中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

17 records (took 0.014 seconds)

    Detecting encrypted malware with SPLT-based deep networks
    13.
    发明授权
    Detecting encrypted malware with SPLT-based deep networks 有权

    公开(公告)号：US11201877B2

    公开(公告)日：2021-12-14

    申请号：US16216361

    申请日：2018-12-11

    Applicant: Cisco Technology, Inc.

    Inventor： Karel Bartos ,  Martin Vejman

    IPC: H04L29/06 ,  G06N3/04 ,  G06N3/08

    Abstract: In one embodiment, a device obtains telemetry data for a plurality of encrypted traffic flows observed in a network. The device clusters the flows into observed flow clusters, based on one or more flow-level features of the obtained telemetry data, as well as malware-related traffic telemetry data into malware-related flow clusters. The observed and malware-related telemetry data are indicative of sequence of packet lengths and times (SPLT) information for the traffic flows. The device samples sets of flows from the observed and malware-related flow clusters, with each set including at least one flow from an observed flow cluster and at least one flow from a malware-related flow cluster. The device trains a deep learning neural network to determine whether a particular encrypted traffic flow is malware-related, by using the SPLT information for the sampled sets of traffic flows as input to an input layer of neurons of the deep network.

    PROTECTING ENDPOINTS WITH PATTERNS FROM ENCRYPTED TRAFFIC ANALYTICS
    14.
    发明申请
    PROTECTING ENDPOINTS WITH PATTERNS FROM ENCRYPTED TRAFFIC ANALYTICS 审中-公开

    公开(公告)号：US20200236131A1

    公开(公告)日：2020-07-23

    申请号：US16251322

    申请日：2019-01-18

    Applicant: Cisco Technology, Inc.

    Inventor： Martin Vejman ,  Karel Bartos ,  Vitek Zlamal

    IPC: H04L29/06 ,  H04L12/24 ,  H04L12/26 ,  G06N3/04 ,  G06N3/08 ,  G06N20/00

    Abstract: In one embodiment, an encrypted traffic analytics service captures telemetry data regarding encrypted network traffic associated with a first endpoint device in a network. The encrypted traffic analytics service receives, from the first endpoint device, an indication that a security agent executed on the first endpoint device has detected malware on the first endpoint device. The encrypted traffic analytics service constructs one or more patterns of encrypted traffic using the captured telemetry data from a time period associated with the received indication. The encrypted traffic analytics service uses the one or more patterns of encrypted traffic to detect malware on a second endpoint device by comparing the one or more patterns of encrypted traffic to telemetry data regarding encrypted network traffic associated with the second endpoint device.

    Graph prioritization for improving precision of threat propagation algorithms
    15.
    发明授权
    Graph prioritization for improving precision of threat propagation algorithms 有权

    公开(公告)号：US10523691B2

    公开(公告)日：2019-12-31

    申请号：US15400389

    申请日：2017-01-06

    Applicant: Cisco Technology, Inc.

    Inventor： Martin Vejman ,  Lukas Machlica

    IPC: G06N20/00 ,  H04L29/06 ,  G06N7/00 ,  G06N5/02 ,  H04L29/12

    Abstract: Systems described herein preemptively detect newly registered network domains that are likely to be malicious before network behavior of the domains is actually observed. A network security device (e.g., a router) receives domain registration data that associates network domains with keys and generating a graph representing the domain registration data. Each edge of the graph connects a vertex representing a domain and a vertex representing a registration attribute (e.g., a registrant email address). The network security device identifies a connected component of the graph that meets a graph robustness threshold. The network security device determines whether a domain of the connected component whose behavior has not yet been observed is malicious using a predictive model based on existing maliciousness labels for other domains of the connected component.

    Filtering onion routing traffic from malicious domain generation algorithm (DGA)-based traffic classification
    16.
    发明授权
    Filtering onion routing traffic from malicious domain generation algorithm (DGA)-based traffic classification 有权

    公开(公告)号：US10375096B2

    公开(公告)日：2019-08-06

    申请号：US15372580

    申请日：2016-12-08

    Applicant: Cisco Technology, Inc.

    Inventor： Lukas Machlica ,  Martin Vejman

    IPC: H04L29/06 ,  H04L12/26

    Abstract: In one embodiment, a device in a network receives domain information from a plurality of traffic flows in the network. The device identifies a particular address from the plurality of traffic flows as part of an onion routing system based on the received domain information. The device distinguishes the particular address during analysis of the traffic flows by a traffic flow analyzer that includes a domain generation algorithm (DGA)-based traffic classifier. The device detects a malicious traffic flow from among the plurality of traffic flows using the traffic flow analyzer. The device causes performance of a mitigation action based on the detected malicious traffic flow.

Patent Agency Ranking