利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

13 条记录 (耗时 0.018 秒)

    DETECTION OF BEACONING BEHAVIOR IN NETWORK TRAFFIC
    2.
    发明申请
    DETECTION OF BEACONING BEHAVIOR IN NETWORK TRAFFIC 审中-公开
    检测网络交通中的交通行为

    公开(公告)号：US20160134651A1

    公开(公告)日：2016-05-12

    申请号：US14750737

    申请日：2015-06-25

    申请人： International Business Machines Corporation

    发明人： Xin HU ,  Jiyong JANG ,  Douglas SCHALES ,  Marc STOECKLIN ,  Ting WANG

    IPC分类号： H04L29/06

    CPC分类号： H04L63/1416 ,  H04L63/101 ,  H04L63/1425

    摘要： A method for detecting beaconing behavior includes preprocessing network records to identify candidate source and destination pairs for detecting beaconing behavior, where each source and destination pair is associated with a specific time interval in a plurality of time intervals forming a time range, the time interval and time range having been predefined. The activity time interval information is converted from the time domain into the frequency domain. Candidate frequencies are determined from the source and destination pairs, as likely candidate frequencies/periodicities of beaconing activities.

    摘要翻译： 用于检测信标行为的方法包括预处理网络记录以识别用于检测信标行为的候选源和目的地对，其中每个源和目的地对在形成时间范围的多个时间间隔中与特定时间间隔相关联，所述时间间隔和 时间范围已经预定义。 活动时间间隔信息从时域转换为频域。 从源和目的地对确定候选频率，作为信标活动的可能的候选频率/周期性。

    Automatic Categorization Of IDPS Signatures From Multiple Different IDPS Systems
    4.
    发明申请
    Automatic Categorization Of IDPS Signatures From Multiple Different IDPS Systems 有权

    公开(公告)号：US20210160260A1

    公开(公告)日：2021-05-27

    申请号：US17167330

    申请日：2021-02-04

    申请人： International Business Machines Corporation

    发明人： Xin HU ,  Jiyong JANG ,  Douglas Lee SCHALES ,  Marc Philippe STOECKLIN ,  Ting WANG

    IPC分类号： H04L29/06 ,  G06N20/00 ,  G06F16/28 ,  G06F16/901

    摘要： Unknown and reference signatures are accessed. The unknown and reference signatures indicate patterns that correspond to known threats to resources (such as computer systems and/or computer networks) in a computer environment and comprise a multitude of descriptive elements having information describing different aspects of a corresponding signature. A set of similarity measures is created of the unknown and reference signatures from different perspectives, each perspective corresponding to a descriptive element. The set of similarity measures are integrated to generate an overall similarity metric. The overall similarity metric is used to find appropriate categories in the reference signatures into which the unknown signatures should be placed. The unknown signatures are placed into the appropriate categories to create a mapping from the unknown signatures to the reference signatures. The mapping is output for use by an IDPS for determining whether a threat has occurred to the resources in the computer environment.

    Automatic Categorization Of IDPS Signatures From Multiple Different IDPS Systems
    7.
    发明申请
    Automatic Categorization Of IDPS Signatures From Multiple Different IDPS Systems 审中-公开

    公开(公告)号：US20200067950A1

    公开(公告)日：2020-02-27

    申请号：US16671267

    申请日：2019-11-01

    申请人： International Business Machines Corporation

    发明人： Xin HU ,  Jiyong JANG ,  Douglas Lee SCHALES ,  Marc Philippe STOECKLIN ,  Ting WANG

    IPC分类号： H04L29/06 ,  G06F16/901 ,  G06F16/28 ,  G06N20/00

    摘要： Unknown and reference signatures are accessed. The unknown and reference signatures indicate patterns that correspond to known threats to resources (such as computer systems and/or computer networks) in a computer environment and comprise a multitude of descriptive elements having information describing different aspects of a corresponding signature. A set of similarity measures is created of the unknown and reference signatures from different perspectives, each perspective corresponding to a descriptive element. The set of similarity measures are integrated to generate an overall similarity metric. The overall similarity metric is used to find appropriate categories in the reference signatures into which the unknown signatures should be placed. The unknown signatures are placed into the appropriate categories to create a mapping from the unknown signatures to the reference signatures. The mapping is output for use by an IDPS for determining whether a threat has occurred to the resources in the computer environment.