中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

7 records (took 0.023 seconds)

    NETWORK SECURITY ANOMALY AND THREAT DETECTION USING RARITY SCORING
    1.
    发明申请
    NETWORK SECURITY ANOMALY AND THREAT DETECTION USING RARITY SCORING 审中-公开

    公开(公告)号：US20180302423A1

    公开(公告)日：2018-10-18

    申请号：US16016472

    申请日：2018-06-22

    Applicant: Splunk Inc.

    Inventor： Sudhakar Muddu ,  Christos Tryfonas ,  Yijiang Li

    IPC: H04L29/06 ,  G06N99/00 ,  G06F17/30 ,  H04L12/26 ,  H04L12/24 ,  G06F3/0484 ,  G06K9/20 ,  G06F3/0482 ,  G06N7/00 ,  G06N5/04 ,  G06F17/22

    Abstract: A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

    Identifying attack behavior based on scripting language activity
    3.
    发明授权
    Identifying attack behavior based on scripting language activity 有权

    公开(公告)号：US11870795B1

    公开(公告)日：2024-01-09

    申请号：US17347278

    申请日：2021-06-14

    Applicant: SPLUNK INC.

    Inventor： Joseph Auguste Zadeh ,  Rodolfo Soto ,  Madhupreetha Chandrasekaran ,  Yijiang Li

    IPC: H04L9/40

    CPC classification number: H04L63/1425 ,  H04L63/1441 ,  H04L2463/121

    Abstract: Techniques for identifying attack behavior based on scripting language activity are disclosed. A security monitoring system generates a behavior profile for a first client device based on scripting language commands included in a first set of raw machine data received from the first client device, where the first client device is coupled to a network, and the first set of raw machine data is associated with network traffic received by or transmitted from the first client device. The security monitoring system analyzes a second set of raw machine data received from the first client device, where the second set of raw machine data is associated with subsequent network traffic received by or transmitted from the first client device. The security monitoring system detects an anomaly in the second set of raw machine data based on the behavior profile, and initiates a mitigation action in response to detecting the anomaly.

    IDENTIFYING ATTACK BEHAVIOR BASED ON SCRIPTING LANGUAGE ACTIVITY
    4.
    发明申请
    IDENTIFYING ATTACK BEHAVIOR BASED ON SCRIPTING LANGUAGE ACTIVITY 审中-公开

    公开(公告)号：US20180212985A1

    公开(公告)日：2018-07-26

    申请号：US15415853

    申请日：2017-01-25

    Applicant: Splunk, Inc.

    Inventor： Joseph Auguste Zadeh ,  Rodolfo Soto ,  Madhupreetha Chandrasekaran ,  Yijiang Li

    IPC: H04L29/06

    CPC classification number: H04L63/1425 ,  H04L63/1441 ,  H04L2463/121

    Abstract: Techniques for identifying attack behavior based on scripting language activity are disclosed. A security monitoring system generates a behavior profile for a first client device based on scripting language commands included in a first set of raw machine data received from the first client device, where the first client device is coupled to a network, and the first set of raw machine data is associated with network traffic received by or transmitted from the first client device. The security monitoring system analyzes a second set of raw machine data received from the first client device, where the second set of raw machine data is associated with subsequent network traffic received by or transmitted from the first client device. The security monitoring system detects an anomaly in the second set of raw machine data based on the behavior profile, and initiates a mitigation action in response to detecting the anomaly.

    Identifying attack behavior based on scripting language activity
    7.
    发明授权
    Identifying attack behavior based on scripting language activity 有权

    公开(公告)号：US11038905B2

    公开(公告)日：2021-06-15

    申请号：US15415853

    申请日：2017-01-25

    Applicant: Splunk, Inc.

    Inventor： Joseph Auguste Zadeh ,  Rodolfo Soto ,  Madhupreetha Chandrasekaran ,  Yijiang Li

    IPC: H04L29/06

    Abstract: Techniques for identifying attack behavior based on scripting language activity are disclosed. A security monitoring system generates a behavior profile for a first client device based on scripting language commands included in a first set of raw machine data received from the first client device, where the first client device is coupled to a network, and the first set of raw machine data is associated with network traffic received by or transmitted from the first client device. The security monitoring system analyzes a second set of raw machine data received from the first client device, where the second set of raw machine data is associated with subsequent network traffic received by or transmitted from the first client device. The security monitoring system detects an anomaly in the second set of raw machine data based on the behavior profile, and initiates a mitigation action in response to detecting the anomaly.

Patent Agency Ranking