US20060294588A1 - System, method and program for identifying and preventing malicious intrusions - Google Patents
System, method and program for identifying and preventing malicious intrusions Download PDFInfo
- Publication number
- US20060294588A1 US20060294588A1 US11/166,550 US16655005A US2006294588A1 US 20060294588 A1 US20060294588 A1 US 20060294588A1 US 16655005 A US16655005 A US 16655005A US 2006294588 A1 US2006294588 A1 US 2006294588A1
- Authority
- US
- United States
- Prior art keywords
- different
- source
- messages
- addresses
- different destination
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
Definitions
- a computer worm is a computer program similar to a computer virus, except that a computer worm does not require action by a person to become active.
- a computer worm exploits some vulnerability in a system to gain access to that system. Once the worm has infected a particular system, it replicates by executing itself. Normally, worms execute themselves and spawn a process that searches for other computers on nearby networks. If a vulnerable computer is found, the worm infects this computer and the cycle continues.
- the computer worm is contained in an e-mail as an attachment, the e-mail and attachment are addressed to a specified destination (or target) IP address, and a specified destination (or target) port at the destination IP address.
- the destination port is typically associated with a communication protocol and application to handle the message.
- An object of the present invention is to identify new computer viruses, worms and other unwanted intrusions.
- System 10 also includes an intrusion analysis server 30 which includes a conventional CPU 50 , PAM 52 , ROM 54 , storage 56 , operating system 58 and TCP/IP adapter card 59 .
- Server 30 also includes an intrusion identification program 32 according to the present invention.
- Program 32 is responsible for profiling the data (both historical and current) about the messages suspected of being intrusions to detect patterns indicative of a malicious intrusion.
- Server 30 also displays to a human analyst on a console 35 the profiles and other analyses generated by program 32 to allow the analyst to make a final determination whether messages which have been detected are malicious. If so, the analyst can notify an administrator for firewalls 19 , 20 and 21 to block subsequent messages from the source IP address of these messages and all messages with this signature. Alternately, the analyst can directly update configuration files within firewalls 16 , 17 and 18 accordingly to block subsequent messages from this source IP addresses or all messages with this signature.
Abstract
Description
- The present invention relates generally to computer systems, and more particularly to identifying and preventing malicious intrusions.
- Computer attacks or intrusions are common today. Some examples are viruses, worms, buffer overflow attacks, malformed URL attacks, and brute force/denial or service attacks. Computer intrusions are typically received via a network intranet or Internet interface targeted at the operating system or an installed service. Computer firewalls can prevent some types of malicious intrusions, although they typically need a signature of the virus or worm or source IP address of the hacker to thwart the intrusion. Before the virus or worm and its signature are identified, the firewall cannot be configured to block it.
- A computer virus is a computer program that is normally harmful in nature to a computer user. Computer viruses are received via several media, such as a computer diskette, e-mail or vulnerable program. Once a virus is received by a user, it remains “dormant” until it is executed by the user (or other program). A virus typically requires a user or program to execute the virus to spread the virus and infect others. When the computer virus is contained in an e-mail as an attachment, the e-mail and attachment are addressed to a specified destination (or target) IP address, and a specified destination (or target port) at the destination address. The destination port is typically associated with a communication protocol and application to handle the message.
- A computer worm is a computer program similar to a computer virus, except that a computer worm does not require action by a person to become active. A computer worm exploits some vulnerability in a system to gain access to that system. Once the worm has infected a particular system, it replicates by executing itself. Normally, worms execute themselves and spawn a process that searches for other computers on nearby networks. If a vulnerable computer is found, the worm infects this computer and the cycle continues. When the computer worm is contained in an e-mail as an attachment, the e-mail and attachment are addressed to a specified destination (or target) IP address, and a specified destination (or target) port at the destination IP address. As noted above, the destination port is typically associated with a communication protocol and application to handle the message.
- As noted above, some types of computer intrusions (including viruses and worms) have a characteristic signature by which the intrusion can be identified. The signature can take various forms depending on the nature of the virus or worm, but typically comprises several consecutive lines of plain text or executable code that are distinctive and appear in the virus or worm program. Once a signature is determined for a new computer virus or worm, intrusion detection or intrusion prevention software can be created and distributed to customers for inclusion in their firewalls. The intrusion detection or intrusion prevention software detects the virus or worm from a network interface card (NIC) or when the virus or worm attempts to pass through a firewall. The detection is by a “key word” search for the signature of the virus or worm. The intrusion prevention or intrusion detection software will then thwart the virus or worm by deleting it or preventing its execution by appropriate command to the operating system. It is important to identify new computer intrusions (and their signatures), as soon as possible after the new intrusion is released. Then, its signatures can be identified and the intrusion prevention or intrusion detection software can be created and distributed to customers.
- A hacker may also send “exploitation” code to the victim's server or workstation, which code automatically exploits vulnerabilities in a victim's server, as would a hacker do manually. For example, a buffer overflow attack exploitation program exploits a vulnerability, typically caused by programmer error, that allows for arbitrary code execution on the target system. As another example, an attacker can inject special machine code into a program variable (usually input by a user) to cause arbitrary code execution in a program. This special code, once given to the program to execute, is placed in the correct area of computer memory, such that the executing program is unaware of the malicious intent of the injected code. There are several classes of buffer overflow, including format string, remote and local. It is important to thwart exploitation code, as well as viruses and worm.
- Intrusion Detection Systems (“IDSs”) are currently known and have a list of signatures of known or suspected viruses, worms and other common intrusions. The IDS may be logically located behind a firewall. The IDS searches each packet it receives for the signatures in its list, and thereby detects a virus, worm or other intrusion. When this occurs, the IDS notifies a security operations center (“SOC”), and the SOC will check that the proper anti-virus, anti-worm or other intrusion protection software is currently installed in the enterprise or customer network. While the IDS is effective in safeguarding an enterprise against confirmed certain viruses, worm and other intrusions which are known or suspected, improvements are need to identify malicious intrusions which have not yet been identified and for which their signatures are not yet identified.
- Some types of source profiling are also known to identify new computer intrusions. For example, US Published Patent Application US 2002/0035698 A1 discloses receipt and analysis of network traffic destined for services to identify an undesirable use of the services. This published patent application also discloses identification of topologically anomalous application-level patterns of traffic and removal of these data flows in real-time from the network. The published patent application considers temporal parameters such as time of day, day of week, day of month and holidays when the traffic occurs.
- US Published Patent Application US 2004/0117478 A1 discloses a system for analyzing network traffic to detect suspect packets and identify intrusions or potential threats. Data packets which meet defined criteria are detected and their details forwarded to a database server where the details are stored so as to be accessible for use in analysis in conjunction with the details of other detected packets. The objective of the published patent application is to allow users to detect hostile network activity and take action based both on real-time information and correlation with historical data. This published patent application performs historical analysis and correlation on the traffic, to build up profiles of both attackers. The published patent application also discloses that to detect some types of intrusions it is useful to have some state in a sniffer. Statefulness is important in detecting a large number of hanging connections in a denial of service attack against a specific machine. Another area where statefulness is useful is to detect sudden peaks in the number of packets directed at specific hosts or specific ports. An alert is raised when changes in traffic patterns are detected even if the individual packets seem harmless, and are not logged to the database.
