CN100443910C - 主动网络防护系统与方法 - Google Patents

主动网络防护系统与方法 Download PDF

Info

Publication number
CN100443910C
CN100443910C CNB2003801047096A CN200380104709A CN100443910C CN 100443910 C CN100443910 C CN 100443910C CN B2003801047096 A CNB2003801047096 A CN B2003801047096A CN 200380104709 A CN200380104709 A CN 200380104709A CN 100443910 C CN100443910 C CN 100443910C
Authority
CN
China
Prior art keywords
bag
data stream
threat
suspicious
network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CNB2003801047096A
Other languages
English (en)
Other versions
CN1720459A (zh
Inventor
克雷格·坎特雷尔
马克·威尔比克-勒迈尔
丹尼斯·考克斯
约翰·麦克黑尔
布赖恩·史密斯
多诺万·科尔比莱
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hewlett Packard Development Co LP
Original Assignee
TippingPoint Technologies Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by TippingPoint Technologies Inc filed Critical TippingPoint Technologies Inc
Publication of CN1720459A publication Critical patent/CN1720459A/zh
Application granted granted Critical
Publication of CN100443910C publication Critical patent/CN100443910C/zh
Anticipated expiration legal-status Critical
Expired - Fee Related legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/22—Arrangements for preventing the taking of data from a data transmission channel without authorisation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00—Digital computers in general; Data processing equipment in general
    • G06F15/16—Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
    • G06F15/163—Interprocessor communication
    • G06F15/173—Interprocessor communication using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0254—Stateful filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/54—Store-and-forward switching systems 
    • H04L12/56—Packet switching systems
    • H04L12/5601—Transfer mode dependent, e.g. ATM
    • H04L2012/5603—Access techniques
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/028—Capturing of monitoring data by filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H04L43/0888—Throughput
