CN104509034B - 模式合并以识别恶意行为 - Google Patents
模式合并以识别恶意行为 Download PDFInfo
- Publication number
- CN104509034B CN104509034B CN201280074998.9A CN201280074998A CN104509034B CN 104509034 B CN104509034 B CN 104509034B CN 201280074998 A CN201280074998 A CN 201280074998A CN 104509034 B CN104509034 B CN 104509034B
- Authority
- CN
- China
- Prior art keywords
- pattern
- event
- information
- network
- community
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/12—Network monitoring probes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims (13)
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/US2012/049057 WO2014021871A1 (en) | 2012-07-31 | 2012-07-31 | Pattern consolidation to identify malicious activity |
Publications (2)
Publication Number | Publication Date |
---|---|
CN104509034A CN104509034A (zh) | 2015-04-08 |
CN104509034B true CN104509034B (zh) | 2017-12-12 |
Family
ID=50028385
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201280074998.9A Expired - Fee Related CN104509034B (zh) | 2012-07-31 | 2012-07-31 | 模式合并以识别恶意行为 |
Country Status (4)
Country | Link |
---|---|
US (1) | US20150215329A1 (zh) |
EP (1) | EP2880820A4 (zh) |
CN (1) | CN104509034B (zh) |
WO (1) | WO2014021871A1 (zh) |
Families Citing this family (49)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9578060B1 (en) | 2012-06-11 | 2017-02-21 | Dell Software Inc. | System and method for data loss prevention across heterogeneous communications platforms |
US9779260B1 (en) | 2012-06-11 | 2017-10-03 | Dell Software Inc. | Aggregation and classification of secure data |
US9565213B2 (en) | 2012-10-22 | 2017-02-07 | Centripetal Networks, Inc. | Methods and systems for protecting a secured network |
US20150373040A1 (en) * | 2013-01-31 | 2015-12-24 | Hewlett-Packard Development Company, L.P. | Sharing information |
EP2951753A4 (en) * | 2013-01-31 | 2016-09-21 | Hewlett Packard Entpr Dev Lp | TARGETED SECURITY ALERTS |
US9210183B2 (en) * | 2013-12-19 | 2015-12-08 | Microsoft Technology Licensing, Llc | Detecting anomalous activity from accounts of an online service |
KR102000133B1 (ko) * | 2014-02-03 | 2019-07-16 | 한국전자통신연구원 | 수집된 이벤트 정보 기반 악성코드 탐지 장치 및 방법 |
US20170155683A1 (en) * | 2014-07-21 | 2017-06-01 | Hewlett Packard Enterprise Development Lp | Remedial action for release of threat data |
WO2016036321A1 (en) * | 2014-09-05 | 2016-03-10 | Agency For Science, Technology And Research | Methods for generating a vulnerability pattern, methods for determining a security threat, vulnerability pattern generators, and vulnerability pattern scanners |
US10326748B1 (en) | 2015-02-25 | 2019-06-18 | Quest Software Inc. | Systems and methods for event-based authentication |
US10417613B1 (en) | 2015-03-17 | 2019-09-17 | Quest Software Inc. | Systems and methods of patternizing logged user-initiated events for scheduling functions |
US9990506B1 (en) | 2015-03-30 | 2018-06-05 | Quest Software Inc. | Systems and methods of securing network-accessible peripheral devices |
US9563782B1 (en) | 2015-04-10 | 2017-02-07 | Dell Software Inc. | Systems and methods of secure self-service access to content |
US9641555B1 (en) | 2015-04-10 | 2017-05-02 | Dell Software Inc. | Systems and methods of tracking content-exposure events |
US9842220B1 (en) | 2015-04-10 | 2017-12-12 | Dell Software Inc. | Systems and methods of secure self-service access to content |
US9569626B1 (en) | 2015-04-10 | 2017-02-14 | Dell Software Inc. | Systems and methods of reporting content-exposure events |
US9842218B1 (en) | 2015-04-10 | 2017-12-12 | Dell Software Inc. | Systems and methods of secure self-service access to content |
US10153992B2 (en) * | 2015-04-28 | 2018-12-11 | Unisys Corporation | Identification of progress towards complete message system integration using automation degree of implementation metrics |
US9686220B2 (en) * | 2015-04-28 | 2017-06-20 | Unisys Corporation | Debug and verify execution modes for computing systems calculating automation degree of implementation metrics |
US9667573B2 (en) * | 2015-04-28 | 2017-05-30 | Unisys Corporation | Identification of automation candidates using automation degree of implementation metrics |
