-
1.发明授权Network security system having a device profiler communicatively coupled to a traffic monitor 有权网络安全系统具有通信耦合到业务监视器的设备分析器公开(公告)号：US08020211B2
公开(公告)日：2011-09-13
申请号：US12552264
申请日：2009-09-01
IPC分类号： G08B23/00 , G06F15/16 , G06F12/14 , G06F11/30 , G06F15/173 , G06F11/00 , H04L29/06 , H04L9/32
CPC分类号： H04L63/1416 , H04L63/1425 , H04L63/1433
摘要： A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attack signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.
摘要翻译： 一种用于提供网络的分布式安全性的系统和方法。 一些设备剖析器放置在网络的不同位置，以从不同的角度评估漏洞。 设备剖析器识别网络上的主机，以及主机上运行的操作系统和应用程序等特性。 设备剖析器遍历具有代表主机特征的节点的漏洞树，每个节点具有相关的潜在漏洞集合。 验证规则可以验证潜在的漏洞。 在网络中央可访问的位置处的集中式相关服务器存储所确定的网络的漏洞，并将确定的漏洞与攻击签名相关联。 流量监视器访问攻击签名并监视网络流量以针对确定的漏洞进行攻击。
-
2.发明授权Network security system having a device profiler communicatively coupled to a traffic monitor 有权网络安全系统具有通信耦合到业务监视器的设备分析器公开(公告)号：US07181769B1
公开(公告)日：2007-02-20
申请号：US10456837
申请日：2003-06-06
CPC分类号： H04L63/1416 , H04L63/1425 , H04L63/1433
摘要： A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attach signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.
摘要翻译： 一种用于提供网络的分布式安全性的系统和方法。 一些设备剖析器放置在网络的不同位置，以从不同的角度评估漏洞。 设备剖析器识别网络上的主机，以及主机上运行的操作系统和应用程序等特性。 设备剖析器遍历具有代表主机特征的节点的漏洞树，每个节点具有相关的潜在漏洞集合。 验证规则可以验证潜在的漏洞。 在网络中央可访问的位置处的集中式相关服务器存储所确定的网络的漏洞，并将所确定的漏洞与附加签名相关联。 流量监视器访问攻击签名并监视网络流量以针对确定的漏洞进行攻击。
-
公开(公告)号：US08918883B1
公开(公告)日：2014-12-23
申请号：US11424088
申请日：2006-06-14
IPC分类号： G06F12/14
CPC分类号： G06F21/577 , G06F2221/2149 , H04L63/1433
摘要： An enterprise network includes hosts running services. Some of the services have security vulnerabilities. There are one or more threat zones associated with the network. For example, a firewall may create two threat zones, one internal to the firewall and one external to it. A device profiler in the first threat zone profiles the hosts on the network and identifies the vulnerabilities that are present. A device profiler in the second threat zone determines which of the identified vulnerabilities are accessible from its zone. A risk module calculates the risk associated with a vulnerability based on the vulnerability's severity, threat level metrics for the threat zones, and an asset value of the host with the vulnerability. A reporting module prioritizes the vulnerabilities based on their risks.
摘要翻译： 企业网络包括运行服务的主机。 一些服务有安全漏洞。 存在与网络相关联的一个或多个威胁区域。 例如，防火墙可能会创建两个威胁区域，一个在防火墙内部，另一个在外部。 第一个威胁区域中的设备分析器将配置网络上的主机并识别出现的漏洞。 第二个威胁区域中的设备分析器确定哪个已识别的漏洞可从其区域访问。 风险模块根据漏洞的严重性，威胁区域的威胁级别度量以及具有漏洞的主机的资产值计算与漏洞相关的风险。 报告模块根据风险优先考虑漏洞。
-
公开(公告)号：US08615572B1
公开(公告)日：2013-12-24
申请号：US13714022
申请日：2012-12-13
IPC分类号： G06F15/16 , G06F15/173 , G06F15/177
CPC分类号： H04L63/029 , H04L41/50 , H04L61/2007 , H04L61/2503 , H04L61/2535 , H04L61/2592 , H04L61/6068
摘要： A network services platform provides services to remote enterprise networks. The services platform provides a control module to a computer in the enterprise network. The control module executes on the computer and interacts with the services platform to establish an Internet Protocol (IP) tunnel between the services platform and the computer. The control module also establishes a bridge between the IP tunnel and the enterprise network. The services platform allocates a unique private IP address space to the enterprise network, and translates IP addresses in network communications between enterprise network addresses and corresponding services platform addresses in the allocated unique private address space. The services platform provides network services to the enterprise network via the IP tunnel and bridge.