- An object of the present invention is to identify new computer viruses, worms and other unwanted intrusions.
- The present invention resides in a computer system, method and program product for identifying a malicious intrusion. A first number of different destination IP addresses, a second number of different destination ports and a third number of different signatures of messages, are identified from a source IP address during a predetermined period. A determination is made that in one or more other such predetermined periods the source IP address sent messages having the first number of different destination IP addresses, the second number of different destination ports and the third number of different signatures.
- In accordance with a feature of the present invention, based on the determination that in the one or more other such predetermined periods the source IP address sent messages having the first number of different destination IP addresses, the second number of different destination ports and the third number of different signatures, a determination is made that the messages are characteristic of a malicious intrusion.
-
FIG. 1 is a block diagram of a computer system which incorporates the present invention. - FIGS. 2(A) and 2(B) form a flow chart illustrating an intrusion identification program within the computer system of
FIG. 1 . -
FIG. 3 is a flow chart of a statistical analysis function within the intrusion identification program ofFIG. 2 . - The present invention will now be described in detail with reference to the figures, where like reference numbers indicate like elements throughout.
FIG. 1 illustrates a computer system 10 which incorporates the present invention. System 10 includes knownfirewalls firewalls -
- nature of data generated by the message.
- destination TCP port where malware is known to exist.
- multiple failed login attempts to a host trying to authenticate a user.
- TCP/IP packet content data that attempts to execute code.
- multiple incomplete TCP/IP “three way handshakes”.
- connection attempts from known “blacklisted”(bad IP address list) IP address.
- System 10 includes
intrusion detection sensors respective firewalls sensors Sensors respective firewalls sensors event database server 12 viaInternet 14. In the notification, thesensors Server 12 stores the data describing each message in adatabase 20.Server 12 also displays this “raw” data about the messages on aconsole 13 for (unassisted) analysis by a human analyst. - System 10 also includes an
intrusion analysis server 30 which includes aconventional CPU 50,PAM 52,ROM 54,storage 56,operating system 58 and TCP/IP adapter card 59.Server 30 also includes anintrusion identification program 32 according to the present invention.Program 32 is responsible for profiling the data (both historical and current) about the messages suspected of being intrusions to detect patterns indicative of a malicious intrusion.Server 30 also displays to a human analyst on aconsole 35 the profiles and other analyses generated byprogram 32 to allow the analyst to make a final determination whether messages which have been detected are malicious. If so, the analyst can notify an administrator forfirewalls firewalls -
FIG. 2 illustratesintrusion identification program 32 and related manual and automatic processing in more detail. Instep 100, anintrusion detection sensor respective firewall sensor database server 12 and identifies the message (as noted above) which is suspected to be an intrusion. In response,server 12 records indatabase 20 information about the suspected intrusion, including its source IP address, destination IP address, destination port, signature if known tosensor console 13 performs a general analysis of the records in database 20 (step 104). The general analysis comprises reviewing data that scrolls throughconsole 13, and determining, to the best knowledge of the human analyst, if the data is known to be malicious or benign. Alternately,program 32 can generally analyze the data by comparing it to a list of source IP addresses, source ports, etc. known to be malicious. Afterstep 104, two series of steps are performed in parallel. In one series,program 32 sorts and tallies for each source IP address the number of different destination IP addresses, number of different destination ports and number of different signatures matched during a predetermined period, such as each day. This sorting and tallying is performed as follows. Instep 108,program 32 queries the records indatabase 20 for different target IP addresses, different target ports and different suspected intrusion signatures, for each source IP address. Instep 109,program 32 sorts or aggregates the records obtained instep 300 for each source IP address for each day, and records them in an HTML table 40. Next, an analyst performs an in-depth analysis of individual packets within the messages (step 110). This in-depth analysis comprises using known specialized data analysis tools to look at data in more detail than that of the general analysis. That is, if the human analyst identifies malicious traffic, or what he or she deems to be malicious traffic, the human analyst can use custom data analysis tools to prove or disprove their assumptions. The custom data analysis tools perform functions such as the following functions: -
- plot raw data into graphs for visual interpretation (where the x-axis can be time, the y-axis can be source IP address, destination IP address, destination port, message signature, etc. with different colors for different source IP addresses, destination IP addresses, destination ports, message signatures, etc. and
- log reports from the analyst to the customer of results of human analysis, and different types of signatures that the IDS detected as suspicious.
- Next,
program 32 displays the HTML table 40 andprogram 32 and the analyst reviews the compilations made byprogram 32 indicating the number of different target IP addresses, number of different target ports and number of different intrusion signatures matched during each day for each source IP address (step 112). Each HTML table includes this daily data for suspected intrusions over several or many days such as thirty. Next,intrusion analysis program 32 determines, based on the data and statistics in table 40, whether there is a pattern of messages characteristic of a known intrusion, either harmless or harmful (decision 114). By way of example, such patterns for each source IP address can be a combination of: - (a) number of different target IP addresses in all messages from the same source IP address during a predetermined (for example, daily) period;
- (b) number of different target ports in all the messages from that same source IP address during the same predetermined (for example, daily) period; and
- (c) number of different (ex. virus, worm, etc.) suspected intrusion signatures matched (against a list in the sensors) in all the messages from that same source IP address during the same predetermined (for example, daily) period; wherein
- (d) during a longer predetermined period, such as monthly, there are at least two, (and typically several) daily periods during which the number of different target IP addresses, number of different target ports and number of different intrusion signatures for the same source IP address was the same. For example, during a one month period there may be eleven different days during which there were a total of five different target IP addresses, four different target ports and three different matched intrusion signatures, from messages originated from the same source IP address. As explained in more detail below, the repetition of these numbers often represents a pattern indicative of the nature of the messages, either friendly or malicious. (Typically, a frequent repetition of these numbers during the monthly period tends to indicate a malicious intrusion, assuming the source IP address is not known to be friendly.)