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Abstract

提供了一种主动网络防护系统，其用于以自动的方式监视和阻止业务流。该主动网络防护系统与该包业务数据流在线布置，并作为网络基础结构中的一部分。通过该配置可以实现对每一个经过的包的检查和控制。一算法过滤操作对该数据流应用统计阈值过滤，以识别经过多个会话存在的威胁。一触发过滤操作对该数据流应用头和内容匹配过滤，以识别各个会话中存在的威胁。存在威胁的包业务流被阻止并且存在威胁的会话被终止。从该数据流中提取可疑业务流以进行进一步的检查，该检查包括更全面的内容匹配和资源危险分析。提供一流控制机制，以用于控制经过该数据流的包的流速。

Description

主动网络防护系统与方法
交叉参考
本申请涉及2002年4月30日提交的审查中的美国申请号10/136,889，题目为网络安全系统集成，其公开内容在此处被引用作为参考。
本申请涉及2002年8月12日提交的审查中的美国专利申请号10/217,862，题目为使用动态选择过滤标准的多层包屏蔽，其公开内容在此处被引用作为参考。
技术领域
本发明涉及网络入侵的检测与抑制。
背景技术
随着企业越来越多地使用互联网来管理业务，通过互联网传送和访问机密的且敏感的信息的数量也逐渐增加。与私人专用的通信网络不同，由于连接到企业的互联网和网络具有开放性且易于访问，使其容易受到安全威胁和恶意窃听，而该私人专用的通信网络已被企业使用了几十年，并且对于外部入侵相对安全。近年来，试探网络安全漏洞或黑客攻击的频率增加，其目的是访问机密信息或者干扰网络通信。
网络攻击变得不仅更普遍而且更加复杂和严重，其部分地是由于关于如何进行该攻击的工具和信息的可用性，包括黑客技术的发展、易受攻击的网络访问点数目的增加以及通过互联网访问和传送的机密信息总量的增加。这些攻击包括分布式拒绝服务攻击，其中黑客用大量的包或连接请求冲击网站，从而淹没该网站并阻止合法用户的接入。其他类型的攻击不仅被设计用来阻止接入到网站，而且穿透其安全措施并允许黑客控制服务器、破坏该网站或者窃取敏感信息。另一种攻击包括恶意窃听，其允许黑客盗用通过互联网传送的机密通信。如果机密通信落入坏人手中，就会引起对该企业的业务的破坏，或者至少破坏其声誉。从拒绝服务攻击还会导致大量费用和负面宣传。在一种抵御所有这些类型的攻击的尝试中，企业已经增加了它们的安全预算来解决有关提升的网络易受攻击性。
入侵检测系统通常被用来作为一种网络防护的方法。这种系统通常是无源系统，其用于监视业务流，识别出业务流中的可疑部分，并且当检测出该业务流时发出警告或报警。无论该入侵检测系统多么智能或准确，其通常不会采取任何有效的措施以作为对可疑攻击的响应。可以在每一次出现可疑活动的情况时产生警告，但是这对网络安全管理员来说并没有多大用处。其原因是，在许多情况下，当警告产生并被识别时，已经太迟而无法提供任何有意义的响应。破坏已经产生了。简单的说，知道安全漏洞或潜在的漏洞并不等同于阻止该漏洞引起的破坏的发生。
从背景技术中可以知道，入侵检测系统在提供某些有益的服务的同时，并不是能够足以抵制网络攻击的防护机制。设计者进一步意识到对可疑入侵提供自动响应的方法的必要性。该响应机制用来扩展入侵检测系统的功能，使其从传统的无源检测模式转变为先进的攻击抑制模式。例如，有两种已知的由入侵检测系统执行的主动(active)响应机制：(a)会话中断(向TCP会话端点发送TCP重置请求)；以及(b)防火墙升级(向防火墙或路由器发送策略配置请求)。然而，这些主动机制通常是没有效果的，并且很容易被任何具有TCP/IP工作原理的基本知识的黑客所避开。事实上，通过对在攻击中地址被淹没的无辜服务器启动拒绝服务响应攻击，或者通过错误的拒绝合法机器的接入，而使该响应机制可能与受害网络为敌。
关于提供该网络保护的前述背景技术的当前状态，使用一基于软件的入侵检测系统，该系统在一通用处理器上执行。该执行的困难是，软件在执行时不能足够快地进行充分保护网络所需的包的检查、比较与分析。此外，由于该基于软件的解决方案太慢，其不能以一种能够有效阻止危险业务流进入受保护网络的方式执行。
从而可以知道，传统入侵检测系统即使配备了响应机制，也会由于其无源监听的结构而无法提供充分的网络防护策略。还可以知道，增强的、主动响应的入侵检测系统并未提供一种具有足够的主动防护能力的方法。从而需要一种具有改进性能的主动网络防护系统和方法，以保护网络抵制更复杂的而且更危险的网络攻击。