US10536352B1 (en) | 2015-08-05 | 2020-01-14 | Quest Software Inc. | Systems and methods for tuning cross-platform data collection |
US10218588B1 (en) | 2015-10-05 | 2019-02-26 | Quest Software Inc. | Systems and methods for multi-stream performance patternization and optimization of virtual meetings |
US10157358B1 (en) | 2015-10-05 | 2018-12-18 | Quest Software Inc. | Systems and methods for multi-stream performance patternization and interval-based prediction |
US20170126704A1 (en) * | 2015-10-28 | 2017-05-04 | Qualcomm Incorporated | Method And Devices For Non-Intrusive Malware Detection For The Internet Of Things (IOT) |
US10192058B1 (en) * | 2016-01-22 | 2019-01-29 | Symantec Corporation | System and method for determining an aggregate threat score |
US10142391B1 (en) | 2016-03-25 | 2018-11-27 | Quest Software Inc. | Systems and methods of diagnosing down-layer performance problems via multi-stream performance patternization |
US10536476B2 (en) * | 2016-07-21 | 2020-01-14 | Sap Se | Realtime triggering framework |
US10482241B2 (en) | 2016-08-24 | 2019-11-19 | Sap Se | Visualization of data distributed in multiple dimensions |
US10542016B2 (en) | 2016-08-31 | 2020-01-21 | Sap Se | Location enrichment in enterprise threat detection |
US10601845B2 (en) * | 2016-09-06 | 2020-03-24 | Radware, Ltd. | System and method for predictive attack sequence detection |
CN109792439B (zh) | 2016-09-16 | 2021-08-27 | 甲骨文国际公司 | 用于威胁检测的动态策略注入和访问可视化 |
US10630705B2 (en) | 2016-09-23 | 2020-04-21 | Sap Se | Real-time push API for log events in enterprise threat detection |
US10673879B2 (en) * | 2016-09-23 | 2020-06-02 | Sap Se | Snapshot of a forensic investigation for enterprise threat detection |
CN106411937B (zh) * | 2016-11-15 | 2017-12-29 | 中国人民解放军信息工程大学 | 基于拟态防御架构的零日攻击检测、分析和响应***及其方法 |
US10534908B2 (en) | 2016-12-06 | 2020-01-14 | Sap Se | Alerts based on entities in security information and event management products |
US10534907B2 (en) | 2016-12-15 | 2020-01-14 | Sap Se | Providing semantic connectivity between a java application server and enterprise threat detection system using a J2EE data |
US10530792B2 (en) | 2016-12-15 | 2020-01-07 | Sap Se | Using frequency analysis in enterprise threat detection to detect intrusions in a computer system |
US11470094B2 (en) | 2016-12-16 | 2022-10-11 | Sap Se | Bi-directional content replication logic for enterprise threat detection |
US10552605B2 (en) | 2016-12-16 | 2020-02-04 | Sap Se | Anomaly detection in enterprise threat detection |
US10764306B2 (en) | 2016-12-19 | 2020-09-01 | Sap Se | Distributing cloud-computing platform content to enterprise threat detection systems |
CN108416211B (zh) * | 2017-01-06 | 2021-08-31 | 安天科技集团股份有限公司 | 一种基于向量标签的场景化检测方法及*** |
US10721239B2 (en) | 2017-03-31 | 2020-07-21 | Oracle International Corporation | Mechanisms for anomaly detection and access management |
US10878102B2 (en) | 2017-05-16 | 2020-12-29 | Micro Focus Llc | Risk scores for entities |
US10530794B2 (en) | 2017-06-30 | 2020-01-07 | Sap Se | Pattern creation in enterprise threat detection |
US10592666B2 (en) | 2017-08-31 | 2020-03-17 | Micro Focus Llc | Detecting anomalous entities |
CN107729096A (zh) * | 2017-09-20 | 2018-02-23 | 中国银行股份有限公司 | 信息分流方法及*** |
US10681064B2 (en) | 2017-12-19 | 2020-06-09 | Sap Se | Analysis of complex relationships among information technology security-relevant entities using a network graph |
US10986111B2 (en) | 2017-12-19 | 2021-04-20 | Sap Se | Displaying a series of events along a time axis in enterprise threat detection |
US11017085B2 (en) * | 2018-07-06 | 2021-05-25 | Percepio AB | Methods and nodes for anomaly detection in computer applications |
Family Cites Families (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6208720B1 (en) * | 1998-04-23 | 2001-03-27 | Mci Communications Corporation | System, method and computer program product for a dynamic rules-based threshold engine |
US7168093B2 (en) * | 2001-01-25 | 2007-01-23 | Solutionary, Inc. | Method and apparatus for verifying the integrity and security of computer networks and implementation of counter measures |
KR100623552B1 (ko) * | 2003-12-29 | 2006-09-18 | 한국정보보호진흥원 | 자동침입대응시스템에서의 위험수준 분석 방법 |
US20110246483A1 (en) * | 2006-03-21 | 2011-10-06 | 21St Century Technologies, Inc. | Pattern Detection and Recommendation |
