-
公开(公告)号：US07904962B1
公开(公告)日：2011-03-08
申请号：US11371937
申请日：2006-03-10
申请人： Sushil Jajodia , Steven E. Noel , Pramod Kalapa , Brian C. O'Berry , Michael A. Jacobs , Eric B. Robertson , Robert G. Weierbach
发明人： Sushil Jajodia , Steven E. Noel , Pramod Kalapa , Brian C. O'Berry , Michael A. Jacobs , Eric B. Robertson , Robert G. Weierbach
CPC分类号： H04L41/12 , H04L63/1425
摘要： Disclosed is a system for modeling, analyzing, and responding to network attacks. Machines are mapped to components, components are mapped to vulnerabilities, and vulnerabilities are mapped to exploits. Each of the exploits includes at least one precondition mapped to at least one postcondition. An attack graph which defines inter-exploit distances is generated using at least one of the exploits. The attack graph is aggregated. At least one hardening option is determined using the aggregated attack graph. Hardening options include applying at least one corrective measure to at least one initial condition, where the initial condition is the initial state of a precondition.
摘要翻译： 公开了一种用于建模，分析和响应网络攻击的系统。 机器映射到组件，组件映射到漏洞，漏洞映射到漏洞。 每个漏洞包括映射到至少一个后置条件的至少一个前提条件。 使用至少一个漏洞利用生成定义间谍间距的攻击图。 攻击图被聚合。 使用聚合攻击图确定至少一个硬化选项。 加固选项包括将至少一个校正措施应用于至少一个初始条件，其中初始条件是前提条件的初始状态。
-
公开(公告)号：US07555778B2
公开(公告)日：2009-06-30
申请号：US11250449
申请日：2005-10-17
IPC分类号： G06F12/14 , G06F7/04 , G06F15/173
CPC分类号： H04L63/1433
摘要： Disclosed is a network hardening mechanism. The mechanism: generates a dependency graph from a multitude of exploits; constructs a goal conditions expression which may then be used to determine set(s) of safe network configurations. A subset of these safe network configuration sets may then be selected for implementation using hardening costs as a criterion.
摘要翻译： 公开了一种网络硬化机制。 机制：从多个漏洞生成依赖图; 构建目标条件表达式，然后可以将其用于确定安全网络配置的集合。 然后可以选择这些安全网络配置集的一部分，以使用硬化成本作为标准。
-
公开(公告)号：US20100192226A1
公开(公告)日：2010-07-29
申请号：US12758135
申请日：2010-04-12
IPC分类号： G06F11/00
CPC分类号： H04L41/12 , H04L63/1425
摘要： Disclosed is a system for correlating intrusion events using attack graph distances. The system includes an attack graph generator, an exploit distance calculator, an intrusion detector, an event report/exploit associator, an event graph creator, an event graph distance calculator, a correlation value calculator, and a coordinated attack analyzer. An attack graph is constructed for exploits and conditions in a network. The exploit distance calculator determines exploit distances for exploit pair(s). The intrusion detector generates event. Events are associated with exploits. Event graph distances are calculated. Correlation values are calculated for event pair(s) using event graph distances. The correlation values are analyzed using a correlation threshold to detect coordinated attacks.
摘要翻译： 公开了一种使用攻击图距离来相关入侵事件的系统。 该系统包括攻击图生成器，利用距离计算器，入侵检测器，事件报告/利用关联器，事件图形创建器，事件图距离计算器，相关值计算器和协调攻击分析器。 为网络中的利用和条件构建攻击图。 利用距离计算器确定漏洞利用距离。 入侵检测器生成事件。 事件与漏洞相关联。 计算事件图距离。 使用事件图距离计算事件对的相关值。 使用相关阈值分析相关值以检测协调的攻击。
-
公开(公告)号：US07627900B1
公开(公告)日：2009-12-01
申请号：US11371930
申请日：2006-03-10
申请人： Steven E. Noel , Sushil Jajodia
发明人： Steven E. Noel , Sushil Jajodia
CPC分类号： H04L41/12 , H04L63/1425
摘要： Disclosed is framework for aggregating network attack graphs. A network may be represented as a dependency graph. Condition set(s), exploit set(s) and machine set(s) may be generated using information from the dependency graph. Exploit-condition set(s) may be generated using the condition set(s) and the exploit set(s). Machine-exploit set(s) may be generated using the exploit-condition set(s) and machine set(s).
