公开(公告)号：US10404554B2

公开(公告)日：2019-09-03

申请号：US15271914

申请日：2016-09-21

申请人： Narus, Inc.

发明人： Alok Tongaonkar ,  Ram Keralapura ,  Antonio Nucci

IPC分类号： G06F13/00 ,  H04L12/26 ,  H04L12/851 ,  G08G1/0962 ,  H04L29/08 ,  H04L29/06

摘要： A method for profiling network traffic of a network. The method includes extracting cells from bi-directional payloads generated by a network application, wherein each cell comprises at least one direction reversal in a corresponding bi-directional flow, generating a cell group comprising a portion of the cells that are similar, analyzing the cell group to generate a signature of the network application, and classifying, based on the signature of the network application, a new bi-directional flow as being generated by the network application.

公开(公告)号：US09311386B1

公开(公告)日：2016-04-12

申请号：US13855872

申请日：2013-04-03

申请人： Narus, Inc.

发明人： Han See Song ,  Mario Baldi ,  Qiang Ma ,  Antonio Nucci

IPC分类号： G06F17/30

CPC分类号： G06F17/30598 ,  G06F17/30643 ,  G06F17/30702 ,  G06F17/30707 ,  G06F17/30722 ,  G06F17/30867

摘要： A method for network resource classification and identifying user interests based on the classification. The method uses a provided hierarchy of categories for classifying network resources, wherein each category is assigned a text item describing the category and the method includes obtaining resource description data collections corresponding to the network resources, and generating, using a semantic correlation algorithm, a category score vector of a network resource by comparing the resource description data collection to the text item assigned to each category in the hierarchy of categories, wherein the category score vector comprises a category score for each category in the hierarchy of categories, wherein the category score is determined based on at least a semantic correlation measure between the resource description data collection and the text item assigned to a corresponding category, wherein the plurality of network resources are classified based at least on the category score.

摘要翻译： 一种基于分类的网络资源分类和用户兴趣的识别方法。 该方法使用提供的类别分类来对网络资源进行分类，其中为每个类别分配描述类别的文本项，并且该方法包括获得与网络资源相对应的资源描述数据集合，并且使用语义相关算法生成类别 通过将资源描述数据收集与分配给类别层级中的每个类别的文本项目进行比较，其中，类别分数向量包括类别分级中的每个类别的类别分数，其中分类分数为 基于至少在资源描述数据收集和分配给相应类别的文本项目之间的语义相关性度量来确定，其中所述多个网络资源至少基于类别分数进行分类。

公开(公告)号：US10419351B1

公开(公告)日：2019-09-17

申请号：US13857092

申请日：2013-04-04

申请人： Narus, Inc.

发明人： Mario Baldi ,  Yong Liao ,  Stanislav Miskovic ,  Antonio Nucci

IPC分类号： G06F15/173 ,  H04L12/851

摘要： A method for classifying network traffic in a network. The method includes obtaining, from an application distribution source, an application distribution data set of comprising information associated with distributing an application from the pre-determined application distribution source, extracting, based on a pre-determined extraction criterion, a token from the application distribution data set of the application, obtaining, from the network traffic, a plurality of flows generated by the application, extracting, in response to detecting the token in a flow of the plurality of flows, context information associated with the token in the flow, and generating an identification rule of the application based on the token and the context information, wherein the identification rule describes one or more rule steps to locate the token in the flow, wherein the network traffic is classified using at least the identification rule.

公开(公告)号：US10332005B1

公开(公告)日：2019-06-25

申请号：US13626070

申请日：2012-09-25

申请人： Narus, Inc.

发明人： Yong Liao ,  Mario Baldi ,  Stanislav Miskovic ,  Antonio Nucci ,  Qiang Xu

IPC分类号： G06N5/00 ,  G06N99/00

摘要： Embodiments of the invention provide a method, system, and computer readable medium for classifying network traffic based on application signatures generated during a training phase. The application signatures are generated based on tokens extracted from a training set that is generated by a particular application during the training phase. Accordingly, a new token extracted in real-time from current network data is compared to the application signatures to determine if the current network data is generated by the particular application.

公开(公告)号：US10263868B1

公开(公告)日：2019-04-16

申请号：US14334141

申请日：2014-07-17

申请人： Narus, Inc.