发明内容
基于本发明的一个实施例，一种网络防护系统包括一状态管理器功能组件，其与包的数据流在线(in-line)连接。该状态管理器功能组件用于跟踪该数据流上当前存在的会话，并保存历史包的相关数据。该系统还包括一算法过滤器，其用于对该跟踪的会话和历史包的相关数据执行统计分析，以确定是否经过多个会话的该数据流中的包对受保护网络造成威胁。
该系统还包括一包处理器，其也与该包的数据流在线连接。该包处理器用于阻止危险的包，以此作为对出现威胁的响应。
该系统还包括一触发过滤器，也与该包的数据流在线连接。该触发过滤器用于根据为检测各个会话中的危险包而设计的标准，过滤出该数据流中的包。该触发过滤器还用于根据为检测经过多个会话的危险包而设计的标准，响应于该算法过滤器的可疑确认，过滤出该数据流中的可疑包。
该系统还包括一流(flow)控制器，其也与包的数据流在线连接。该流控制器用于管制沿着该数据流的包的通过率。
在事件包被识别为可疑的情况下，该系统还包括一威胁校验器。从该数据流中提取可疑包，然后该威胁校验器使用比在线触发过滤器所使用的更全面的过滤标准来进行过滤。该更全面的分析被设计用于确定该可疑的提取包是否真正危险。
可疑包也可由一危险评估器分析。该危险评估器用于检查可疑的提取包，并且确定是否可疑的提取包对网络中出现的可识别资源造成某种危险。
由于该发明能够以线速执行对可疑/危险内容的深度包检查，所以其能够比在先技术基于软件的入侵检测系统有利地提供显著的改善。快速路径模式匹配的性能是在提供网络保护防止攻击的同时加速包处理的关键。为了支持模式匹配的必要速率，并且达到深度包检查，优选的使用多个并行模式匹配操作执行该模式匹配操作。通过以该方式执行，该系统变得容易升级以适应未来需求。
此外，可以知道一些包需要更仔细的检查。因此，本发明有利地执行一初始筛选以识别出哪些包需要进一步的分析。从该数据流中提取出这些包，然后在单独的处理流中进行更仔细的筛选。
在本发明的一优选实施例中，该系统有利地使用一混合了硬件/软件的方案，以在维持包的吞吐率的同时提供合适的包筛选水平。优选的，在线组件在硬件中执行。例如，使用硬件设计执行模式匹配操作，这些操作比在先技术基于软件的入侵检测方案法快的多。控制和结构可在软件中处理，以提供给系统灵活性水平。此外，优选的，对于从该数据流中提取的包的线外处理在软件中执行，以允许该系统对这些包造成的任何威胁进行更仔细的检查。该结构还允许该系统随着数据速率的增加而升级。
附图说明
当结合附图一起参考下面的详细说明时，可获得对本发明的方法和装置的更完整的理解。其中：
图1是基于本发明的主动网络防护系统的框图。
图2是图1所示系统的更详细的框图。
具体实施方式
本发明提供一主动网络防护系统，其用于以自动的方式监视和阻止业务流。优选的将该主动网络防护系统在线布置(即在包业务数据流中)，并作为网络基础结构的一部分，以检查和尽可能控制每一个通过的包。该网络防护解决方案构成了一个从基于前述背景技术的无源入侵检测系统的显著的技术转移。
重要的是，该主动网络防护系统必须能够可靠的以线速执行。当它检测出恶意包时，立即采取措施丢弃该包并由此阻止其进入可能会受到破坏的网络。从而，通过丢弃该包，可立即阻止该攻击，并且具有额外的好处，即没有需要修复的破坏也没有需要处理的报警。
该主动网络防护系统还提供一些其他的好处。除了阻止包外，该主动网络防护系统还具有修改包的能力。标准化的概念是具有一定重要性的一个包修改的概念。标准化是强制遵守一协议或标准的特定实现的过程。例如，常用的入侵检测系统规避技术采用许多种方式的变化，以使目标系统能够处理分段。一些系统重组具有第一个重叠包的数据的重叠分段，另一些系统则重组最后一个包的数据。入侵检测系统需要猜测该目标怎样重组或者考虑所有的选项。如果未能预测出目标怎样运行，则或者检测不到攻击或者产生错误的报警。与此相对照，通过在线设置并且侦听所有的包，本发明的主动网络防护系统能够通过使用一组算法重组分段以及传送被重组的包而实现标准化。将流标准化消除了猜测包或流在不同的目标系统如何被处理的必要，而且越过了常用的检测规避技术。
该主动网络防护系统还具有有效管理包流量(吞吐量)的能力。调节流速的概念允许主动网络防护系统使已知的“好的”业务流优先或减缓可疑业务流的通过。从上下文中可知，许多拒绝服务的攻击产生与合法业务流没有明显区别的业务流。通过对被检测出的具有某些属性的业务流的调速，至少能够阻碍(并可能进一步停止)拒绝服务的攻击淹没目标源。作为附加的好处，当调速控制可用时，通过为重要业务流设置更高的通过主动网络防护系统的优先级，而使该重要业务流的吞吐量增加，从而提高网络生产率。