摘要翻译： 披露了用于聚合网络攻击图的框架。 网络可以表示为依赖图。 可以使用来自依赖图的信息来生成条件集合，利用集合和机器集合。 可以使用条件集和漏洞集来生成漏洞利用条件集。 可以使用漏洞利用条件集和机器集来生成机器漏洞集。
-
公开(公告)号：US20120227108A1
公开(公告)日：2012-09-06
申请号：US13466706
申请日：2012-05-08
IPC分类号： G06F21/00
CPC分类号： H04L41/12 , H04L63/1425
摘要： Disclosed is a system for correlating intrusion events using attack graph distances. The system includes an attack graph generator, an exploit distance calculator, an intrusion detector, an event report/exploit associator, an event graph creator, an event graph distance calculator, a correlation value calculator, and a coordinated attack analyzer. An attack graph is constructed for exploits and conditions in a network. The exploit distance calculator determines exploit distances for exploit pair(s). The intrusion detector generates event. Events are associated with exploits. Event graph distances are calculated. Correlation values are calculated for event pair(s) using event graph distances. The correlation values are analyzed using a correlation threshold to detect coordinated attacks.
摘要翻译： 公开了一种使用攻击图距离来相关入侵事件的系统。 该系统包括攻击图生成器，利用距离计算器，入侵检测器，事件报告/利用关联器，事件图形创建器，事件图距离计算器，相关值计算器和协调攻击分析器。 为网络中的利用和条件构建攻击图。 利用距离计算器确定漏洞利用距离。 入侵检测器生成事件。 事件与漏洞相关联。 计算事件图距离。 使用事件图距离计算事件对的相关值。 使用相关阈值分析相关值以检测协调的攻击。
-
公开(公告)号：US20100058456A1
公开(公告)日：2010-03-04
申请号：US12548115
申请日：2009-08-26
申请人： Sushil Jajodia , Steven E. Noel
发明人： Sushil Jajodia , Steven E. Noel
IPC分类号： G06F15/16
CPC分类号： H04L63/20 , G06F21/552
摘要： Embodiments of the present invention identify locations to deploy IDS sensor(s) within a network infrastructure and prioritize IDS alerts using attack graph analysis. An attack graph that describes exploitable vulnerability(ies) within a network infrastructure is aggregated into protection domains. Edge(s) that have exploit(s) between two protection domains are identified. Sets that contain edge(s) serviced by a common network traffic device are defined. Set(s) that collectively contain all of the edge(s) are selected. The common network traffic device(s) that service the selected sets are identified as the location(s) to deploy IDS sensor(s) within the network infrastructure.
摘要翻译： 本发明的实施例识别在网络基础设施内部署IDS传感器的位置，并使用攻击图分析对IDS警报进行优先级排序。 描述网络基础架构内的可利用漏洞的攻击图被聚合到保护域中。 识别在两个保护域之间具有漏洞的边缘。 定义包含由公共网络流量设备服务的边缘的集合。 选择集合包含所有边缘的集合。 为所选集合服务的公共网络流量设备被识别为在网络基础设施内部署IDS传感器的位置。
-
公开(公告)号：US07735141B1
公开(公告)日：2010-06-08
申请号：US11371938
申请日：2006-03-10
CPC分类号： H04L41/12 , H04L63/1425
摘要： Disclosed is a system for correlating intrusion events using attack graph distances. The system includes an attack graph generator, an exploit distance calculator, an intrusion detector, an event report/exploit associator, an event graph creator, an event graph distance calculator, a correlation value calculator, and a coordinated attack analyzer. An attack graph is constructed for exploits and conditions in a network. The exploit distance calculator determines exploit distances for exploit pair(s). The intrusion detector generates event. Events are associated with exploits. Event graph distances are calculated. Correlation values are calculated for event pair(s) using event graph distances. The correlation values are analyzed using a correlation threshold to detect coordinated attacks.
摘要翻译： 公开了一种使用攻击图距离来相关入侵事件的系统。 该系统包括攻击图生成器，利用距离计算器，入侵检测器，事件报告/利用关联器，事件图形创建器，事件图距离计算器，相关值计算器和协调攻击分析器。 为网络中的利用和条件构建攻击图。 利用距离计算器确定漏洞利用距离。 入侵检测器生成事件。 事件与漏洞相关联。 计算事件图距离。 使用事件图距离计算事件对的相关值。 使用相关阈值分析相关值以检测协调的攻击。
-
-
-
-
-
-
搜索结果
7 条记录 (耗时 0.022 秒)
