-
1.发明申请Method, program and system for automatically detecting malicious computer network reconnaissance 有权自动检测恶意计算机网络侦察的方法，程序和系统公开(公告)号：US20050027854A1
公开(公告)日：2005-02-03
申请号：US10629175
申请日：2003-07-29
申请人： Alan Boulanger , Robert Danford , Kevin Himberger , Clark Jeffries , Raj Singh
发明人： Alan Boulanger , Robert Danford , Kevin Himberger , Clark Jeffries , Raj Singh
IPC分类号： H04L12/26 , H04L29/06 , G06F15/173
CPC分类号： H04L63/1408 , H04L43/00 , H04L63/1458 , H04L63/166
摘要： A detection and response system that generates an Alert if unauthorized scanning is detected on a computer network that includes a look-up table to record state value corresponding to the sequence in which SYN, SYN/ACK and RST packets are observed. A set of algorithms executed on a processing engine adjusts the state value in response to observing the packets. When the state value reaches a predetermined value indicating that all three packets have been seen, the algorithm generates an Alert.
摘要翻译： 检测和响应系统，如果在包含查看表的计算机网络上检测到未经授权的扫描，以记录与遵守SYN，SYN / ACK和RST数据包的顺序相对应的状态值的警报。 在处理引擎上执行的一组算法根据观察数据包来调整状态值。 当状态值达到表示已经看到所有三个分组的预定值时，该算法生成警报。
-
2.发明申请Method, system and program for automatically detecting distributed port scans in computer networks 失效自动检测计算机网络中分布式端口扫描的方法，系统和程序公开(公告)号：US20060018262A1
公开(公告)日：2006-01-26
申请号：US10896733
申请日：2004-07-22
IPC分类号： H04L12/26
CPC分类号： H04L63/1416 , H04L63/1466
摘要： A detection and response system including a set of algorithms for detecting within a stream of normal computer traffic a subset of (should focus on network traffic eliciting a response) TCP or UDP packets with one IP Source Address (SA) value, one or a few Destination Address (DA) values, and a number exceeding a threshold of distinct Destination Port (DP) values. A lookup mechanism such as a Direct Table and Patricia search tree record and trace sets of packets with one SA and one DA as well as the set of DP values observed for the given SA, DA combination. The detection and response system reports the existence of such a subset and the header values including SA, DA, and multiple DPs of the subset. The detection and response system also includes various administrative responses to reports.
摘要翻译： 一种检测和响应系统，包括一组用于在正常计算机业务流内检测的一组算法（应该侧重于引发响应的网络业务）具有一个IP源地址（SA）值的TCP或UDP分组，一个或几个 目标地址（DA）值和超过不同目标端口（DP）值阈值的数字。 一个查找机制，如直接表和帕特里夏搜索树记录，跟踪一组SA和一个DA的数据包以及给定SA，DA组合观察到的一组DP值。 检测和响应系统报告这样的子集的存在以及包括SA，DA和子集的多个DP的标题值。 检测和响应系统还包括对报告的各种管理响应。
-
3.发明申请Apparatus, method and program to detect and control deleterious code (virus) in computer network 有权用于检测和控制计算机网络中有害代码（病毒）的装置，方法和程序公开(公告)号：US20060021040A1
公开(公告)日：2006-01-26
申请号：US10896680
申请日：2004-07-22
IPC分类号： G06F12/14
CPC分类号： H04L63/145 , H04L43/00 , H04L63/0236 , H04L63/1416
摘要： A detection and response system including a set of algorithms for detection within a stream of normal computer traffic a subset of TCP packets with one IP Source Address (SA), one Destination Port (DP), and a number exceeding a threshold of distinct Destination Addresses (DA). There is efficient use of a lookup mechanism such as a Direct Table and Patricia search tree to record sets of packets with one SA and one DP as well as the set of DA values observed for the given SA, DP combination. The existence of such a subset and the header values including SA, DP, and multiple DAs of the subset are reported to a network administrator. In addition, various administrative responses to reports are provided.
摘要翻译： 一种检测和响应系统，包括用于在正常计算机业务流内检测的一组算法，具有一个IP源地址（SA）的TCP分组的子集，一个目的地端口（DP）以及超过不同目的地址的阈值的数量 （DA）。 有效利用诸如直接表和帕特里夏搜索树之类的查找机制来记录具有一个SA和一个DP的分组集合以及针对给定的SA，DP组合观察到的一组DA值。 这样的子集的存在和包括该子集的SA，DP和多个DA的标题值被报告给网络管理员。 此外，还提供了各种对报告的行政回应。
-
4.发明申请Methods, systems, and computer program products for operating a communication network through use of blocking measures for responding to communication traffic anomalies 失效通过使用阻塞措施来响应通信流量异常来操作通信网络的方法，系统和计算机程序产品公开(公告)号：US20050177872A1
公开(公告)日：2005-08-11
申请号：US10774017
申请日：2004-02-05
申请人： Alan Boulanger , Kevin Himberger , Clark Jeffries , John Ziraldo
发明人： Alan Boulanger , Kevin Himberger , Clark Jeffries , John Ziraldo
CPC分类号： H04L63/0218 , H04L63/02 , H04L63/1416 , H04L63/1441
摘要： A communication network is operated by detecting an anomaly in the communication traffic at a plurality of nodes in a communication network. A first blocking measure A is independently applied at respective ones of the plurality of nodes to the anomalous traffic that stops the anomalous traffic. A second blocking measure B is independently determined at the respective ones of the plurality of nodes such that application of a logical combination of the first blocking measure A and the second blocking measure B to the anomalous traffic stops the anomalous traffic.