为使该主动网络防护系统能够成功应用，其应该能够以线速和较低的等待时间来执行对包业务流的状态监视。例如，WAN/LAN接入速度在几个G比特的范围，从而主动网络防护系统应该具有G比特速率，并且具有交换机和路由器的典型的毫秒级等待时间的硬件能力。此时的目标是具有深度模式匹配的性能。该主动网络防护系统应该具有避免丢弃有用业务流的可靠方法。同样，由于主动网络防护系统被应用为网络基础结构的一部分，其应该具有高可靠性的传送能力。
参考背景技术，现在给出基于本发明的主动网络防护系统和方法的更详细的解释。
现在参考图1和图2，其中示出了基于本发明的主动网络防护系统10的框图。系统10被配置为企业的网络基础结构12的一部分。该配置有利地允许系统10与被监视的该数据流14在线设置。该在线设置有利于检查并尽可能控制数据流14中的每一个包16。同样的，有必要使该系统以接近(如果不优选为超出的话)数据流14的线速的速率运行。通过在线处理，该系统对每一个经过的包执行深度包检查。
系统10提供大量的在线功能组件。这些功能组件中的第一个包括一状态管理器功能20组件。该状态管理器20执行两个主要的、与数据流14的主动监视相关的操作。首先，状态管理器20执行会话管理操作22。该会话管理操作22监视和管理与数据流14承载的包业务流相关的每一会话的状态。特别的，该会话管理操作22可能利用表或其他机制跟踪数据流14上当前存在的会话，并保存历史包的相关数据以用于检测。例如，连接表可以被用来维持关于每一连接(例如，TCP SYN，SYN ACK等)的状态的数据。可能被保留的历史包的相关数据类型实例包括：
分段的包的重组；
TCP会话流的重组；
协商的临时端口的维持(例如，FTP建立一个动态端口以交换数据)；
连接建立状态(在通信的主机间正确的交换，例如，在TCP建立连接中的明确定义的交换)；以及
协议和应用层状态信息(确保应用或协议转移到明确定义的状态，而不违背这些应用或协议的定义或者使用这些应用或协议中的已知的弱点)。
会话管理操作22在线检查数据流14中的每一个包16，以确保各个包都与一个已识别的会话关联。如果包16被检查出与会话不关联，该异常包16可能被视为可疑的或者危险的，并被系统10阻止。此外，包与会话间的关系的记录被保留，以便当发现危险的或可疑的包时，系统10能够选择相似的处理(通过丢弃或进一步检查)包含被检测到的包的会话中的所有包。此概念被称为“会话重定向”。
其次，状态管理器20执行包和流的重组的操作24。与此操作相联系，可以知道对该网络的攻击可在多个包上被分割。这样，攻击者就会用多个包隐藏其攻击，其中每一个包看起来都是没有危险的。为了提防这种攻击，包和流的重组的操作24对于已建立起连接的数据流14进行监视，并随着时间的流逝检查多个包及其内容(利用上述参照的历史数据)，以便考察和检测攻击的存在。这样，包流和重组的操作跟踪包和其有效载荷，识别包之间的关系，并将包的有效载荷重组在一起，以分析重组的包数据是否具有潜在的危胁。如果检查了一组普通流的包16，并且当该重组的包被确定为造成了威胁时，则这些包(以及同一个流或会话中的相关的包)可能被系统10阻止，而且/或者与这些危险的包相关联的流/会话可能被系统10终止。从而，该功能组件允许穿过包边界的模式匹配的跟踪。
标准化处理可能包括多种不同的包处理程序，其被设计用来增强与特定标准的一致性。由于状态管理器“接触”每一个沿数据流传递的包，所以在本发明中可以实现该标准化过程。例如，标准化允许系统定义某一关于被保护网络的重组策略。通过识别分段包的威胁，该策略可规定任何到达时次序颠倒的包都要被无条件的阻止，从而在受保护网络接收包之前迫使发送方以正确的顺序重发。标准化也允许系统10执行关于IP选项的特定的解释规则。此外，标准化也要求所有的编码(例如十六进制或统一码)包在传送到受保护网络之前先被解码。从而这些操作加强了与特定规则或标准化约束的结合，并更好的保护网络不受攻击。
优选的，状态管理器被实施为定制了硬件模块的应用，以便确保其能以最大可能的速度(优选的，超过数据流的线速)执行必要任务的能力。
为了协助状态管理器20的操作，状态管理器20搜集涉及了通过的包业务流的性质的数据。例如，该数据可在上面参考的连接表中编辑或搜集。该数据包括在各个会话中的包业务流的信息以及多个不同会话中的包业务流的信息。
在状态管理器和算法过滤操作之间的数据关系可能有两项应用。在第一应用中，状态管理器仅搜集数据并报告给算法过滤操作。在第二应用中，状态管理器搜集和总结数据，然后将该总结报告给算法过滤操作。第二应用是优选的，因为其使过滤器在执行过滤操作之前不必进行总结，从而达到了加快处理速度的目的。然而，该第二应用需要更为复杂的硬件状态管理器应用，其增加了设计成本。