发明人： Mario Baldi ,  Yong Liao ,  Stanislav Miskovic ,  Antonio Nucci ,  Han Hee Song

IPC分类号： H04L12/26

摘要： A method for applying a user-specific policy in a network. The method includes identifying a historical portion of network traffic of the network as associated with a user, analyzing, by a computer processor, the historical portion of network traffic to generate a fingerprint of the user, wherein the fingerprint represents characteristics of user activity in the network, identifying, by the computer processor, an ongoing portion of network traffic of the network as associated with the user, analyzing, by the computer processor and based on the fingerprint, the ongoing portion of network traffic to determine a match, wherein the match is determined at a time point within the ongoing portion of network traffic, and applying, in response to determining the match, the user-specific policy to the ongoing portion of network traffic subsequent to the time point.

公开(公告)号：US10078743B1

公开(公告)日：2018-09-18

申请号：US14458723

申请日：2014-08-13

申请人： Narus, Inc.

发明人： Mario Baldi ,  Antonio Nucci

IPC分类号： G06F17/00 ,  G06F21/32 ,  G06N99/00

CPC分类号： G06F21/32 ,  G06F21/316 ,  G06N20/00

摘要： A method for using a user device. The method includes obtaining, during a fingerprint learning phase, a historical portion of user activity data associated with user activity of a user using the user device, analyzing, by a computer processor of the user device, the historical portion to generate a fingerprint of the user, wherein the fingerprint represents characteristics of the user activity, obtaining, during a fingerprint matching phase subsequent to the fingerprint learning phase, an ongoing portion of the user activity data, analyzing, by the computer processor and based on the fingerprint, the ongoing portion to determine a match, wherein the match is determined at a time point within the fingerprint matching phase, and unlocking, by the computer processor and in response to determining the match, a locked data item for access, therein the locked data item is stored on the user device. The locked data item is associated to the user owning, assigned to, or normally and legitimately using the user device. In one embodiment, once unlocked the data item can be used to authenticate the user associated to it, i.e., the user owning, assigned to, or normally and legitimately using the user device on which the data item is stored.

公开(公告)号：US09977910B2

公开(公告)日：2018-05-22

申请号：US14968435

申请日：2015-12-14

申请人： Narus, Inc.

发明人： Ignacio Bermudez Corrales ,  Antonio Nucci

IPC分类号： H04L29/06 ,  G06F21/62 ,  G06F21/60 ,  H04L9/08

CPC分类号： G06F21/6209 ,  G06F21/602 ,  G06F21/6263 ,  G06F2221/2107 ,  G06F2221/2137 ,  H04L9/0825 ,  H04L9/0833

摘要： A trusted user circle server for encryption key distribution and authentication support, as well as a client-side application which resides on user's devices are disclosed. In particular, the trusted user circle server manages a repository for static public keys (SPUK) which are used for authentication and secure distribution of a dynamic private context key (DPCK) used for the end-to-many encryption. Accordingly, posting users encrypt posted document using the DPCK and viewing users retrieve the DPCK to decrypt the posted document. These keys are associated to the trusted user circle and are generated dynamically for a given circle policy context (CPC). The CPC is an identifier that represents a group of members of a trusted user circle. It changes whenever any member of the trusted user circle leave it, when a new trusted user circle is created or when the DPCK expires after a pre-determined period of time.

公开(公告)号：US09479405B1

公开(公告)日：2016-10-25

申请号：US13724779

申请日：2012-12-21

申请人： Narus, Inc.

发明人： Alok Tongaonkar ,  Ram Keralapura ,  Antonio Nucci

IPC分类号： G06F15/16 ,  H04J14/00 ,  H03M13/00 ,  H04L12/26 ,  H02M7/48 ,  G08G1/0962 ,  H04L12/851 ,  G06F21/78

CPC分类号： H04L43/04 ,  G06F21/78 ,  G08G1/0962 ,  H02M7/4826 ,  H04L43/026 ,  H04L47/2441 ,  H04L67/02 ,  H04L67/42

摘要： A method for profiling network traffic of a network. The method includes extracting cells from bi-directional payloads generated by a network application, wherein each cell comprises at least one direction reversal in a corresponding bi-directional flow, generating a cell group comprising a portion of the cells that are similar, analyzing the cell group to generate a signature of the network application, and classifying, based on the signature of the network application, a new bi-directional flow as being generated by the network application.