摘要翻译： 通信网络通过检测通信网络中的多个节点处的通信业务中的异常来操作。 第一阻塞测度A被独立地应用于多个节点中的相应的节点处于停止异常业务的异常业务。 在多个节点中的相应节点处独立地确定第二阻塞测量B，使得将第一阻塞测度A和第二阻塞测量B的逻辑组合应用于异常业务停止异常业务。
-
公开(公告)号：US20060107318A1
公开(公告)日：2006-05-18
申请号：US10940558
申请日：2004-09-14
IPC分类号： G06F12/14 , G06F11/00 , G06F11/22 , G06F11/30 , G06F11/32 , G06F11/34 , G06F11/36 , G06F12/16 , G06F15/18 , G08B23/00
CPC分类号： G06F21/55 , G06F11/349 , G06F11/3495 , G06F2201/81 , H04L63/1416 , H04L63/1458 , H04L2463/141 , H04L2463/144 , Y02D10/34
摘要： A method of, system for, and product for managing a denial of service attack in a multiprocessor environment comprising. The first step is establishing normal traffic usage baselines in the multiprocessor environment. Once the baseline is established the next step is monitoring outgoing traffic to detect a high proportion of packets being sent to a specific destination address, and a high number of outbound packets compared to said baseline. Next is monitoring ports and protocols to detect a high proportion of packets sent to a specific port, and a consistent use of a protocol for all packets for that port. If there is such consistent use of a protocol for all packets for that port as to evidence a denial of service attack, blocking measures are started to mitigate the apparent denial of service attack.
-
公开(公告)号：US20070241905A1
公开(公告)日：2007-10-18
申请号：US11766883
申请日：2007-06-22
IPC分类号： G08B13/14
CPC分类号： G06K19/0723 , G06K19/0717
摘要： System and method for recording temperature on an RFID tag. A first RFID tag is attached to a container. The first RFID tag includes a temperature sensor. The container contains a multiplicity of packages. A multiplicity of second RFID tags are attached to the multiplicity of packages, respectively. The first RFID tag transmits temperature information to the multiplicity of second RFID tags. In response, the multiplicity of second RFID tags record the temperature information. Consequently, there is no need for expensive temperature sensors on the multiplicity of RFID tags on the packages. According to features of the present invention, the first RFID tag is an active RFID tag, and the multiplicity of second RFID tags are passive RFID tags. The first RFID tag also transmits other information to the multiplicity of second RFID tags to enable the second RFID tags to authenticate the temperature information. Other types of environmental sensors such as a humidity sensor or vibration sensor can substitute for the temperature sensor.
摘要翻译： 记录RFID标签温度的系统和方法。 第一个RFID标签连接到容器。 第一RFID标签包括温度传感器。 容器包含多个包。 多个第二RFID标签分别附接到多个包装。 第一RFID标签将温度信息传送到多个第二RFID标签。 作为响应，第二RFID标签的多个记录温度信息。 因此，不需要在包装上的RFID标签上的昂贵的温度传感器。 根据本发明的特征，第一RFID标签是有源RFID标签，多个第二RFID标签是无源RFID标签。 第一RFID标签还向多个第二RFID标签传送其他信息，以使第二RFID标签能够认证温度信息。 其他类型的环境传感器，如湿度传感器或振动传感器可以代替温度传感器。
-
公开(公告)号：US20050204159A1
公开(公告)日：2005-09-15
申请号：US10796161
申请日：2004-03-09
申请人： John Davis , Kevin Himberger , Clark Jeffries , Garreth Jeremiah
发明人： John Davis , Kevin Himberger , Clark Jeffries , Garreth Jeremiah
CPC分类号： H04L63/0236 , H04L51/12 , H04L63/0263
摘要： A system, method and program product for blocking unwanted e-mails. An e-mail is identified as unwanted. A source IP address of the unwanted e-mail is determined. Other source IP addresses owned or registered by an owner or registrant of the source IP address of the unwanted e-mail are determined. Subsequent e-mails from the source IP address and the other IP addresses are blocked. This will thwart a spammer who shifts to a new source IP address when its spam is blocked from one source IP address.