US7934253B2 (en) * | 2006-07-20 | 2011-04-26 | Trustwave Holdings, Inc. | System and method of securing web applications across an enterprise |
US7551073B2 (en) * | 2007-01-10 | 2009-06-23 | International Business Machines Corporation | Method, system and program product for alerting an information technology support organization of a security event |
US20090307772A1 (en) * | 2008-05-21 | 2009-12-10 | Honeywell International Inc. | framework for scalable state estimation using multi network observations |
US20100262688A1 (en) * | 2009-01-21 | 2010-10-14 | Daniar Hussain | Systems, methods, and devices for detecting security vulnerabilities in ip networks |
US8516576B2 (en) * | 2010-01-13 | 2013-08-20 | Microsoft Corporation | Network intrusion detection with distributed correlation |
-
2012
- 2012-07-31 WO PCT/US2012/049057 patent/WO2014021871A1/en active Application Filing
- 2012-07-31 EP EP12882513.0A patent/EP2880820A4/en not_active Withdrawn
- 2012-07-31 CN CN201280074998.9A patent/CN104509034B/zh not_active Expired - Fee Related
- 2012-07-31 US US14/418,910 patent/US20150215329A1/en not_active Abandoned
Also Published As
Publication number | Publication date |
---|---|
EP2880820A4 (en) | 2016-03-23 |
CN104509034A (zh) | 2015-04-08 |
EP2880820A1 (en) | 2015-06-10 |
WO2014021871A1 (en) | 2014-02-06 |
US20150215329A1 (en) | 2015-07-30 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN104509034B (zh) | 模式合并以识别恶意行为 | |
US12047396B2 (en) | System and method for monitoring security attack chains | |
EP3528462B1 (en) | A method for sharing cybersecurity threat analysis and defensive measures amongst a community | |
CN107454109B (zh) | 一种基于http流量分析的网络窃密行为检测方法 | |
CN110620759B (zh) | 基于多维关联的网络安全事件危害指数评估方法及其*** | |
CN106790008B (zh) | 用于在企业网络中检测异常主机的机器学习*** | |
WO2021171090A1 (en) | An artificial intelligence adversary red team | |
CN101803337B (zh) | 入侵检测方法和*** | |
US20230012220A1 (en) | Method for determining likely malicious behavior based on abnormal behavior pattern comparison | |
CN108259462A (zh) | 基于海量网络监测数据的大数据安全分析*** | |
CN106650436A (zh) | 一种基于局域网的安全检测方法和装置 | |
CN109074454A (zh) | 基于赝象对恶意软件自动分组 | |
US9961047B2 (en) | Network security management | |
CN113709170A (zh) | 资产安全运营***、方法和装置 | |
Ehis | Optimization of security information and event management (SIEM) infrastructures, and events correlation/regression analysis for optimal cyber security posture | |
Li et al. | A hierarchical mobile‐agent‐based security operation center | |
Bsufka et al. | Intelligent network-based early warning systems | |
KR102295947B1 (ko) | 사이버 보안관제의 실시간 모니터링 시스템 및 방법 | |
Walker et al. | Cyber security concerns for ubiquitous/pervasive computing environments | |
Vigenesh et al. | An Intense Systematic Review of Mobile Agent Based Harmful Threats And Attack Detection Systems in IOT Networks | |
Frye et al. | Tridso: Traffic-based reasoning intrusion detection system using ontology | |
CN117792733A (zh) | 一种网络威胁的检测方法及相关装置 | |
Tiejun et al. | Novel intelligent NIPS model based on Multiple Mobile Agents and data mining | |
CN109962905A (zh) | 保护当前***免受网络攻击的方法 | |
Xuetao et al. | A Typical Set Method of Intrusion Detection Technology Base on Computer Audit Data |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
C41 | Transfer of patent application or patent right or utility model | ||
TA01 | Transfer of patent application right |
Effective date of registration: 20160920 Address after: American Texas Applicant after: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP Address before: American Texas Applicant before: Hewlett-Packard Development Company, Limited Liability Partnership |
|
GR01 | Patent grant | ||
GR01 | Patent grant | ||
TR01 | Transfer of patent right | ||
TR01 | Transfer of patent right |
Effective date of registration: 20180608 Address after: American California Patentee after: Antite Software Co., Ltd. Address before: American Texas Patentee before: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP |
|
CF01 | Termination of patent right due to non-payment of annual fee | ||
CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20171212 Termination date: 20200731 |