摘要翻译： 一种用于分析网络网络流量的方法。 该方法包括从由网络应用产生的双向有效负载提取单元，其中每个单元包括相应的双向流中的至少一个方向反转，产生包含类似的单元的一部分的单元组，分析单元 组生成网络应用的签名，并且基于网络应用的签名对由网络应用生成的新的双向流进行分类。

公开(公告)号：US09245121B1

公开(公告)日：2016-01-26

申请号：US13963881

申请日：2013-08-09

申请人： Narus, Inc.

发明人： Pengkui Luo ,  Ruben Torres ,  Zhi-Li Zhang ,  Sabyasachi Saha ,  Sung-Ju Lee ,  Antonio Nucci

IPC分类号： H04L29/06 ,  G06F21/56

CPC分类号： H04L63/14 ,  H04L63/1408 ,  H04L2463/144

摘要： A method for detecting a malicious node in a network. The method includes obtaining a plurality of failed domain name service (DNS) queries from the network, wherein each of the plurality of failed DNS queries is initiated from a client node of the network and comprises an effective second-level domain (eSLD) name, generating, by a computer processor and using a pre-determined clustering algorithm, a cluster from a plurality of eSLD names comprising the eSLD name of each of the plurality of failed DNS queries, wherein the cluster comprises a portion of the plurality of eSLD names that is selected based on the pre-determined clustering algorithm, determining, by the computer processor and using a pre-determined formula, a score representing statistical characteristics of the cluster, and assigning, in response to the score meeting a pre-determined criterion, a malicious status to the client node.

摘要翻译： 一种用于检测网络中的恶意节点的方法。 该方法包括从网络获取多个失败的域名服务（DNS）查询，其中，多个故障DNS查询中的每一个从网络的客户机节点发起并且包括有效的二级域名（eSLD）名称， 由计算机处理器和使用预定集群算法生成来自包括所述多个故障DNS查询中的每一个的eSLD名称的多个eSLD名称的集群，其中所述集群包括所述多个eSLD名称中的一部分， 基于所述预先确定的聚类算法选择，由所述计算机处理器和使用预定公式确定表示所述群集的统计特征的得分，并且响应于满足预定标准的得分， 恶意状态到客户端节点。

公开(公告)号：US09213855B1

公开(公告)日：2015-12-15

申请号：US14294080

申请日：2014-06-02

申请人： Narus, Inc.

发明人： Ignacio Bermudez Corrales ,  Antonio Nucci

IPC分类号： H04L9/32 ,  G06F21/62

CPC分类号： G06F21/6209 ,  G06F21/602 ,  G06F21/6263 ,  G06F2221/2107 ,  G06F2221/2137 ,  H04L9/0825 ,  H04L9/0833

摘要： A trusted user circle server for encryption key distribution and authentication support, as well as a client-side application which resides on user's devices are disclosed. In particular, the trusted user circle server manages a repository for static public keys (SPUK) which are used for authentication and secure distribution of a dynamic private context key (DPCK) used for the end-to-many encryption. Accordingly, posting users encrypt posted document using the DPCK and viewing users retrieve the DPCK to decrypt the posted document. These keys are associated to the trusted user circle and are generated dynamically for a given circle policy context (CPC). The CPC is an identifier that represents a group of members of a trusted user circle. It changes whenever any member of the trusted user circle leave it, when a new trusted user circle is created or when the DPCK expires after a pre-determined period of time.

摘要翻译： 公开了一种用于加密密钥分发和认证支持的可信用户圈服务器，以及驻留在用户设备上的客户端应用程序。 特别地，可信用户圈服务器管理用于静态公钥（SPUK）的存储库，其用于用于端对端加密的动态私有上下文密钥（DPCK）的认证和安全分发。 因此，发布用户使用DPCK加密发布的文档，并且查看用户检索DPCK以解密发布的文档。 这些密钥与可信用户圈相关联，并为给定的循环策略上下文（CPC）动态生成。 CPC是一个标识符，表示可信用户圈的一组成员。 当信任的用户圈的任何成员离开时，当创建新的受信任的用户圈或在DPCK在预定时间段之后到期时，它会改变。