摘要翻译： 用于阻止不必要的电子邮件的系统，方法和程序产品。 电子邮件被标识为不需要的。 确定不需要的电子邮件的源IP地址。 确定不想要的电子邮件的源IP地址的所有者或注册人拥有或注册的其他源IP地址。 源IP地址和其他IP地址的后续电子邮件被阻止。 这将阻止垃圾邮件发送者转移到新的源IP地址，当其垃圾邮件被一个源IP地址阻止时。
-
8.发明申请System and method for detection and mitigation of distributed denial of service attacks 失效用于检测和减轻分布式拒绝服务攻击的系统和方法公开(公告)号：US20070011740A1
公开(公告)日：2007-01-11
申请号：US11176079
申请日：2005-07-07
IPC分类号： G06F12/14
CPC分类号： H04L63/0227 , H04L63/1458 , H04L2463/141
摘要： A router includes a relatively low bandwidth communication connection to a small computer, a relatively high bandwidth communication connection to a communication network; and a processing unit for executing in the router a set of permit rules for permitting flow of communication packets with respect to the connections for user initiated sessions, the permit rules including a default rule for discarding all packets with respect to the small computer in traffic not pertaining to sessions initiated by the small computer.
摘要翻译： 路由器包括到小计算机的相对低带宽通信连接，到通信网络的相对高带宽通信连接; 以及处理单元，用于在路由器中执行用于允许关于用于用户发起的会话的连接的通信分组的流的一组允许规则，所述许可规则包括用于丢弃相对于流量中的小型计算机的所有分组的默认规则， 涉及小型电脑发起的会议。
-
公开(公告)号：US20060156408A1
公开(公告)日：2006-07-13
申请号：US11033436
申请日：2005-01-11
IPC分类号： H04L9/32 , G06F15/16 , G06F11/00 , G06F17/00 , G06F11/22 , G06F17/30 , G06F9/00 , G06F11/30 , G06F7/04 , G06F11/32 , G06F7/58 , G06F11/34 , G06K19/00 , G06F11/36 , G06K9/00 , G06F12/14 , G06F12/16 , G06F15/18 , G08B23/00
CPC分类号： G06F21/552 , G06F21/577 , G06Q40/08 , G08B21/22
摘要： A method, apparatus, and computer instructions for providing a current and complete security compliance view of an enterprise system. The present invention provides the ability to gain a real-time security posture and security compliance view of an enterprise and to assess the risk impact of known threats and attacks to continued business operations at various levels is provided. Responsive to a change to an enterprise environment, a request, or an external threat, an administrator loads or updates at least one of a Critical Application Operations database, a Historical database, an Access Control database, a Connectivity database, and a Threat database. Based on a comparison of information in the databases against similar security data elements from company or external policies, the administrator may generate a Security Compliance view of the enterprise. A Security Posture view may also be generated by comparing the Security Compliance view against data in the Threat database.
摘要翻译： 一种用于提供企业系统的当前和完整的安全合规性视图的方法，装置和计算机指令。 本发明提供获得企业的实时安全状态和安全合规性视图的能力，并且评估已知威胁和攻击对于各个级别的持续业务操作的风险影响。 响应企业环境，请求或外部威胁的更改，管理员加载或更新关键应用程序操作数据库，历史数据库，访问控制数据库，连接数据库和威胁数据库中的至少一个。 基于数据库中的信息与公司或外部策略中类似的安全数据元素的比较，管理员可以生成企业的安全合规性视图。 通过将安全合规性视图与威胁数据库中的数据进行比较，也可以生成安全性状态视图。
-
公开(公告)号：US20060101021A1
公开(公告)日：2006-05-11
申请号：US10984299
申请日：2004-11-09
IPC分类号： G06F17/30
CPC分类号： H04L51/04 , H04L12/1831 , H04L51/12 , Y10S707/922
摘要： A technique for tracking one or more thresholds relating to the blocking of a particular screen name used on an IM system is disclosed. If the number of people who have blocked a particular screen name reaches a threshold amount, a determination is made that the screen name is being used by a spimmer or other bothersome person, and disciplinary action can be taken. In a preferred embodiment, the email address associated with a user name of a suspected spimmer is identified and all screen names associated with that email address are also subjected to disciplinary action, if desired. Thus, an IM company can suspend all screen names of a spimmer that are tied to the same email address, even though not all (or even none) of the screen names individually have reached a threshold level for discipline/suspension.
摘要翻译： 公开了一种用于跟踪与在IM系统上使用的特定屏幕名称的阻塞相关的一个或多个阈值的技术。 如果阻止特定屏幕名称的人数达到阈值数量，则确定屏幕名称正被微笑者或其他麻烦的人使用，并且可以采取纪律处分。 在优选实施例中，如果需要，识别与疑似微分器的用户名相关联的电子邮件地址，并且与该电子邮件地址相关联的所有屏幕名称也受到纪律处分。 因此，即使不是所有（甚至没有）屏幕名称的个人都已达到纪律/暂停的阈值水平，因此IM公司可以暂停连接到相同电子邮件地址的所有屏幕快照的屏幕名称。
-
-
-
-
-
-
-
-
-
搜索结果
47 条记录 (耗时 0.029 秒)