收集的数据被报告26给算法过滤操作28。该算法过滤操作28对报告的数据执行统计分析，以确定该数据是否指示着潜在的问题(即，它是可疑的)或威胁。由算法过滤操作28执行的统计分析被设计用来捕捉地址搜索攻击、端口扫描攻击和拒绝服务攻击的情况，这些情况由涉及了穿过多个不同会话的数据流的包业务流性质的数据所揭示。为了达到该目标，设计和制造了一组算法过滤器30以用于识别、检测和抑制在多个会话中发生的识别出的网络威胁。然后为这些算法过滤器30提供一组检测引擎32，每一引擎被实现用于多个识别出的会话攻击情形(例如，地址搜索、端口扫描和拒绝服务)之一。每个检测引擎32也接收由数据管理器20搜集的关于各个会话中的包业务流和经过多个不同会话的包业务流的信息的报告26的数据(或其子集)。通过基于算法过滤器30的统计方式评测报告26的数据，每个检测引擎32可以得出是否网络正受到多会话攻击的结论。然后，算法过滤操作28中的管理功能34根据检测引擎32的结论向状态管理器20提供正确的反馈36。在检测出存在来自于数据流的多个会话包业务流的威胁的情况下，系统10可能阻止危险的包并且/或者系统10可能终止与这些包关联的会话。
优选的，算法过滤操作被应用为一可定制的软件应用(其与硬件状态管理器相接)以便确保其对于安全危险的持续的适应性和被设计或被调整的能力。这样，威胁检测能力也可随需要被调整。此外，通过限制由算法过滤操作执行的功能，并将尽可能多的功能(除威胁检测操作外)推向状态管理器，在该状态管理器中这些功能能够在硬件中被有效而快速的执行，从而能够保持高的总的包处理速度，并允许以线速执行操作。
系统10提供的第二在线功能组件包括一触发过滤器功能组件50，其应用为有利于深度包检查的状态模式匹配的形式。触发过滤器50执行两种关于数据流14的主动监视的过滤操作。首先，包头匹配操作52查看每个包，并确定是否其包头字段值会引起对危险业务流的怀疑。该操作包括检查固定头字段(例如，目的和源IP地址、目的和源端口等)是否存在表示攻击的信息。例如，可以基于头信息对包进行分类。然后，该分类只被过滤器所使用，或者当如下文所述执行其他过滤操作时，该分类被用来提供参考。其次，包内容匹配操作54查看每个包，并确定是否其内容(字符)串和/或正则表达式值引起对危险业务流的怀疑。该操作包括将包的有效载荷单元与被识别出与攻击关联的字符串和表达相匹配。可以知道，基于被检测的头字段值和内容串/正则表达式值的组合，包头匹配操作52和包内容匹配操作54可以有利地相互结合操作，以检测可疑包业务流。在检测出威胁的情况下，系统10可能阻止危险的包并且/或者系统10可能终止与这些包关联的会话。
尽管上述说明集中于用于寻找危险的或可疑业务流的触发操作(然后阻止该业务流)，在某些情况下，也可以将触发器应用为，或者将过滤器设计为用于寻找“好的”业务流的品质和特性。这种情况下，系统10将阻止所有没有被识别为符合“好的”标准的包，而识别出的好的包则被允许通过。
优选的，触发器过滤功能组件被应用为定制硬件模块的应用，以便确保其以最大可能速度(优选的，超过数据流的线速)执行必要任务的能力。特别的，通过使用并行处理结构中的多个、硬件执行的模式匹配组件，来执行快速路径模式匹配的处理。该配置允许系统以线速操作，并且还可提供未来的升级。
为了协助触发过滤器功能组件50的操作，向包头部匹配操作52和包内容匹配操作54提供过滤标准(或规则)54。这些规则54包括检测触发器56和检测异常58。检测触发器56识别单一的或互相联合的一个或多个头字段值、内容字符串和/或正则表达式值，其在单一会话中的包的有效载荷单元内匹配的存在表示着对网络的威胁。检测异常58是单一的或互相联合的一个或多个头字段值、内容字符串和/或正则表达式值的识别，尽管其在单一会话中的包的有效载荷单元内的存在可能是关心的内容，也不能将其视为表示对网络的威胁。转换功能组件60用来将检测触发器56和检测异常58转换为过滤标准(或规则)54，将其提供给并应用于触发过滤功能组件50的包头匹配操作52和包内容匹配操作54。该转换可能，例如包括数据向较低层机器码的转换，其由包头匹配操作52和包内容匹配操作54所执行。
检测触发器56和检测异常58来源于一组检测签名62，其被专门设计或制作以用于识别、检测和抑制已识别的单一会话类型的网络威胁。例如，检测签名62(包括，例如安全规则、策略和算法)可能被设计用来从检测出的脆弱环节减轻或转移网络破坏。这些检测签名62可能从许多众所周知的资源得到，包括，例如机器(主机)制造商、服务供应商、互联网等。此外，签名62可以由受保护网络的管理员创建。而且，签名62可由提供签名创建业务的实体提供，其中该实体用于从周围环境中搜集威胁信息(例如，蠕虫、病毒、特洛伊、拒绝服务、存取、故障、侦察，其他可疑业务流等)、分析该信息并设计检测签名62，该检测签名62能被其他实体用于从搜集到的威胁中减轻或转移网络破坏。