- In some cases, the repetition during a month of a combination of a specific number of different target IP addresses, specific different target ports and specific number of different intrusion signatures (matched against a list in the
sensors decision 114, yes branch). This is based on records stored byserver 32, based on past iterations ofprogram 32 during previous analysis (for example, monthly) periods and patterns detected during such periods. In such cases where the combination is known to indicate an intrusion,program 32 displays for the analyst, or sends a notification to an administrator of thefirewalls firewall firewall - Refer again to
decision 114, no branch, where the combination of a specific number of different target IP addresses, specific different target ports and specific number of different intrusion signatures matched for a specific source IP address during a certain number of days of the month does not equal a combination previously determined to be indicative of a malicious intrusion. In such a case,program 32 or the analyst determines if there is another reason to conclude that the messages from the source IP address are likely to be malicious or “malware” (decision 118). Program 32 (or the human analyst) makes the determination by looking for a predetermined or higher number of days (at least two and typically several days) during which there were the same number of different target IP addresses, same number of different target ports and same number of different intrusion signatures (matched by the sensor), where the source IP address is not known to be friendly. (Theprogram 32 or human analyst may learn that an IP address is friendly by contacting the customer, and asking the customer if the customer knows the source IP address to be friendly.) In general, the higher number of days during which there were the same number of different target IP addresses, same number of different target ports and same number of different intrusion signatures matched, the greater the likelihood that the messages are intrusion, assuming the source IP address is not known to the analyst or customer to be friendly. If the number of such days exceeds the predetermined number (and the source IP address is not known to the analyst or customer to be friendly), then theprogram 32 or analyst warns the firewall administrators that this source IP address and signature are likely to be malicious (step 119). - Referring again to
decision 118, no branch, where the combination of number of different target IP addresses, number of different target ports and number of different intrusion signatures matched do not indicate that the message is malicious, based on previous iterations ofprogram 32 or other known patterns. In such a case, the reason may be that there are one or two days of data that are not characteristic of the messages. So, the analyst will review the numbers for each source IP address for each day, to determine which combination of specific number of different target IP addresses, specific number of different target ports and specific number of different intrusion signatures matched for a specific source IP address best represents the pattern of messages from the source IP address (step 120). For example, if there were eight days with the same number of target IP address, same number of target port and same number of different matched signatures, and one day with a different number of target IP addresses, different number of target ports or different number of matched signatures, the analyst will disregard this one day. Afterstep 120, the analyst makes an entry in the database (the data warehouse) table 40 for this source IP address to reflect the representative numbers of different target IP addresses, different target ports and different signatures matched (step 122). Then,program 32 or the analyst repeats the analysis ofdecision 118 using the representative numbers. If the representative numbers indicate a malicious intrusion (step 118, yes branch), thenprogram 32 performs the processing ofstep 119. If the representative numbers do not indicate a malicious intrusion, thenprogram 32 deems the messages as not malicious and ignores them (step 124). - Refer again to step 104 and the other series of steps performed in parallel with steps 108-124. In
step 130,intrusion analysis program 32 creates a destination port “pivot” table 42 to represent the distribution of numbers of destination ports per source IP address during the month. The port pivot table is based on a standard deviation from the norm calculated over a predetermined number of days, such as thirty. -
FIG. 3 illustratesstep 130 in more detail. Instep 300,program 32 identifies from the HTML table 40 a predetermined number (such as twenty) of destination ports that have the highest volume of incoming message traffic. Then, for each such destination port,program 32 calculates the standard deviation and mean of number of incoming messages for the last predetermined period (such as thirty days) (step 302). Then,program 32 subtracts each day's total number of incoming messages from the mean for the last predetermined period (such as thirty days) (step 304). Then,program 32 divides each day's difference calculated instep 304 by the standard deviation calculated instep 302 to yield the number of standard deviations (“X”) above or below the norm for the day (step 306). The greater number of standard deviations above the norm, the greater the risk that the port is under attack. Thus,program 32 determines if “X” is less than two but not equal to zero (decision 310). If so, thenprogram 32 categorizes or classifies the port as “low concern”, i.e. unlikely to be the target of malware (step 312). Next,program 32 determines if “X” is greater than one but less than four (decision 314). If so, thenprogram 32 categorizes or classifies the port as “medium concern”, i.e. moderately likely to be the target of malware (step 316). Next,program 32 determines if “X” is greater than or equal to four (decision 318). If so, thenprogram 32 categorizes or classifies the port as “high concern”, i.e. likely to be the target of malware (step 320). If “X” is less than or equal to zero, thenprogram 32 categorizes or classifies the port as not important, and drops it from the list (step 322) - Then,
program 32 makes a record in HTML table 40 for the ports in the list (step 324). The record indicates the port number, number of incoming messages during the day, standard deviation from the mean, total number of incoming messages during the ten days and the level of concern. A human analyst periodically reviews the records made in step 324 to determine if further investigation is required (step 326). This determination is based on how many standard deviations from the mean a particular port deviates. - Referring again to
FIG. 2 , afterprogram 32 creates the destination port pivot table instep 130,program 32 determines if there are any destination ports with highly anomalous data, i.e. data volumes that falls out of the normal range of activity for that port (decision 132). If there are no destination ports with highly anomalous data (decision 132, no branch), thenprogram 32 concludes its analysis of the ports; no intrusions are suspected (step 134). However, if there are any destination ports with highly anomalous data (decision 132, yes branch), then program 33 or the human analyst performs an in depth analysis of such destination ports (step 136). The in-depth analysis comprises displaying information about the port, such as common programs that run on that given port and port volume data for a selected period of time (e.g., thirty days, sixty days or ninety days). -
Program 32 can be loaded intoserver 12 from a computer storage medium such as magnetic tape or disk, optical CD ROM, DVD, etc. or downloaded from network media from the Internet via a TCP/IP adapter card, and stored in RAM inserver 12. The storage media, network media and RAM are collectively called “computer readable media”. - Based on the foregoing, a system, method and program for identifying malicious intrusions have been disclosed. However, numerous modifications and substitutions can be made without deviating from the scope of the present invention. Therefore, the present invention has been disclosed by way of illustration of not limitation, and reference should be made to the following claims to determine the scope of the present invention.