-
5.发明授权Network security system having a device profiler communicatively coupled to a traffic monitor 有权网络安全系统具有通信耦合到业务监视器的设备分析器公开(公告)号：US08176544B2
公开(公告)日：2012-05-08
申请号：US13020775
申请日：2011-02-03
CPC分类号： H04L63/1416 , H04L63/1425 , H04L63/1433
摘要： A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attack signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.
摘要翻译： 一种用于提供网络的分布式安全性的系统和方法。 一些设备剖析器放置在网络的不同位置，以从不同的角度评估漏洞。 设备剖析器识别网络上的主机，以及主机上运行的操作系统和应用程序等特性。 设备剖析器遍历具有代表主机特征的节点的漏洞树，每个节点具有相关的一组潜在漏洞。 验证规则可以验证潜在的漏洞。 在网络中央可访问的位置处的集中式相关服务器存储所确定的网络的漏洞，并将确定的漏洞与攻击签名相关联。 流量监视器访问攻击签名并监视网络流量以针对确定的漏洞进行攻击。
-
6.发明申请NETWORK SECURITY SYSTEM HAVING A DEVICE PROFILER COMMUNICATIVELY COUPLED TO A TRAFFIC MONITOR 有权具有与交通监控器通信的设备配置文件的网络安全系统公开(公告)号：US20090320138A1
公开(公告)日：2009-12-24
申请号：US12552264
申请日：2009-09-01
IPC分类号： G06F15/18 , G06F15/173 , H04L29/06 , H04L9/32 , G06F11/30 , G06F11/00 , G06F15/16 , G08B23/00
CPC分类号： H04L63/1416 , H04L63/1425 , H04L63/1433
摘要： A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attack signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.
摘要翻译： 一种用于提供网络的分布式安全性的系统和方法。 一些设备剖析器放置在网络的不同位置，以从不同的角度评估漏洞。 设备剖析器识别网络上的主机，以及主机上运行的操作系统和应用程序等特性。 设备剖析器遍历具有代表主机特征的节点的漏洞树，每个节点具有相关的潜在漏洞集合。 验证规则可以验证潜在的漏洞。 在网络中央可访问的位置处的集中式相关服务器存储所确定的网络的漏洞，并将确定的漏洞与攻击签名相关联。 流量监视器访问攻击签名并监视网络流量以针对确定的漏洞进行攻击。
-
公开(公告)号：US09509711B1
公开(公告)日：2016-11-29
申请号：US13363857
申请日：2012-02-01
申请人： Timothy D. Keanini , Brent R. Torre , James A. Acquaviva , Patrick J. McNerthney , Robert W. Thomas
发明人： Timothy D. Keanini , Brent R. Torre , James A. Acquaviva , Patrick J. McNerthney , Robert W. Thomas
CPC分类号： H04L63/1433 , G06F21/6227 , G06F21/6254
摘要： An organization's security data is compared to an aggregation of multiple organizations' security data. Security data is received from multiple organizations having organizational characteristics. The received security data is aggregated based on the organizational characteristics to generate sets of aggregate data associated with the organizational characteristics. A query is received from an organization of the multiple organizations. The query specifies a particular organizational characteristic. A set of aggregate data associated with the specified organizational characteristic is identified. A representation of the organization's security data in relation to the identified set of aggregate data is generated. The representation is transmitted to the organization in response to the query.