通常，该检测签名62包括一定义了标准(例如，TCP、HTTP和URI相关的标准)的客体，一项或多项提取的包特征必须满足该标准，以便检测由该检查的业务流引起的对网络的潜在威胁。作为实例，每一个检测签名可能包括下面客体：
元数据：描述签名的名字、身份、分类和级别；
行动设置：如果检测到威胁时，系统10执行的一个或多个行动(允许、拒绝、登陆、阻止、终止等)的定义；
询问：签名所应用于的并且受到威胁的特定网络组件(机器设置)的定义(或身份)；
签名定义：一组必须被匹配的标准，并连同其他必须被考虑的关联参数一起用于识别威胁。
优选的，上述关于过滤器标准管理的操作被应用为一定制的软件应用(其与硬件触发过滤功能组件相接)以便确保其对于安全危险的持续的适应性和被设计或被调整的能力。这样，系统的威胁检测能力可被随需要调整。
优选的，由触发过滤器功能组件50执行的过滤比较操作被应用到包层和/或会话层中的一层或两层。在包层，当应用检测签名的规则时，检查和过滤操作单独针对每一个包。在会话层，当应用检测签名的规则时，检查和过滤操作一起针对多个相关包。为了协助会话层的比较，系统10可能依据关于存储的历史包的相关数据的状态信息。对于会话层的比较，该比较和过滤不仅针对所提取的当前检查包的包特征(头和有效载荷)，而且包括历史包的相关数据。如果在签名62的标准和提取的包特征与历史包的相关数据的结合体之间存在匹配，则就检测出了对网络14的潜在威胁。
系统10提供的第三在线功能组件包括包处理器功能组件70。作为对由状态管理器功能组件20和触发过滤器功能组件50得出的评估和结论的响应，包处理器功能组件70作为一守门器(gatekeeper)操作并确定怎样处理包和/或会话。特别的，包处理器功能组件编辑状态管理器20和触发过滤器功能组件50的分析和检查结果，以确定某一包是否是感兴趣的，然后对该包执行正确的操作。有三种可用的处理选择以用于确定包是否是感兴趣的。第一，在状态管理器功能组件20以及触发过滤器功能组件50都未检测出任何关于某一包或会话的威胁、危险或可疑处的情况下，允许该包业务流通过72并且继续沿数据流14传送。第二，在状态管理器功能组件20或者触发过滤器功能组件50检测出关于某包或会话的明显的威胁或危险的情况下，在数据流14中阻止并抛弃74该包业务流。第三，在状态管理器功能组件20或者触发过滤器功能组件50检测出关于某包或会话的威胁或危险的可疑处的情况下，从数据流14中提取出76该包业务流以进行下一步的更仔细的检查，该检查会在下文中具体讨论。
优选的，该包处理器功能组件在硬件上应用，以便保持其快速做出关于数据流中通过的包的分类决定的能力。
系统10提供的第四在线功能组件包括流控制功能组件80。流控制功能组件80基于某些可编程的或可配置的优先权而进行操作，以定制沿数据路径14输出的业务流。业务流定制(shaping)主要通过调高(或者，相反地，调低)速率而实现，其中允许某包业务流以该速率沿数据路径14传递。例如，已知的并证实的良性业务流，其在数据路径14上的传送可能被优先。类似的，关于已知的重要业务应用的包业务流相比比其他次要业务流可能被给予优先权。通常，某种类型的业务流可能被调速，以使其不会超出某一阈值。这用于阻止下游资源的超运作或者妨碍较高优先级的业务流。
优选的，该流控制功能组件应用于硬件上，以便保持其快速做出关于数据流中通过的包的处理决定的能力。
对于被包处理器功能组件70识别为可疑并且之后从数据流14中被提取76的包业务流，在做出最终处理决定之前对该业务流进行更仔细的和彻底的检查。使用一线外(out-of-line)威胁校验功能组件100执行该进一步的检查。“线外”的意思是包业务流在主数据流14外被处理。该威胁校验功能组件100以与前面详细讨论的在线触发过滤器功能组件50组件相似的方式运行。然而，在执行具体检查的层面上存在主要的运行差异。因为触发过滤器功能组件50必须在线运行，所以过滤标准(或规则)54必须被设计用于基本上以线速执行(优选的使用上述定制的硬件解决方案)。该设计标准基本上迫使触发过滤器功能组件50将其检测努力集中于不彻底的检查和评估(其被设计用于快速识别可疑的和明显的危险或有威胁的包业务流)。该检查的性质将会不可避免的将一定数量的通过进一步详细分析可被确定为良性业务流的包识别为可疑的。然而，线外威胁校验功能组件100的目标是更彻底的评估该可疑业务流，以便从可疑业务流中区分出良性部分并将其返回102到数据流14里。至此，其能被有利地应用为可定制的软件应用，以便确保其对于安全危险的持续的适应性和被设计或被调整的能力。