Claims (9)
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/166,550 US20060294588A1 (en) | 2005-06-24 | 2005-06-24 | System, method and program for identifying and preventing malicious intrusions |
CNB2006100826549A CN100448203C (en) | 2005-06-24 | 2006-05-24 | System and method for identifying and preventing malicious intrusions |
US13/965,303 US8931099B2 (en) | 2005-06-24 | 2013-08-13 | System, method and program for identifying and preventing malicious intrusions |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/166,550 US20060294588A1 (en) | 2005-06-24 | 2005-06-24 | System, method and program for identifying and preventing malicious intrusions |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/965,303 Continuation US8931099B2 (en) | 2005-06-24 | 2013-08-13 | System, method and program for identifying and preventing malicious intrusions |
Publications (1)
Publication Number | Publication Date |
---|---|
US20060294588A1 true US20060294588A1 (en) | 2006-12-28 |
Family
ID=37569161
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/166,550 Abandoned US20060294588A1 (en) | 2005-06-24 | 2005-06-24 | System, method and program for identifying and preventing malicious intrusions |
US13/965,303 Active US8931099B2 (en) | 2005-06-24 | 2013-08-13 | System, method and program for identifying and preventing malicious intrusions |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/965,303 Active US8931099B2 (en) | 2005-06-24 | 2013-08-13 | System, method and program for identifying and preventing malicious intrusions |
Country Status (2)
Country | Link |
---|---|
US (2) | US20060294588A1 (en) |
CN (1) | CN100448203C (en) |
Cited By (55)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070005753A1 (en) * | 2005-06-29 | 2007-01-04 | Simon Crosby | Methods, apparatus, and systems for distributed hypothesis testing in autonomic processing machines |
US20070078589A1 (en) * | 2005-10-05 | 2007-04-05 | Antonio Magnaghi | Detecting anomalies internal to a network from traffic external to the network |
US20070272122A1 (en) * | 2006-03-24 | 2007-11-29 | Joerg Lahann | Reactive coatings for regioselective surface modification |
US20070281126A1 (en) * | 2006-06-01 | 2007-12-06 | The Regents Of The University Of Michigan | Dry adhesion bonding |
US20080127306A1 (en) * | 2006-09-15 | 2008-05-29 | Microsoft Corporation | Automated Service for Blocking Malware Hosts |
US20080144613A1 (en) * | 2006-12-13 | 2008-06-19 | Avaya Technology Llc | Maintaining Communication Between Network Nodes that are Subjected to a Packet Attack |
US20080229414A1 (en) * | 2007-03-14 | 2008-09-18 | Microsoft Corporation | Endpoint enabled for enterprise security assessment sharing |
US20080229422A1 (en) * | 2007-03-14 | 2008-09-18 | Microsoft Corporation | Enterprise security assessment sharing |
US20080229421A1 (en) * | 2007-03-14 | 2008-09-18 | Microsoft Corporation | Adaptive data collection for root-cause analysis and intrusion detection |
US20080229419A1 (en) * | 2007-03-16 | 2008-09-18 | Microsoft Corporation | Automated identification of firewall malware scanner deficiencies |
US20080244748A1 (en) * | 2007-04-02 | 2008-10-02 | Microsoft Corporation | Detecting compromised computers by correlating reputation data with web access logs |
US20080269456A1 (en) * | 2007-03-22 | 2008-10-30 | Joerg Lahann | Multifunctional cvd coatings |
WO2008134057A1 (en) * | 2007-04-30 | 2008-11-06 | Sourcefire, Inc. | Real-time awareness for a computer network |
US20080276316A1 (en) * | 2004-07-29 | 2008-11-06 | Roelker Daniel J | Intrusion detection strategies for hypertext transport protocol |
US20080301812A1 (en) * | 2007-05-29 | 2008-12-04 | Alcatel Lucent | Method and system for counting new destination addresses |
US7539681B2 (en) | 2004-07-26 | 2009-05-26 | Sourcefire, Inc. | Methods and systems for multi-pattern searching |
US7606214B1 (en) * | 2006-09-14 | 2009-10-20 | Trend Micro Incorporated | Anti-spam implementations in a router at the network layer |
US20090293122A1 (en) * | 2008-05-21 | 2009-11-26 | Alcatel-Lucent | Method and system for identifying enterprise network hosts infected with slow and/or distributed scanning malware |
US20100071061A1 (en) * | 2005-06-29 | 2010-03-18 | Trustees Of Boston University | Method and Apparatus for Whole-Network Anomaly Diagnosis and Method to Detect and Classify Network Anomalies Using Traffic Feature Distributions |
US7701945B2 (en) | 2006-08-10 | 2010-04-20 | Sourcefire, Inc. | Device, system and method for analysis of segments in a transmission control protocol (TCP) session |
US7716742B1 (en) | 2003-05-12 | 2010-05-11 | Sourcefire, Inc. | Systems and methods for determining characteristics of a network and analyzing vulnerabilities |
US20100132038A1 (en) * | 2008-11-26 | 2010-05-27 | Zaitsev Oleg V | System and Method for Computer Malware Detection |
US7733803B2 (en) | 2005-11-14 | 2010-06-08 | Sourcefire, Inc. | Systems and methods for modifying network map attributes |
US7948988B2 (en) | 2006-07-27 | 2011-05-24 | Sourcefire, Inc. | Device, system and method for analysis of fragments in a fragment train |
US20110219450A1 (en) * | 2010-03-08 | 2011-09-08 | Raytheon Company | System And Method For Malware Detection |
US8046833B2 (en) | 2005-11-14 | 2011-10-25 | Sourcefire, Inc. | Intrusion event correlation with network discovery information |
US8069352B2 (en) | 2007-02-28 | 2011-11-29 | Sourcefire, Inc. | Device, system and method for timestamp analysis of segments in a transmission control protocol (TCP) session |
WO2012054401A1 (en) * | 2010-10-18 | 2012-04-26 | Board Of Regents Of The University Of Texas System | Remediation of computer security vulnerabilities |
US20120233694A1 (en) * | 2011-03-11 | 2012-09-13 | At&T Intellectual Property I, L.P. | Mobile malicious software mitigation |
US8272055B2 (en) | 2008-10-08 | 2012-09-18 | Sourcefire, Inc. | Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention system |
US8433790B2 (en) | 2010-06-11 | 2013-04-30 | Sourcefire, Inc. | System and method for assigning network blocks to sensors |
US8474043B2 (en) | 2008-04-17 | 2013-06-25 | Sourcefire, Inc. | Speed and memory optimization of intrusion detection system (IDS) and intrusion prevention system (IPS) rule processing |
US8554907B1 (en) * | 2011-02-15 | 2013-10-08 | Trend Micro, Inc. | Reputation prediction of IP addresses |
US8601034B2 (en) | 2011-03-11 | 2013-12-03 | Sourcefire, Inc. | System and method for real time data awareness |
US20140033310A1 (en) * | 2012-07-30 | 2014-01-30 | Newegg Inc. | System and Method of Active Remediation and Passive Protection Against Cyber Attacks |
