公开(公告)号：US10440036B2

公开(公告)日：2019-10-08

申请号：US14963267

申请日：2015-12-09

申请人： Check Point Software Technologies Ltd.

发明人： Anandabrata Pal ,  Lior Arzi ,  Tamara Leiderfarb

IPC分类号： G06F21/00 ,  H04L29/06

摘要： Computerized methods and systems determine an entry point or source of an attack on an endpoint, such as a machine, e.g., a computer, node of a network, system or the like. These computerized methods and systems utilize an attack execution/attack or start root, to build an attack tree, which shows the attack on the end point and the damage caused by the attack, as it propagates through the machine, network, system, or the like.

公开(公告)号：US10462160B2

公开(公告)日：2019-10-29

申请号：US15292169

申请日：2016-10-13

申请人： CHECK POINT SOFTWARE TECHNOLOGIES LTD.

发明人： Lior Arzi ,  Tamara Leiderfarb ,  Anandabrata Pal

IPC分类号： H04L29/06 ,  G06F21/56

摘要： Computerized methods and systems identify events associated with an attack initiated on an endpoint client. A listing of processes executed or created on the endpoint during the attack is obtained. The listing of processes includes a first process and at least one subsequent process executed or created by the first process. The computerized methods and systems analyze for the occurrence of at least one event during a time interval associated with the attack. The computerized methods and systems determine whether the listing of processes includes a process that when executed caused the occurrence of the at least one event. If the listing of processes excludes process that when executed caused the occurrence of the at least one event, the at least one event and the causing process are stored, for example, in a database or memory.

公开(公告)号：US10972488B2

公开(公告)日：2021-04-06

申请号：US16571118

申请日：2019-09-15

申请人： CHECK POINT SOFTWARE TECHNOLOGIES LTD.

发明人： Anandabrata Pal ,  Lior Arzi ,  Tamara Leiderfarb

IPC分类号： H04L29/06

摘要： Computerized methods and systems determine an entry point or source of an attack on an endpoint, such as a machine, e.g., a computer, node of a network, system or the like. These computerized methods and systems utilize an attack execution/attack or start root, to build an attack tree, which shows the attack on the end point and the damage caused by the attack, as it propagates through the machine, network, system, or the like.

公开(公告)号：US20170171225A1

公开(公告)日：2017-06-15

申请号：US14963267

申请日：2015-12-09

申请人： Check Point Software Technologies Ltd.

发明人： ANANDABRATA PAL ,  Lior Arzi ,  Tamara Leiderfarb

IPC分类号： H04L29/06

摘要： Computerized methods and systems determine an entry point or source of an attack on an endpoint, such as a machine, e.g., a computer, node of a network, system or the like. These computerized methods and systems utilize an attack execution/attack or start root, to build an attack tree, which shows the attack on the end point and the damage caused by the attack, as it propagates through the machine, network, system, or the like.