部分的由于基于软件的实现，威胁校验功能组件100实现与触发过滤器功能组件50略有不同的评估处理。特别的，该威胁校验功能组件100使用协议解码器和正则表达式匹配执行详细的威胁分析。这比触发过滤评估花费更多的时间和资源，但是它能带来准确的多的威胁确认。为执行该操作，提供给威胁校验功能组件100的过滤标准(或规则)108比提供给在线触发过滤器功能组件50的规则54更加全面且有更强的识别能力。由于对提取出76的可疑业务流的评估在线外执行，并且被检查的业务流的总量被相当多的减少，因此在威胁校验功能组件100中可以提供额外的时间以便更仔细地考虑是否每一个包真的预示着对网络的威胁或危险。提供了关于感兴趣的协议和正则表达式的检测校验110组件。然后，转换功能组件112将检测校验组件110转换为过滤器标准(或规则)108，以提供给并在威胁校验功能组件100上执行。检测校验组件110来自于与上述相同的一组检测签名62，这些检测签名被专门设计或制作以用于识别、检测和抑制所识别的单一会话类型的网络威胁。
该威胁校验功能组件100利用三种处理选项之一的选择，而响应于对可疑业务流的更仔细的分析。第一，在确认包业务流是良性的情况下，将其返回102到数据流104。第二，在确认一明显的威胁或危险的情况下，包业务流被阻止和丢弃114。第三，在无法做出明确决定(良性或者威胁)的情况下，包业务流被返回102到数据流，但是该业务流的备份被传递116以进行进一步的确认和处理，从而确定是否需要产生警告。
通过如下的考虑可以更好的理解触发过滤器功能组件50执行的分析和威胁校验功能组件100执行的分析之间的区别。由触发过滤器功能组件50使用的过滤标准被实现为基于硬件的触发机制，以允许对接收到的包业务流进行相对较高速度的检查，该机制使用限制了处理能力的过滤器，该过滤器被设计用来捕获实际上所有可疑的业务流，可以知道该过滤器将不可避免的、与危险业务流一起错误的额外捕获一些良性业务流(即，精确性较低并且会有大量的错误确认)。作为实例，该层过滤包含头字段比较和触发器内容搜索(即，短字符串比较)，其能够用较低复杂度的算法以更快的速度执行，并处理具有较高包含错误的怀疑度的过滤后输出。另一方面，由威胁校验功能组件100使用的过滤标准被应用为基于软件的确认机制，以允许对包业务流的可疑部分进行较低速度的检查，在该机制中，使用更复杂的处理能力过滤器，其被设计用来更仔细的检查可疑的业务流，并识别出更可能的威胁或危险的业务流，可以知道该威胁校验功能组件100可能错误的捕获一些良性的业务流(即，精确性相对较高，尽管也有少量的错误确认)，但是这发生的可能性比触发过滤器功能组件50要小得多。作为实例，该第二层过滤包含使用较复杂的算法以较慢的速度执行的协议解码器和正则表达式匹配(即，长字符串匹配)，并处理具有较低包含错误的怀疑度的过滤后输出。
关于由威胁校验功能组件100传递116的包业务流的备份(仍然可疑)，可以采取多种可能的行动。例如，产生警告120并将可疑的包业务流的备份传送给网络管理员以进行进一步的检查。可选地，可以由线外危险评估功能组件130对可疑的包业务流进行评估。危险评估功能组件130的操作用于评估是否可疑包业务流预示着对网络中的机器和设备存在可以确认的、具体的威胁。为了协助该确认，由系统10维护一资源数据库132，其中包含受保护网络中出现的每一台机器和设备的信息及其互连和彼此间的运行关系。例如，优选的，资源数据库132包含识别网络中的机器(主机)的企业(即受保护网络)特有的数据、主机提供的服务以及与该网络结构环境中的机器和服务关联的潜在的计算机系统和网络设备的弱点。可以使用多种众所周知的方法之一搜集该数据，这些方法包括，例如独立的、可能的在先技术的、弱点评估扫描器设备的使用，该设备用于以传统的方法评估该受保护的网络。然后，该危险评估功能组件对于网络中的资源环境评估已经触发怀疑的检测签名(特别的，该受到威胁的网络组件(机器设置)的签名信息)，以通过该检测签名的应用而确定受到被检测为可疑的包业务流威胁的网络资源的类型。如果由包含在数据库132中的信息确定，该受保护的网络没有任何受到威胁的机器或设备，则该可疑业务流与该网络关系很小或没有，并将其忽略。然而，如果该受保护的网络包含可能受到怀疑业务流威胁的资源，则该业务流随后或者被阻止并丢弃，或者产生通知网络/安全管理员的潜在威胁警告，以减少或消除该破坏危险。这种情况下，可能产生警告120并且该可疑包业务流被传送到网络管理员以进行进一步的检查。