US8671182B2 (en) | 2010-06-22 | 2014-03-11 | Sourcefire, Inc. | System and method for resolving operating system or service identity conflicts |
US8677486B2 (en) | 2010-04-16 | 2014-03-18 | Sourcefire, Inc. | System and method for near-real time network attack detection, and system and method for unified detection via detection routing |
US20140113588A1 (en) * | 2012-10-18 | 2014-04-24 | Deutsche Telekom Ag | System for detection of mobile applications network behavior- netwise |
US20140156720A1 (en) * | 2012-12-03 | 2014-06-05 | Aruba Networks, Inc. | Control plane protection for various tables using storm prevention entries |
US20140167960A1 (en) * | 2012-12-19 | 2014-06-19 | Wal-Mart Stores, Inc. | Detecting Defective Shopping Carts |
US9009820B1 (en) * | 2010-03-08 | 2015-04-14 | Raytheon Company | System and method for malware detection using multiple techniques |
US20150135324A1 (en) * | 2013-11-11 | 2015-05-14 | International Business Machines Corporation | Hyperlink data presentation |
US20170085577A1 (en) * | 2015-09-22 | 2017-03-23 | Lorraine Wise | Computer method for maintaining a hack trap |
US20170125073A1 (en) * | 2015-01-29 | 2017-05-04 | Knuedge Incorporated | Affinity Data Collection in a Computing System |
US20180124070A1 (en) * | 2008-08-04 | 2018-05-03 | Zscaler, Inc. | Cloud-based malware detection |
US20190044962A1 (en) * | 2012-12-27 | 2019-02-07 | Huawei Technologies Co., Ltd. | Method, Apparatus, and Device for Detecting E-mail Attack |
US20190075131A1 (en) * | 2014-06-02 | 2019-03-07 | Paypal, Inc. | Dynamic detection of geo-location obfuscation in of internet devices |
US10331569B2 (en) | 2016-01-05 | 2019-06-25 | Friday Harbor Llc | Packet router buffer management |
US10360178B2 (en) * | 2016-05-12 | 2019-07-23 | International Business Machines Corporation | Process scheduling based on file system consistency level |
US20190387012A1 (en) * | 2017-03-03 | 2019-12-19 | Nippon Telegraph And Telephone Corporation | Log analysis apparatus, log analysis method, and log analysis program |
US20190394236A1 (en) * | 2016-12-09 | 2019-12-26 | International Business Machines Corporation | Protecting against notification based phishing attacks |
US10558803B2 (en) | 2013-11-13 | 2020-02-11 | Proofpoint, Inc. | System and method of protecting client computers |
US11240258B2 (en) * | 2015-11-19 | 2022-02-01 | Alibaba Group Holding Limited | Method and apparatus for identifying network attacks |
US20220284094A1 (en) * | 2005-06-30 | 2022-09-08 | Webroot Inc. | Methods and apparatus for malware threat research |
US20230085654A1 (en) * | 2019-05-08 | 2023-03-23 | Capital One Services, Llc | Virtual private cloud flow log event fingerprinting and aggregation |
Families Citing this family (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101014047A (en) * | 2007-02-06 | 2007-08-08 | 华为技术有限公司 | Method for locating the attack source of multimedia subsystem network, system and anti-attack system |
US20190141059A1 (en) * | 2016-06-23 | 2019-05-09 | Mitsubishi Electric Corporation | Intrusion detection apparatus and computer readable medium |
CN106022115A (en) * | 2016-07-20 | 2016-10-12 | 浪潮电子信息产业股份有限公司 | Method for tracing risk program |
CN109246109A (en) * | 2018-09-18 | 2019-01-18 | 扬州凤凰网络安全设备制造有限责任公司 | The secure memory item of software and hardware combining |
CN109547416A (en) * | 2018-10-30 | 2019-03-29 | 扬州凤凰网络安全设备制造有限责任公司 | Physical level security server |
US11201881B2 (en) * | 2018-10-31 | 2021-12-14 | Hewlett Packard Enterprise Development Lp | Behavioral profiling of service access using intent to access in discovery protocols |
CN110460577B (en) * | 2019-07-09 | 2021-08-03 | 昆明理工大学 | Intrusion detection system based on improved computer viruses |
US11765188B2 (en) * | 2020-12-28 | 2023-09-19 | Mellanox Technologies, Ltd. | Real-time detection of network attacks |
Citations (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5761440A (en) * | 1994-09-15 | 1998-06-02 | International Business Machines Corporation | System and method utilizing multiple search trees to route data within a data processing network |
US6657956B1 (en) * | 1996-03-07 | 2003-12-02 | Bull Cp8 | Method enabling secure access by a station to at least one server, and device using same |
US20050091533A1 (en) * | 2003-10-28 | 2005-04-28 | Fujitsu Limited | Device and method for worm detection, and computer product |
US6950434B1 (en) * | 1999-12-07 | 2005-09-27 | Advanced Micro Devices, Inc. | Arrangement for searching packet policies using multi-key hash searches in a network switch |
US20060047832A1 (en) * | 2004-05-21 | 2006-03-02 | Christopher Betts | Method and apparatus for processing web service messages |
US7017185B1 (en) * | 2000-12-21 | 2006-03-21 | Cisco Technology, Inc. | Method and system for maintaining network activity data for intrusion detection |
US20060137009A1 (en) * | 2004-12-22 | 2006-06-22 | V-Secure Technologies, Inc. | Stateful attack protection |
US20060212572A1 (en) * | 2000-10-17 | 2006-09-21 | Yehuda Afek | Protecting against malicious traffic |
US7181765B2 (en) * | 2001-10-12 | 2007-02-20 | Motorola, Inc. | Method and apparatus for providing node security in a router of a packet network |
US7246156B2 (en) * | 2003-06-09 | 2007-07-17 | Industrial Defender, Inc. | Method and computer program product for monitoring an industrial network |
US7424744B1 (en) * | 2002-03-05 | 2008-09-09 | Mcafee, Inc. | Signature based network intrusion detection system and method |
US7440406B2 (en) * | 2004-12-29 | 2008-10-21 | Korea University Industry & Academy Cooperation Foundation | Apparatus for displaying network status |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
GB2362076B (en) * | 2000-05-03 | 2002-08-14 | 3Com Corp | Detection of an attack such as a pre-attack on a computer network |
US20020035698A1 (en) | 2000-09-08 | 2002-03-21 | The Regents Of The University Of Michigan | Method and system for protecting publicly accessible network computer services from undesirable network traffic in real-time |
GB0022485D0 (en) * | 2000-09-13 | 2000-11-01 | Apl Financial Services Oversea | Monitoring network activity |
CN1156762C (en) * | 2001-12-04 | 2004-07-07 | 上海复旦光华信息科技股份有限公司 | By-pass investigation and remisson method for rejecting service attack |
US20030188189A1 (en) * | 2002-03-27 | 2003-10-02 | Desai Anish P. | Multi-level and multi-platform intrusion detection and response system |
US20030196123A1 (en) | 2002-03-29 | 2003-10-16 | Rowland Craig H. | Method and system for analyzing and addressing alarms from network intrusion detection systems |
