-
1.发明申请Method and apparatus for monitoring operation of processing systems, related network and computer program product therefor 审中-公开用于监控处理系统，相关网络和计算机程序产品的操作的方法和装置公开(公告)号：US20070107052A1
公开(公告)日：2007-05-10
申请号：US10582848
申请日：2003-12-17
申请人： Gianluca Cangini , Gerardo Lamastra , Francesco Coda Zabetta , Paolo Abeni , Madalina Baltatu , Rosalia D'Alessandro , Stefano Brusotti , Sebastiano Di Paola , Manuel Leone , Federico Frosali
发明人： Gianluca Cangini , Gerardo Lamastra , Francesco Coda Zabetta , Paolo Abeni , Madalina Baltatu , Rosalia D'Alessandro , Stefano Brusotti , Sebastiano Di Paola , Manuel Leone , Federico Frosali
IPC分类号： G06F12/14
CPC分类号： G06F21/554 , G06F21/55
摘要： Apparatus for monitoring operation of a processing system includes a set of modules for monitoring operation of a set of system primitives that allocate or release the system resources and are used by different processes running on the system. Preferably, the modules include at least one application knowledge module tracking the processes running on the system and monitoring the resources used thereby, a network knowledge module monitoring connections by the processes running on the system, a file-system analysis module monitoring the file-related operations performed within the system, and a device monitoring module monitoring operation of commonly used modules with the system. A preferred field of application is in host-based intrusion detection systems.
摘要翻译： 用于监视处理系统的操作的装置包括一组模块，用于监视分配或释放系统资源并被系统上运行的不同进程使用的一组系统原语的操作。 优选地，所述模块包括至少一个应用知识模块，其跟踪在系统上运行的进程并监视由此使用的资源，网络知识模块通过系统上运行的进程来监视连接，文件系统分析模块监视文件相关 在系统内执行的操作，以及设备监控模块，监视系统中常用模块的操作。 优选的应用领域是基于主机的入侵检测系统。
-
2.发明申请Method and system for processing packet flows, and computer program product therefor 审中-公开处理数据包流的方法和系统及其计算机程序产品公开(公告)号：US20090217369A1
公开(公告)日：2009-08-27
申请号：US11919906
申请日：2005-05-04
CPC分类号： H04L47/10 , G06F9/526 , G06F2209/522 , H04L49/90 , H04L63/1408
摘要： Packet flows are processed, e.g. to perform an intrusion detection function in a communication network, by means of a multiprocessor system including a plurality of processing units. The packets are distributed for processing among the processing units via a distribution function. Such a distribution function is selectively allotted to one of the processing units of the plurality. A preferred embodiment of the arrangement involves using a single Symmetric Multi-Processor machine with a single network port to Gigabit/sec link. The corresponding system architecture does not require any intermediate device, or any external load balancing mechanism. All the processing work is performed on a single system, which is able to dynamically balance the traffic load among the several independent CPUs. By resorting to a specific scheduling arrangement, such a system is able to effectively distribute the computations required to perform both the loadbalancing and the detection operations.
摘要翻译： 处理数据包流，例如 通过包括多个处理单元的多处理器系统在通信网络中执行入侵检测功能。 这些分组被分配用于经由分发功能在处理单元之间进行处理。 这种分配功能被选择性地分配给多个处理单元之一。 该布置的优选实施例涉及使用具有单个网络端口到千兆/秒链路的单个对称多处理器机器。 相应的系统架构不需要任何中间设备或任何外部负载平衡机制。 所有的处理工作都在单个系统上执行，能够动态平衡多个独立CPU之间的流量负载。 通过采用特定的调度安排，这样的系统能够有效地分配执行负载平衡和检测操作所需的计算。
-
公开(公告)号：US20100287128A1
公开(公告)日：2010-11-11
申请号：US12811048
申请日：2007-12-28
IPC分类号： G06F15/18 , G06F15/173
CPC分类号： H04L63/1425 , G06K9/6284 , H04L45/02
摘要： Disclosed herein is an anomaly detection method for link-state routing protocols, a link-state routing protocol providing for link-state update (LSU) messages to be exchanged between nodes in a packet-based network, wherein each link-state update message includes link-state advertisement (LSA) message(s) each having a respective header. The method comprises monitoring the link-state advertisement messages exchanged in the network, extracting and forming respective feature vectors with the values in the fields of the headers of the monitored link-state advertisement messages, and detecting an anomaly related to routing based on the feature vectors. In particular, detecting an anomaly related to routing includes feeding the feature vectors to a machine learning system, conveniently a one-class classifier, preferably a one-class support vector machine (OC-SVM).
摘要翻译： 本文公开了一种用于链路状态路由协议的异常检测方法，提供在基于分组的网络中的节点之间交换的链路状态更新（LSU）消息的链路状态路由协议，其中每个链路状态更新消息包括 链路状态广播（LSA）消息，每个消息具有相应的报头。 该方法包括监视在网络中交换的链路状态通告消息，提取和形成各个特征向量，其中所述被监控链路状态通告消息的报头的字段中的值，以及基于特征检测与路由有关的异常 向量 特别地，检测与路由相关的异常包括将特征向量馈送到机器学习系统，方便地是一类分类器，优选地是一类支持向量机（OC-SVM）。
-
公开(公告)号：US08626678B2
公开(公告)日：2014-01-07
申请号：US12811048
申请日：2007-12-28
IPC分类号： G06F15/18
CPC分类号： H04L63/1425 , G06K9/6284 , H04L45/02
摘要： Disclosed herein is an anomaly detection method for link-state routing protocols, a link-state routing protocol providing for link-state update (LSU) messages to be exchanged between nodes in a packet-based network, wherein each link-state update message includes link-state advertisement (LSA) message(s) each having a respective header. The method comprises monitoring the link-state advertisement messages exchanged in the network, extracting and forming respective feature vectors with the values in the fields of the headers of the monitored link-state advertisement messages, and detecting an anomaly related to routing based on the feature vectors. In particular, detecting an anomaly related to routing includes feeding the feature vectors to a machine learning system, conveniently a one-class classifier, preferably a one-class support vector machine (OC-SVM).
摘要翻译： 本文公开了一种用于链路状态路由协议的异常检测方法，提供要在基于分组的网络中的节点之间交换的链路状态更新（LSU）消息的链路状态路由协议，其中每个链路状态更新消息包括 链路状态广播（LSA）消息，每个消息具有相应的报头。 该方法包括监视在网络中交换的链路状态通告消息，提取和形成各个特征向量，其中所述被监控链路状态通告消息的报头的字段中的值，以及基于特征检测与路由有关的异常 向量 特别地，检测与路由相关的异常包括将特征向量馈送到机器学习系统，方便地是一类分类器，优选地是一类支持向量机（OC-SVM）。
-
-
-
搜索结果
4 条记录 (耗时 0.03 秒)
