公开(公告)号：US09503465B2

公开(公告)日：2016-11-22

申请号：US14080532

申请日：2013-11-14

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Baris Coskun

IPC: G06F21/50 ,  H04L29/06

CPC classification number: H04L63/1425 ,  G06F17/30864 ,  H04L43/04 ,  H04L63/0254 ,  H04L63/1416

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to learn malicious activity. An example method includes assigning weights of a distance function to respective statistical features; iteratively calculating, with a processor, the distance function to adjust the weights (1) to cause a reduction in a first distance calculated according to the distance function for a first pair of entities in a reference group associated with malicious activity and (2) to cause an increase in a second distance calculated according to the distance function for a first one of the entities included in the reference group and a second entity not included in the reference group; and determining whether a first statistical feature is indicative of malicious activity based on a respective adjusted weight of the first statistical feature determined after calculating the distance function for a number of iterations.

Abstract translation: 公开了方法，装置，系统和制品来学习恶意活动。 一种示例性方法包括将距离函数的权重分配给相应的统计特征; 使用处理器迭代地计算所述距离函数以调整所述权重（1）以导致根据与恶意活动相关联的参考组中的第一对实体的距离函数计算的第一距离的减小;以及（2）至 导致对于包括在参考组中的第一个实体和不包括在参考组中的第二实体的根据距离函数计算的第二距离的增加; 以及基于在计算多个迭代的距离函数之后确定的所述第一统计特征的相应调整的权重来确定第一统计特征是否指示恶意活动。

公开(公告)号：US20160308837A1

公开(公告)日：2016-10-20

申请号：US15194037

申请日：2016-06-27

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Arati Baliga ,  Xu Chen ,  Baris Coskun ,  Gustavo de los Reyes ,  Seungjoon Lee ,  Suhas Mathur ,  Jacobus Van der Merwe ,  Gang Xu

IPC: H04L29/06 ,  H04W12/08

CPC classification number: H04L63/0272 ,  H04L63/1416 ,  H04L63/145 ,  H04L63/1458 ,  H04W12/08

Abstract: Methods and apparatus to configure virtual private mobile networks are disclosed. Example methods include provisioning a virtual private mobile network within a wireless network, and, after provisioning the virtual private mobile network, determining whether a first communication from a user equipment matches a security event profile. When the first communication matches the profile, the example methods include transmitting, from the wireless network via a first base transceiver station, an instruction to cause the user equipment to be communicatively coupled to the virtual private mobile network. The example methods further include instructing the user equipment to transmit a second communication through a second base transceiver station that is physically separate from the first base transceiver station and through the virtual private mobile network. In the example methods, the virtual private mobile network is isolated in a wireless spectrum from other portions of the network.

Abstract translation: 公开了配置虚拟专用移动网络的方法和装置。 示例性方法包括在无线网络内配置虚拟专用移动网络，并且在配置虚拟专用移动网络之后，确定来自用户设备的第一通信是否匹配安全事件简档。 当第一通信与简档匹配时，示例性方法包括经由第一基站收发器从无线网络发送使得用户设备通信地耦合到虚拟专用移动网络的指令。 示例性方法还包括指示用户设备通过与第一基站收发器物理分离并通过虚拟专用移动网络的第二基站收发器发送第二通信。 在示例性方法中，虚拟专用移动网络在来自网络的其他部分的无线频谱中被隔离。

公开(公告)号：US20170070528A1

公开(公告)日：2017-03-09

申请号：US15354214

申请日：2016-11-17

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Baris Coskun

IPC: H04L29/06 ,  H04L12/26 ,  G06F17/30

CPC classification number: H04L63/1425 ,  G06F17/30864 ,  H04L43/04 ,  H04L63/0254 ,  H04L63/1416

Abstract: Example network monitoring methods disclosed herein include iteratively adjusting respective weights assigned to respective types of network activity features for devices monitored in a network, the iterative adjusting to determine an output set of weights corresponding to ones of the types of network activity features indicative of malicious network activity. For example, the iterative adjusting is to (1) reduce a first distance calculated between a first pair of reference devices previously classified as being associated with malicious network activity, and (2) increase a second distance calculated between a first one of the pair of the reference devices and a first unclassified device. Disclosed example network monitoring methods also include determining whether a second unclassified device is associated with malicious network activity based on the output set of weights.