WO2003083660A1 (en) * | 2002-03-29 | 2003-10-09 | Global Dataguard, Inc. | Adaptive behavioral intrusion detection systems and methods |
US7774839B2 (en) * | 2002-11-04 | 2010-08-10 | Riverbed Technology, Inc. | Feedback mechanism to minimize false assertions of a network intrusion |
-
2005
- 2005-06-24 US US11/166,550 patent/US20060294588A1/en not_active Abandoned
-
2006
- 2006-05-24 CN CNB2006100826549A patent/CN100448203C/en active Active
-
2013
- 2013-08-13 US US13/965,303 patent/US8931099B2/en active Active
Patent Citations (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5761440A (en) * | 1994-09-15 | 1998-06-02 | International Business Machines Corporation | System and method utilizing multiple search trees to route data within a data processing network |
US6657956B1 (en) * | 1996-03-07 | 2003-12-02 | Bull Cp8 | Method enabling secure access by a station to at least one server, and device using same |
US6950434B1 (en) * | 1999-12-07 | 2005-09-27 | Advanced Micro Devices, Inc. | Arrangement for searching packet policies using multi-key hash searches in a network switch |
US20060212572A1 (en) * | 2000-10-17 | 2006-09-21 | Yehuda Afek | Protecting against malicious traffic |
US7017185B1 (en) * | 2000-12-21 | 2006-03-21 | Cisco Technology, Inc. | Method and system for maintaining network activity data for intrusion detection |
US7181765B2 (en) * | 2001-10-12 | 2007-02-20 | Motorola, Inc. | Method and apparatus for providing node security in a router of a packet network |
US7424744B1 (en) * | 2002-03-05 | 2008-09-09 | Mcafee, Inc. | Signature based network intrusion detection system and method |
US7246156B2 (en) * | 2003-06-09 | 2007-07-17 | Industrial Defender, Inc. | Method and computer program product for monitoring an industrial network |
US20050091533A1 (en) * | 2003-10-28 | 2005-04-28 | Fujitsu Limited | Device and method for worm detection, and computer product |
US20060047832A1 (en) * | 2004-05-21 | 2006-03-02 | Christopher Betts | Method and apparatus for processing web service messages |
US20060137009A1 (en) * | 2004-12-22 | 2006-06-22 | V-Secure Technologies, Inc. | Stateful attack protection |
US7440406B2 (en) * | 2004-12-29 | 2008-10-21 | Korea University Industry & Academy Cooperation Foundation | Apparatus for displaying network status |
Cited By (107)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7949732B1 (en) | 2003-05-12 | 2011-05-24 | Sourcefire, Inc. | Systems and methods for determining characteristics of a network and enforcing policy |
US8578002B1 (en) | 2003-05-12 | 2013-11-05 | Sourcefire, Inc. | Systems and methods for determining characteristics of a network and enforcing policy |
US7885190B1 (en) | 2003-05-12 | 2011-02-08 | Sourcefire, Inc. | Systems and methods for determining characteristics of a network based on flow analysis |
US7801980B1 (en) | 2003-05-12 | 2010-09-21 | Sourcefire, Inc. | Systems and methods for determining characteristics of a network |
US7730175B1 (en) | 2003-05-12 | 2010-06-01 | Sourcefire, Inc. | Systems and methods for identifying the services of a network |
US7716742B1 (en) | 2003-05-12 | 2010-05-11 | Sourcefire, Inc. | Systems and methods for determining characteristics of a network and analyzing vulnerabilities |
US7996424B2 (en) | 2004-07-26 | 2011-08-09 | Sourcefire, Inc. | Methods and systems for multi-pattern searching |
US7756885B2 (en) | 2004-07-26 | 2010-07-13 | Sourcefire, Inc. | Methods and systems for multi-pattern searching |
US7539681B2 (en) | 2004-07-26 | 2009-05-26 | Sourcefire, Inc. | Methods and systems for multi-pattern searching |
US20080276316A1 (en) * | 2004-07-29 | 2008-11-06 | Roelker Daniel J | Intrusion detection strategies for hypertext transport protocol |
US7496962B2 (en) | 2004-07-29 | 2009-02-24 | Sourcefire, Inc. | Intrusion detection strategies for hypertext transport protocol |
US20100071061A1 (en) * | 2005-06-29 | 2010-03-18 | Trustees Of Boston University | Method and Apparatus for Whole-Network Anomaly Diagnosis and Method to Detect and Classify Network Anomalies Using Traffic Feature Distributions |
US7603461B2 (en) * | 2005-06-29 | 2009-10-13 | Intel Corporation | Methods, apparatus, and systems for distributed hypothesis testing in autonomic processing machines |
US8869276B2 (en) * | 2005-06-29 | 2014-10-21 | Trustees Of Boston University | Method and apparatus for whole-network anomaly diagnosis and method to detect and classify network anomalies using traffic feature distributions |
US20070005753A1 (en) * | 2005-06-29 | 2007-01-04 | Simon Crosby | Methods, apparatus, and systems for distributed hypothesis testing in autonomic processing machines |
US20220284094A1 (en) * | 2005-06-30 | 2022-09-08 | Webroot Inc. | Methods and apparatus for malware threat research |
US20070078589A1 (en) * | 2005-10-05 | 2007-04-05 | Antonio Magnaghi | Detecting anomalies internal to a network from traffic external to the network |
US8046833B2 (en) | 2005-11-14 | 2011-10-25 | Sourcefire, Inc. | Intrusion event correlation with network discovery information |
US7733803B2 (en) | 2005-11-14 | 2010-06-08 | Sourcefire, Inc. | Systems and methods for modifying network map attributes |
US8289882B2 (en) | 2005-11-14 | 2012-10-16 | Sourcefire, Inc. | Systems and methods for modifying network map attributes |
US20070272122A1 (en) * | 2006-03-24 | 2007-11-29 | Joerg Lahann | Reactive coatings for regioselective surface modification |
US7909928B2 (en) | 2006-03-24 | 2011-03-22 | The Regents Of The University Of Michigan | Reactive coatings for regioselective surface modification |
US7947148B2 (en) | 2006-06-01 | 2011-05-24 | The Regents Of The University Of Michigan | Dry adhesion bonding |
US20070281126A1 (en) * | 2006-06-01 | 2007-12-06 | The Regents Of The University Of Michigan | Dry adhesion bonding |
US7948988B2 (en) | 2006-07-27 | 2011-05-24 | Sourcefire, Inc. | Device, system and method for analysis of fragments in a fragment train |
US7701945B2 (en) | 2006-08-10 | 2010-04-20 | Sourcefire, Inc. | Device, system and method for analysis of segments in a transmission control protocol (TCP) session |
US7606214B1 (en) * | 2006-09-14 | 2009-10-20 | Trend Micro Incorporated | Anti-spam implementations in a router at the network layer |
US8646038B2 (en) * | 2006-09-15 | 2014-02-04 | Microsoft Corporation | Automated service for blocking malware hosts |
US20080127306A1 (en) * | 2006-09-15 | 2008-05-29 | Microsoft Corporation | Automated Service for Blocking Malware Hosts |
US8353030B2 (en) * | 2006-12-13 | 2013-01-08 | Avaya Inc. | Maintaining communication between network nodes that are subjected to a packet attack |
