak Parekh

IPC分类号： H04L29/06

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/554 ,  H04L63/145 ,  H04L63/1475 ,  H04L63/1491

摘要： Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems are provided. These systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed without generating excess traffic loads.

摘要翻译： 提供了在协作计算机系统之间关联和分发入侵警报信息的系统和方法。 这些系统和方法提供警报相关器和警报分发器，其使得能够检测到攻击的早期迹象并且迅速地传播到协作系统。 警报相关器利用数据结构来关联警报检测，并提供可以向其他协作系统透露威胁信息的机制。 警报分配器使用有效的技术来对协作系统进行分组，然后根据时间表在某些成员之间传递数据。 以这种方式，数据可以常规分配，而不会产生过多的流量负载。

公开(公告)号：US09135438B2

公开(公告)日：2015-09-15

申请号：US13743232

申请日：2013-01-16

申请人： The Trustees of Columbia University in the City of New York

发明人： Salvatore J Stolfo ,  Tal Malkin ,  Angelos D Keromytis ,  Vishal Misra ,  Michael Locasto ,  Janak Parekh

IPC分类号： H04L29/06 ,  G06F21/55

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/554 ,  H04L63/145 ,  H04L63/1475 ,  H04L63/1491

摘要： Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems are provided. These systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed without generating excess traffic loads.

摘要翻译： 提供了在协作计算机系统之间关联和分发入侵警报信息的系统和方法。 这些系统和方法提供警报相关器和警报分发器，其使得能够检测到攻击的早期迹象并且迅速地传播到协作系统。 警报相关器利用数据结构来关联警报检测，并提供一种机制，通过该机制可以向其他协作系统显示威胁信息。 警报分配器使用有效的技术来对协作系统进行分组，然后根据时间表在某些成员之间传递数据。 以这种方式，数据可以定期分布，而不会产生过多的流量负载。

公开(公告)号：US10038704B2

公开(公告)日：2018-07-31

申请号：US14846188

申请日：2015-09-04

申请人： The Trustees of Columbia University in the City of New York

发明人： Salvatore J. Stolfo ,  Tal Malkin ,  Angelos D. Keromytis ,  Vishal Misra ,  Michael Locasto ,  Janak Parekh

IPC分类号： H04L29/06 ,  G06F21/55

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/554 ,  H04L63/145 ,  H04L63/1475 ,  H04L63/1491

摘要： Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems are provided. These systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed without generating excess traffic loads.

公开(公告)号：US20130318606A1

公开(公告)日：2013-11-28

申请号：US13743232

申请日：2013-01-16

申请人： The Trustees of Columbia University in the City of New York

发明人： Salvatore J. Stolfo ,  Tal Malkin ,  Angelos D. Keromytis ,  Vishal Misra ,  Michael Locasto ,  Janak Parekh

IPC分类号： G06F21/55

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/554 ,  H04L63/145 ,  H04L63/1475 ,  H04L63/1491

摘要： Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems are provided. These systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed, without generating excess traffic loads.

摘要翻译： 提供了在协作计算机系统之间关联和分发入侵警报信息的系统和方法。 这些系统和方法提供警报相关器和警报分发器，其使得能够检测到攻击的早期迹象并且迅速地传播到协作系统。 警报相关器利用数据结构来关联警报检测，并提供可以向其他协作系统透露威胁信息的机制。 警报分配器使用有效的技术来对协作系统进行分组，然后根据时间表在某些成员之间传递数据。 以这种方式，数据可以定期分布，而不会产生过多的流量负载。