-
公开(公告)号：US20160105454A1
公开(公告)日：2016-04-14
申请号：US14879876
申请日：2015-10-09
Applicant: NEC Laboratories America, Inc.
Inventor： Zhichun Li , Zhenyu Wu , Zhiyun Qian , Guofei Jiang , Masoud Akhoondi , Markus Kusano
CPC classification number: H04L63/1416 , G06F17/30958 , H04L63/1425 , H04L63/1441 , H04L2463/146
Abstract: Methods and systems for intrusion attack recovery include monitoring two or more hosts in a network to generate audit logs of system events. One or more dependency graphs (DGraphs) is generated based on the audit logs. A relevancy score for each edge of the DGraphs is determined. Irrelevant events from the DGraphs are pruned to generate a condensed backtracking graph. An origin is located by backtracking from an attack detection point in the condensed backtracking graph.
Abstract translation: 入侵攻击恢复的方法和系统包括监控网络中的两个或多个主机以生成系统事件的审核日志。 基于审计日志生成一个或多个依赖关系图（DGraphs）。 确定DGraph的每个边缘的相关性得分。 修剪来自DGraphs的不相关事件，以生成一个浓缩回溯图。 原点是通过从浓缩回溯图中的攻击检测点进行回溯定位。
-
公开(公告)号：US09736173B2
公开(公告)日：2017-08-15
申请号：US14879876
申请日：2015-10-09
Applicant: NEC Laboratories America, Inc.
Inventor： Zhichun Li , Zhenyu Wu , Zhiyun Qian , Guofei Jiang , Masoud Akhoondi , Markus Kusano
CPC classification number: H04L63/1416 , G06F17/30958 , H04L63/1425 , H04L63/1441 , H04L2463/146
Abstract: Methods and systems for intrusion attack recovery include monitoring two or more hosts in a network to generate audit logs of system events. One or more dependency graphs (DGraphs) is generated based on the audit logs. A relevancy score for each edge of the DGraphs is determined. Irrelevant events from the DGraphs are pruned to generate a condensed backtracking graph. An origin is located by backtracking from an attack detection point in the condensed backtracking graph.
-
Search Results
2
records
(took 0.011 seconds)