US20080144613A1 (en) * | 2006-12-13 | 2008-06-19 | Avaya Technology Llc | Maintaining Communication Between Network Nodes that are Subjected to a Packet Attack |
US8069352B2 (en) | 2007-02-28 | 2011-11-29 | Sourcefire, Inc. | Device, system and method for timestamp analysis of segments in a transmission control protocol (TCP) session |
US8959568B2 (en) | 2007-03-14 | 2015-02-17 | Microsoft Corporation | Enterprise security assessment sharing |
US8955105B2 (en) | 2007-03-14 | 2015-02-10 | Microsoft Corporation | Endpoint enabled for enterprise security assessment sharing |
US20080229414A1 (en) * | 2007-03-14 | 2008-09-18 | Microsoft Corporation | Endpoint enabled for enterprise security assessment sharing |
US8413247B2 (en) | 2007-03-14 | 2013-04-02 | Microsoft Corporation | Adaptive data collection for root-cause analysis and intrusion detection |
US20080229421A1 (en) * | 2007-03-14 | 2008-09-18 | Microsoft Corporation | Adaptive data collection for root-cause analysis and intrusion detection |
US20080229422A1 (en) * | 2007-03-14 | 2008-09-18 | Microsoft Corporation | Enterprise security assessment sharing |
US20080229419A1 (en) * | 2007-03-16 | 2008-09-18 | Microsoft Corporation | Automated identification of firewall malware scanner deficiencies |
US20080269456A1 (en) * | 2007-03-22 | 2008-10-30 | Joerg Lahann | Multifunctional cvd coatings |
US8399047B2 (en) | 2007-03-22 | 2013-03-19 | The Regents Of The Univeristy Of Michigan | Multifunctional CVD coatings |
US20080244748A1 (en) * | 2007-04-02 | 2008-10-02 | Microsoft Corporation | Detecting compromised computers by correlating reputation data with web access logs |
US20080244694A1 (en) * | 2007-04-02 | 2008-10-02 | Microsoft Corporation | Automated collection of forensic evidence associated with a network security incident |
US8424094B2 (en) | 2007-04-02 | 2013-04-16 | Microsoft Corporation | Automated collection of forensic evidence associated with a network security incident |
US7882542B2 (en) | 2007-04-02 | 2011-02-01 | Microsoft Corporation | Detecting compromised computers by correlating reputation data with web access logs |
US20080244742A1 (en) * | 2007-04-02 | 2008-10-02 | Microsoft Corporation | Detecting adversaries by correlating detected malware with web access logs |
WO2008134057A1 (en) * | 2007-04-30 | 2008-11-06 | Sourcefire, Inc. | Real-time awareness for a computer network |
US8127353B2 (en) | 2007-04-30 | 2012-02-28 | Sourcefire, Inc. | Real-time user awareness for a computer network |
US20080301812A1 (en) * | 2007-05-29 | 2008-12-04 | Alcatel Lucent | Method and system for counting new destination addresses |
US7917957B2 (en) * | 2007-05-29 | 2011-03-29 | Alcatel Lucent | Method and system for counting new destination addresses |
US8474043B2 (en) | 2008-04-17 | 2013-06-25 | Sourcefire, Inc. | Speed and memory optimization of intrusion detection system (IDS) and intrusion prevention system (IPS) rule processing |
US20090293122A1 (en) * | 2008-05-21 | 2009-11-26 | Alcatel-Lucent | Method and system for identifying enterprise network hosts infected with slow and/or distributed scanning malware |
US8341740B2 (en) * | 2008-05-21 | 2012-12-25 | Alcatel Lucent | Method and system for identifying enterprise network hosts infected with slow and/or distributed scanning malware |
US11347847B2 (en) * | 2008-08-04 | 2022-05-31 | Zscaler, Inc. | Cloud-based malware detection |
US20180124070A1 (en) * | 2008-08-04 | 2018-05-03 | Zscaler, Inc. | Cloud-based malware detection |
US11687651B2 (en) | 2008-08-04 | 2023-06-27 | Zscaler, Inc. | Cloud-based malware detection |
US10262136B1 (en) * | 2008-08-04 | 2019-04-16 | Zscaler, Inc. | Cloud-based malware detection |
US9450975B2 (en) | 2008-10-08 | 2016-09-20 | Cisco Technology, Inc. | Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention system |
US9055094B2 (en) | 2008-10-08 | 2015-06-09 | Cisco Technology, Inc. | Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention system |
US8272055B2 (en) | 2008-10-08 | 2012-09-18 | Sourcefire, Inc. | Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention system |
US8484727B2 (en) * | 2008-11-26 | 2013-07-09 | Kaspersky Lab Zao | System and method for computer malware detection |
US20100132038A1 (en) * | 2008-11-26 | 2010-05-27 | Zaitsev Oleg V | System and Method for Computer Malware Detection |
US20110219450A1 (en) * | 2010-03-08 | 2011-09-08 | Raytheon Company | System And Method For Malware Detection |
US9009820B1 (en) * | 2010-03-08 | 2015-04-14 | Raytheon Company | System and method for malware detection using multiple techniques |
US8863279B2 (en) | 2010-03-08 | 2014-10-14 | Raytheon Company | System and method for malware detection |
US8677486B2 (en) | 2010-04-16 | 2014-03-18 | Sourcefire, Inc. | System and method for near-real time network attack detection, and system and method for unified detection via detection routing |
US8433790B2 (en) | 2010-06-11 | 2013-04-30 | Sourcefire, Inc. | System and method for assigning network blocks to sensors |
US9110905B2 (en) | 2010-06-11 | 2015-08-18 | Cisco Technology, Inc. | System and method for assigning network blocks to sensors |
US8671182B2 (en) | 2010-06-22 | 2014-03-11 | Sourcefire, Inc. | System and method for resolving operating system or service identity conflicts |
WO2012054401A1 (en) * | 2010-10-18 | 2012-04-26 | Board Of Regents Of The University Of Texas System | Remediation of computer security vulnerabilities |
US9177154B2 (en) | 2010-10-18 | 2015-11-03 | Todd Wolff | Remediation of computer security vulnerabilities |
US8554907B1 (en) * | 2011-02-15 | 2013-10-08 | Trend Micro, Inc. | Reputation prediction of IP addresses |
US20120233694A1 (en) * | 2011-03-11 | 2012-09-13 | At&T Intellectual Property I, L.P. | Mobile malicious software mitigation |
US8601034B2 (en) | 2011-03-11 | 2013-12-03 | Sourcefire, Inc. | System and method for real time data awareness |
US9584535B2 (en) | 2011-03-11 | 2017-02-28 | Cisco Technology, Inc. | System and method for real time data awareness |
US9135432B2 (en) | 2011-03-11 | 2015-09-15 | Cisco Technology, Inc. | System and method for real time data awareness |
US8695095B2 (en) * | 2011-03-11 | 2014-04-08 | At&T Intellectual Property I, L.P. | Mobile malicious software mitigation |
US20140033310A1 (en) * | 2012-07-30 | 2014-01-30 | Newegg Inc. | System and Method of Active Remediation and Passive Protection Against Cyber Attacks |
US9648029B2 (en) * | 2012-07-30 | 2017-05-09 | Newegg Inc. | System and method of active remediation and passive protection against cyber attacks |
US9369476B2 (en) * | 2012-10-18 | 2016-06-14 | Deutsche Telekom Ag | System for detection of mobile applications network behavior-netwise |