摘要翻译： 将组织的安全数据与多个组织的安全数据的聚合进行比较。 从具有组织特征的多个组织收到安全数据。 接收到的安全数据将根据组织特征进行聚合，以生成与组织特征相关联的集合数据集。 从多个组织的组织收到查询。 该查询指定了特定的组织特征。 识别与指定的组织特征相关联的一组聚合数据。 生成与所识别的集合数据集相关的组织的安全数据的表示。 响应于查询，该表示被传送到组织。
-
公开(公告)号：US08356089B1
公开(公告)日：2013-01-15
申请号：US13531248
申请日：2012-06-22
IPC分类号： G06F15/16 , G06F15/173 , G06F15/177
CPC分类号： H04L63/029 , H04L41/50 , H04L61/2007 , H04L61/2503 , H04L61/2535 , H04L61/2592 , H04L61/6068
摘要： A network services platform provides services to remote enterprise networks. The services platform provides a control module to a computer in the enterprise network. The control module executes on the computer and interacts with the services platform to establish an Internet Protocol (IP) tunnel between the services platform and the computer. The control module also establishes a bridge between the IP tunnel and the enterprise network. The services platform allocates a unique private IP address space to the enterprise network, and translates IP addresses in network communications between enterprise network addresses and corresponding services platform addresses in the allocated unique private address space. The services platform provides network services to the enterprise network via the IP tunnel and bridge.
-
9.发明授权Network security system having a device profiler communicatively coupled to a traffic monitor 有权网络安全系统具有通信耦合到业务监视器的设备分析器公开(公告)号：US07594273B2
公开(公告)日：2009-09-22
申请号：US11676051
申请日：2007-02-16
IPC分类号： G06F15/18 , G08B23/00 , G06F15/16 , H04L29/06 , H04L9/32 , G06F11/30 , G06F15/173 , G06F11/00
CPC分类号： H04L63/1416 , H04L63/1425 , H04L63/1433
摘要： A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attack signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.
摘要翻译： 一种用于提供网络的分布式安全性的系统和方法。 一些设备剖析器放置在网络的不同位置，以从不同的角度评估漏洞。 设备剖析器识别网络上的主机，以及主机上运行的操作系统和应用程序等特性。 设备剖析器遍历具有代表主机特征的节点的漏洞树，每个节点具有相关的潜在漏洞集合。 验证规则可以验证潜在的漏洞。 在网络中央可访问的位置处的集中式相关服务器存储所确定的网络的漏洞，并将确定的漏洞与攻击签名相关联。 流量监视器访问攻击签名并监视网络流量以针对确定的漏洞进行攻击。
-
公开(公告)号：US09280667B1
公开(公告)日：2016-03-08
申请号：US11033414
申请日：2005-01-10
CPC分类号： G06F21/577 , G06F2221/034 , H04L63/1433
摘要： A system comprises a security manager to scan a network for host instances representing hosts on the network at that time, and record characteristics of the host instances in a host record. The security manager subsequently scans the network for host instances in order to identify persistent hosts. A host profiling module takes snapshots of the network to generate host instances based on characteristics such as an IP address, a NetBIOS name, a DNS name, a MAC address. A host matching module correlates host instances from different snapshots using weighted rules (predetermined or customized) to discriminate between multiple potential matching host instances. Also, security logic makes security decisions based on data including persistent host information.
摘要翻译： 一个系统包括一个安全管理器，用于扫描一个网络，用于在当时在网络上表示主机的主机实例，并记录主机实例在主机记录中的特征。 安全管理器随后扫描网络以获取主机实例，以便识别持久主机。 主机分析模块根据IP地址，NetBIOS名称，DNS名称，MAC地址等特征，对网络的快照进行生成。 主机匹配模块使用加权规则（预定或自定义）来相互关联来自不同快照的主机实例，以区分多个潜在匹配的主机实例。 此外，安全逻辑基于包括持久主机信息的数据进行安全决策。
-
-
-
-
-
-
-
-
-
搜索结果
12 条记录 (耗时 0.019 秒)