Abstract translation: 本文公开的示例性网络监视方法包括迭代地调整分配给网络中监视的设备的各种类型的网络活动特征的相应权重，所述迭代调整以确定与指示恶意网络的网络活动特征中的一种类型的对应的输出权重集合 活动。 例如，迭代调整是（1）减少先前被分类为与恶意网络活动相关联的第一对参考设备之间计算的第一距离，以及（2）增加在一对 参考设备和第一个未分类设备。 公开的示例性网络监控方法还包括基于输出的权重集来确定第二未分类设备是否与恶意网络活动相关联。

公开(公告)号：US20170004217A1

公开(公告)日：2017-01-05

申请号：US15269096

申请日：2016-09-19

Applicant: AT&T Intellectual Property I, L.P.

Inventor： ANDREA G. FORTE ,  Baris Coskun ,  Qi Shen ,  Ilona Murynets ,  Jeffrey Bickford ,  Mikhail lstomin ,  Paul Giura ,  Roger Piqueras Jover ,  Ramesh Subbaraman ,  Suhas Mathur ,  Wei Wang

IPC: G06F17/30

CPC classification number: G06F17/30867 ,  G06F17/30554 ,  G06Q10/00

Abstract: A method, non-transitory computer readable medium and apparatus for deriving trustful metadata for an application are disclosed. For example, the method crawls online for the application, analyzes the application to determine a function of the application, and generates trustful meta-data for the application based upon the function of the application.

Abstract translation: 公开了一种用于为应用导出可信赖元数据的方法，非暂时计算机可读介质和装置。 例如，该方法在线应用程序进行爬网，分析应用程序以确定应用程序的功能，并根据应用程序的功能为应用程序生成可信赖的元数据。

公开(公告)号：US20150163235A1

公开(公告)日：2015-06-11

申请号：US14099600

申请日：2013-12-06

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Baris Coskun ,  Suhrid Balakrishnan ,  Suhas Mathur

IPC: H04L29/06

CPC classification number: H04L63/1416 ,  H04L63/14 ,  H04L63/1408 ,  H04L63/1425 ,  H04L2463/146

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to identify an Internet protocol address blacklist boundary. An example method includes identifying a netblock associated with a malicious Internet protocol address, the netblock having a lower boundary and an upper boundary, collecting netflow data associated with a plurality of Internet protocol addresses in the netblock, establishing a first window associated with a lower portion of Internet protocol addresses numerically lower than a candidate Internet protocol address, establishing a second window associated with an upper portion of Internet protocol addresses numerically higher than a candidate Internet protocol address, calculating a breakpoint score based on a comparison between a behavioral profile of the first window and a behavioral profile of the second window, and identifying a first sub-netblock when the breakpoint score exceeds a threshold value.

Abstract translation: 公开了方法，装置，系统和制品以识别因特网协议地址黑名单边界。 示例性方法包括识别与恶意因特网协议地址相关联的网络块，网络块具有下边界和上边界，收集与网络块中的多个因特网协议地址相关联的网络流数据，建立与下部相关联的第一窗口 互联网协议地址数字地低于候选互联网协议地址，建立与互联网协议地址的上部相关联的第二窗口，数字地高于候选互联网协议地址，计算断点得分，基于第一 窗口和第二窗口的行为简档，以及当断点得分超过阈值时识别第一子网块。

公开(公告)号：US20210344632A1

公开(公告)日：2021-11-04

申请号：US17376404

申请日：2021-07-15

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Paul Giura ,  Baris Coskun

IPC: H04L12/58

Abstract: A method of generating a signature for a group of electronic messages that each include a plurality of characters comprises extracting a plurality of blocks of characters from each of the electronic messages, mathematically processing each of the blocks of characters from each electronic message, and generating a signature for the group of electronic messages based at least in part on the mathematically processed blocks of characters. In some embodiments a counting Bloom filter may be used to generate the signature. The signatures generated by these methods may be used to identify spam.

公开(公告)号：US10419992B2

公开(公告)日：2019-09-17

申请号：US15231406

申请日：2016-08-08

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Jacobus Van der Merwe ,  Xu Chen ,  Baris Coskun ,  Gustavo de los Reyes ,  Seungjoon Lee ,  Suhas Mathur ,  Arati Baliga ,  Gang Xu

IPC: G06F15/177 ,  H04W36/14 ,  H04L12/24 ,  H04L12/46 ,  H04L12/26 ,  H04L12/801 ,  H04L29/08 ,  H04L12/927 ,  H04L29/06 ,  H04W36/30 ,  H04W88/02

Abstract: Methods and apparatus to migrate a mobile device from a first virtual private mobile network to a second virtual private mobile network are disclosed. An example apparatus includes a processor and a memory including instructions that cause the processor to perform operations including determining, based on a set of latency routing rules, that a communication transmitted via the first virtual private mobile network is a latency sensitive communication. In response to determining the communication is a latency sensitive communication, the mobile device that originated the latency sensitive communication is identified. The mobile device is communicating via the first virtual private mobile network. Example operations also include migrating the mobile device from the first virtual private mobile network to the second virtual private mobile network wherein the second virtual private mobile network is configured to reduce the latency of the latency sensitive communication.