US20140113588A1 (en) * | 2012-10-18 | 2014-04-24 | Deutsche Telekom Ag | System for detection of mobile applications network behavior- netwise |
US20140156720A1 (en) * | 2012-12-03 | 2014-06-05 | Aruba Networks, Inc. | Control plane protection for various tables using storm prevention entries |
US9800503B2 (en) * | 2012-12-03 | 2017-10-24 | Aruba Networks, Inc. | Control plane protection for various tables using storm prevention entries |
US10263916B2 (en) | 2012-12-03 | 2019-04-16 | Hewlett Packard Enterprise Development Lp | System and method for message handling in a network device |
US20140167960A1 (en) * | 2012-12-19 | 2014-06-19 | Wal-Mart Stores, Inc. | Detecting Defective Shopping Carts |
US10673874B2 (en) * | 2012-12-27 | 2020-06-02 | Huawei Technologies Co., Ltd. | Method, apparatus, and device for detecting e-mail attack |
US20190044962A1 (en) * | 2012-12-27 | 2019-02-07 | Huawei Technologies Co., Ltd. | Method, Apparatus, and Device for Detecting E-mail Attack |
US9396170B2 (en) * | 2013-11-11 | 2016-07-19 | Globalfoundries Inc. | Hyperlink data presentation |
US20150135324A1 (en) * | 2013-11-11 | 2015-05-14 | International Business Machines Corporation | Hyperlink data presentation |
US11468167B2 (en) | 2013-11-13 | 2022-10-11 | Proofpoint, Inc. | System and method of protecting client computers |
US10558803B2 (en) | 2013-11-13 | 2020-02-11 | Proofpoint, Inc. | System and method of protecting client computers |
US10572662B2 (en) * | 2013-11-13 | 2020-02-25 | Proofpoint, Inc. | System and method of protecting client computers |
US10659491B2 (en) * | 2014-06-02 | 2020-05-19 | Paypal, Inc. | Dynamic detection of geo-location obfuscation in of internet devices |
US20190075131A1 (en) * | 2014-06-02 | 2019-03-07 | Paypal, Inc. | Dynamic detection of geo-location obfuscation in of internet devices |
US10108516B2 (en) * | 2015-01-29 | 2018-10-23 | Knuedge Incorporated | Affinity data collection in a computing system |
US20170125073A1 (en) * | 2015-01-29 | 2017-05-04 | Knuedge Incorporated | Affinity Data Collection in a Computing System |
US20170085577A1 (en) * | 2015-09-22 | 2017-03-23 | Lorraine Wise | Computer method for maintaining a hack trap |
US11240258B2 (en) * | 2015-11-19 | 2022-02-01 | Alibaba Group Holding Limited | Method and apparatus for identifying network attacks |
US20220116412A1 (en) * | 2015-11-19 | 2022-04-14 | Alibaba Group Holding Limited | Method and apparatus for identifying network attacks |
US10380027B2 (en) | 2016-01-05 | 2019-08-13 | Friday Harbor Llc | Disjointed virtual memory scheme with block bypass |
US10331569B2 (en) | 2016-01-05 | 2019-06-25 | Friday Harbor Llc | Packet router buffer management |
US10360178B2 (en) * | 2016-05-12 | 2019-07-23 | International Business Machines Corporation | Process scheduling based on file system consistency level |
US20190394236A1 (en) * | 2016-12-09 | 2019-12-26 | International Business Machines Corporation | Protecting against notification based phishing attacks |
US10904287B2 (en) * | 2016-12-09 | 2021-01-26 | International Business Machines Corporation | Protecting against notification based phishing attacks |
US20190387012A1 (en) * | 2017-03-03 | 2019-12-19 | Nippon Telegraph And Telephone Corporation | Log analysis apparatus, log analysis method, and log analysis program |
US20230085654A1 (en) * | 2019-05-08 | 2023-03-23 | Capital One Services, Llc | Virtual private cloud flow log event fingerprinting and aggregation |
US11909753B2 (en) * | 2019-05-08 | 2024-02-20 | Capital One Services, Llc | Virtual private cloud flow log event fingerprinting and aggregation |
Also Published As
Publication number | Publication date |
---|---|
US20130333036A1 (en) | 2013-12-12 |
US8931099B2 (en) | 2015-01-06 |
CN100448203C (en) | 2008-12-31 |
CN1885794A (en) | 2006-12-27 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8931099B2 (en) | System, method and program for identifying and preventing malicious intrusions | |
JP6894003B2 (en) | Defense against APT attacks | |
US11068588B2 (en) | Detecting irregularities on a device | |
US6405318B1 (en) | Intrusion detection system | |
US10726125B2 (en) | Malware detection using clustering with malware source information | |
US8127356B2 (en) | System, method and program product for detecting unknown computer attacks | |
JP6104149B2 (en) | Log analysis apparatus, log analysis method, and log analysis program | |
JP4961153B2 (en) | Aggregating knowledge bases from computer systems and proactively protecting computers from malware | |
US20030084319A1 (en) | Node, method and computer readable medium for inserting an intrusion prevention system into a network stack | |
US20030101260A1 (en) | Method, computer program element and system for processing alarms triggered by a monitoring system | |
US20060259967A1 (en) | Proactively protecting computers in a networking environment from malware | |
US20030188190A1 (en) | System and method of intrusion detection employing broad-scope monitoring | |
US20080016208A1 (en) | System, method and program product for visually presenting data describing network intrusions | |
US20110072516A1 (en) | Prevention of distributed denial of service attacks | |
US20200195672A1 (en) | Analyzing user behavior patterns to detect compromised nodes in an enterprise network | |
JP7204247B2 (en) | Threat Response Automation Methods | |
Sequeira | Intrusion prevention systems: security's silver bullet? | |
US20030084344A1 (en) | Method and computer readable medium for suppressing execution of signature file directives during a network exploit | |
Coulibaly | An overview of intrusion detection and prevention systems | |
EP1751651B1 (en) | Method and systems for computer security | |
Ahmed | Intrusion detection system: A survey and taxonomy | |
Palekar et al. | Complete Study Of Intrusion Detection System | |
OLUSEYE-PAUL | IMPLEMENTATION OF AN INTRUSION DETECTION SYSTEM ON MTU NETWORK | |
Alukwe | Enhancing Cybersecurity: Smart Intrusion Detection in File Server SYSTEMS | |
Singh | Intrusion detection system (IDS) and intrusion prevention system (IPS) for network security: a critical analysis |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:LAHANN, JEFFREY S.;THIELE, FREDERIC G.;WALTER, MICHAEL A.;REEL/FRAME:016638/0924;SIGNING DATES FROM 20050724 TO 20050725 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- AFTER EXAMINER'S ANSWER OR BOARD OF APPEALS DECISION |
|
AS | Assignment |
Owner name: KYNDRYL, INC., NEW YORK Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:INTERNATIONAL BUSINESS MACHINES CORPORATION;REEL/FRAME:058213/0912 Effective date: 20211118 |