利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

4 条记录 (耗时 0.011 秒)

    BOTNET EARLY DETECTION USING HYBRID HIDDEN MARKOV MODEL ALGORITHM
    1.
    发明申请
    BOTNET EARLY DETECTION USING HYBRID HIDDEN MARKOV MODEL ALGORITHM 有权
    BOTNET早期检测使用混合隐马尔可夫模型算法

    公开(公告)号：US20110004936A1

    公开(公告)日：2011-01-06

    申请号：US12726272

    申请日：2010-03-17

    申请人： Hahn-Ming Lee ,  Ching-Hao Mao ,  Yu-Jie Chen ,  Yi-Hsun Wang ,  Jerome Yeh ,  Tsu-Han Chen

    发明人： Hahn-Ming Lee ,  Ching-Hao Mao ,  Yu-Jie Chen ,  Yi-Hsun Wang ,  Jerome Yeh ,  Tsu-Han Chen

    IPC分类号： G06F21/00

    CPC分类号： H04L63/1441 ,  H04L2463/144

    摘要： A botnet detection system is provided. A bursty feature extractor receives an Internet Relay Chat (IRC) packet value from a detection object network, and determines a bursty feature accordingly. A Hybrid Hidden Markov Model (HHMM) parameter estimator determines probability parameters for a Hybrid Hidden Markov Model according to the bursty feature. A traffic profile generator establishes a probability sequential model for the Hybrid Hidden Markov Model according to the probability parameters and pre-defined network traffic categories. A dubious state detector determines a traffic state corresponding to a network relaying the IRC packet in response to reception of a new IRC packet, determines whether the IRC packet flow of the object network is dubious by applying the bursty feature to the probability sequential model for the Hybrid Hidden Markov Model, and generates a warning signal when the IRC packet flow is regarded as having a dubious traffic state.

    摘要翻译： 提供僵尸网络检测系统。 突发特征提取器从检测对象网络接收因特网中继聊天（IRC）分组值，并相应地确定突发特征。 混合隐马尔可夫模型（HHMM）参数估计器根据突发特征确定混合隐马尔可夫模型的概率参数。 流量简档生成器根据概率参数和预定义的网络流量类别建立混合隐马尔可夫模型的概率序列模型。 可疑状态检测器响应于接收到新的IRC分组而确定与中继IRC分组的网络相对应的业务状态，通过将突发特征应用于概率序列模型来确定对象网络的IRC分组流是否可疑， 混合隐马尔可夫模型，并且当IRC分组流被认为具有可疑业务状态时，生成警告信号。

    Botnet early detection using hybrid hidden markov model algorithm
    4.
    发明授权
    Botnet early detection using hybrid hidden markov model algorithm 有权
    僵尸网络早期检测使用混合隐马尔可夫模型算法

    公开(公告)号：US08307459B2

    公开(公告)日：2012-11-06

    申请号：US12726272

    申请日：2010-03-17

    申请人： Hahn-Ming Lee ,  Ching-Hao Mao ,  Yu-Jie Chen ,  Yi-Hsun Wang ,  Jerome Yeh ,  Tsu-Han Chen

    发明人： Hahn-Ming Lee ,  Ching-Hao Mao ,  Yu-Jie Chen ,  Yi-Hsun Wang ,  Jerome Yeh ,  Tsu-Han Chen

    IPC分类号： G06F7/04 ,  G06F11/00

    CPC分类号： H04L63/1441 ,  H04L2463/144

    摘要： A botnet detection system is provided. A bursty feature extractor receives an Internet Relay Chat (IRC) packet value from a detection object network, and determines a bursty feature accordingly. A Hybrid Hidden Markov Model (HHMM) parameter estimator determines probability parameters for a Hybrid Hidden Markov Model according to the bursty feature. A traffic profile generator establishes a probability sequential model for the Hybrid Hidden Markov Model according to the probability parameters and pre-defined network traffic categories. A dubious state detector determines a traffic state corresponding to a network relaying the IRC packet in response to reception of a new IRC packet, determines whether the IRC packet flow of the object network is dubious by applying the bursty feature to the probability sequential model for the Hybrid Hidden Markov Model, and generates a warning signal when the IRC packet flow is regarded as having a dubious traffic state.

    摘要翻译： 提供僵尸网络检测系统。 突发特征提取器从检测对象网络接收因特网中继聊天（IRC）分组值，并相应地确定突发特征。 混合隐马尔可夫模型（HHMM）参数估计器根据突发特征确定混合隐马尔可夫模型的概率参数。 流量简档生成器根据概率参数和预定义的网络流量类别建立混合隐马尔可夫模型的概率序列模型。 可疑状态检测器响应于接收到新的IRC分组而确定与中继IRC分组的网络相对应的业务状态，通过将突发特征应用于概率序列模型来确定对象网络的IRC分组流是否可疑， 混合隐马尔可夫模型，并且当IRC分组流被认为具有可疑业务状态时，生成警告信号。