公开(公告)号：US10333877B2

公开(公告)日：2019-06-25

申请号：US14264159

申请日：2014-04-29

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Paul Giura ,  Baris Coskun

IPC: G06F15/16 ,  H04L12/58

Abstract: A method of generating a signature for a group of electronic messages that each include a plurality of characters comprises extracting a plurality of blocks of characters from each of the electronic messages, mathematically processing each of the blocks of characters from each electronic message, and generating a signature for the group of electronic messages based at least in part on the mathematically processed blocks of characters. In some embodiments a counting Bloom filter may be used to generate the signature. The signatures generated by these methods may be used to identify spam.

公开(公告)号：US10069799B2

公开(公告)日：2018-09-04

申请号：US15194037

申请日：2016-06-27

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Arati Baliga ,  Xu Chen ,  Baris Coskun ,  Gustavo de los Reyes ,  Seungjoon Lee ,  Suhas Mathur ,  Jacobus Van der Merwe ,  Gang Xu

IPC: H04L29/06 ,  H04W12/08

Abstract: Methods and apparatus to configure virtual private mobile networks are disclosed. Example methods include provisioning a virtual private mobile network within a wireless network, and, after provisioning the virtual private mobile network, determining whether a first communication from a user equipment matches a security event profile. When the first communication matches the profile, the example methods include transmitting, from the wireless network via a first base transceiver station, an instruction to cause the user equipment to be communicatively coupled to the virtual private mobile network. The example methods further include instructing the user equipment to transmit a second communication through a second base transceiver station that is physically separate from the first base transceiver station and through the virtual private mobile network. In the example methods, the virtual private mobile network is isolated in a wireless spectrum from other portions of the network.

公开(公告)号：US20160353345A1

公开(公告)日：2016-12-01

申请号：US15231406

申请日：2016-08-08

Applicant: AT&T Intellectual Property I, L.P.

Inventor： Jacobus Van der Merwe ,  Xu Chen ,  Baris Coskun ,  Gustavo de los Reyes ,  Seungjoon Lee ,  Suhas Mathur ,  Arati Baliga ,  Gang Xu

IPC: H04W36/14 ,  H04L12/46 ,  H04L12/26

CPC classification number: H04W36/14 ,  H04L12/4633 ,  H04L12/4641 ,  H04L41/083 ,  H04L43/0858 ,  H04L43/087 ,  H04L43/16 ,  H04L47/14 ,  H04L47/805 ,  H04L65/80 ,  H04L67/322 ,  H04W36/30 ,  H04W88/02

Abstract: Methods and apparatus to migrate a mobile device from a first virtual private mobile network to a second virtual private mobile network are disclosed. An example apparatus includes a processor and a memory including instructions that cause the processor to perform operations including determining, based on a set of latency routing rules, that a communication transmitted via the first virtual private mobile network is a latency sensitive communication. In response to determining the communication is a latency sensitive communication, the mobile device that originated the latency sensitive communication is identified. The mobile device is communicating via the first virtual private mobile network. Example operations also include migrating the mobile device from the first virtual private mobile network to the second virtual private mobile network wherein the second virtual private mobile network is configured to reduce the latency of the latency sensitive communication.

Abstract translation: 公开了将移动设备从第一虚拟专用移动网络迁移到第二虚拟专用移动网络的方法和装置。 示例性设备包括处理器和存储器，其包括使得处理器执行操作的指令，包括基于一组等待时间路由规则来确定经由第一虚拟专用移动网络发送的通信是等待时间敏感通信。 响应于确定通信是延迟敏感通信，识别发起等待时间敏感通信的移动设备。 移动设备正在经由第一虚拟专用移动网络进行通信。 示例性操作还包括将移动设备从第一虚拟专用移动网络迁移到第二虚拟专用移动网络，其中第二虚拟专用移动网络被配置为减少等待时间敏感通信的等待时间。