再一次参考该算法过滤操作28。特别的，该检测引擎32以一种依据该算法过滤器30的统计方式来评估该报告的26的数据，并得出是否该网络正受到多个会话的攻击的结论。也可能该评估不能确切的判断是否存在攻击。这种情况下，就产生了攻击的怀疑。为了解决该怀疑，检测引擎被配置为能够产生一个怀疑警告170，该警告被传送到转换功能组件60。作为响应，该转换功能组件60可能改变或调整其转换操作，其中该转换操作将检测触发器56和检测异常58转换为过滤标准(或规则)54，从而该触发过滤器功能组件50的包头匹配操作52和/或包内容匹配操作54变得对可能存在的多会话攻击很敏感。这样，就在包头匹配操作52和/或包内容匹配操作54上执行一些控制以便尝试和找到该多会话攻击，基于由算法过滤操作28执行的统计分析而怀疑该多会话攻击的存在。
优选的，该系统10被设置为受保护网络中的一个网络单元。从而该系统10可能包括大量外部物理接口以允许连接到外部环境(即，受保护网络外面的不信任环境)。作为实例，该不信任环境可能包括下述的一种或几种：广域网(WAN)、虚拟专用网(VPN)服务器、本地局域网(LAN)客户机、无线或远程接入服务器以及不信任网络(例如互联网)。系统10中也可能包含大量内部的物理接口，以允许连接到受保护(信任的)网络的单元。例如，受保护网络的单元可能包括：路由器、特殊服务器类型(例如，HTTP、SMTP、FTP、DNA等)、内联网、个人计算机以及网络区域。可以知道，当需要配置信任网络和不信任网络的互连时，可以将内部和外部的物理接口相连接。
优选的，系统10在一支持其操作的适当的物理平台上应用。该平台包括向系统提供合适的执行环境以进行安全应用所需的基础硬件、操作系统和核心基础结构设备。该执行环境包括操作、管理、维持和提供设备、一个支持安全应用的执行的嵌入式操作系统以及硬件(例如底盘、电源、扩展能力、电路插件支持等)。尽管上面已经讨论了优选实施例，系统10的功能也可被应用于仅有硬件、仅有软件或两者都有的平台上。
对于由系统在触发过滤器功能组件50或者威胁校验功能组件100上执行的比较和过滤操作，有多种处理功能可以被考虑和被评估，以用于过滤标准或者与其相关联。在OSI第一层，可以考虑使用用于包通信的物理硬件接口。在OSI第二层，可以考虑使用下述涉及编码、寻址和传送信息的数据链路：以太网源/目标地址、VLAN PRI/CFI、VLAN识别符和以太网类型，以及MPLS标签。在OSI第三层，可以考虑使用下述涉及传输路由、消息处理和转移信息的网络：IP域(例如，源/目标地址、有效载荷长度、分段比特(fragbits)、头长度、ID字段、偏移字段、选项、协议字段、服务类型字段、生命周期字段和版本字段)、和ARP字段(发送端和目的端MAC或协议地址、协议或硬件类型或大小)。此外，在OSI第4层，可以考虑使用下述的关于传递服务和质量信息的传输：TCP域(源/目标端口、数据长度、头长度、应答号、标志、序列号、紧急指针、窗口及检查和)、ICMP(类型、编码、序列、ID、数据长度、检查和、icmp码)以及UDP(源/目标端口)。处理功能可附加地评估协议解码信息，如下：HTTP(所有的头字段包括请求行、方法、URI、协议、主机、内容长度、体)、DNS、SMTP、SNMP、SMP、FTP等。此外，处理功能可能评估：固定的常量字符串偏移、固定的变量字符串偏移、规则的常量表达式的偏移、规则的变量表达式的偏移、事件搜集、事件序列、分段、连接状态、流重组、标准化技术(检测和消除重叠分段、规避技术)以及十六进制或统一码解码。
尽管本发明的方法和装置的优选实施例已在附图中示出并在前面的详细说明中说明，可以理解本发明并未限制于公开的实施例，而是如同在后面的权利要求中提出和定义的，可以在不偏离本发明的精神的前提下进行多种重排、修改和替换。

Claims (37)

1.一种网络防护系统，包括：
一状态管理器功能组件，其与包的数据流在线连接，该状态管理器功能组件用于跟踪该数据流上当前存在的会话，并保存历史包的相关数据；
一算法过滤器，用于对跟踪的会话和历史包的相关数据执行统计分析，以确定经过多个会话的数据流中的包是否对受保护网络造成威胁；以及
一包处理器，其也与包的数据流在线连接，并用于响应于威胁的存在而阻止存在威胁的包。
2.如权利要求1所述的网络防护系统，其中该包处理器还用于响应于威胁的存在而终止存在威胁的会话。
3.如权利要求1所述的网络防护系统，其中对受保护网络的威胁包括对于多个会话的威胁，该多个会话的威胁来自于地址搜索攻击、端口扫描攻击和拒绝服务攻击组成的集合。
4.如权利要求1所述的网络防护系统，其中用于对跟踪的会话和历史包的相关数据执行统计分析的算法过滤器，还用于确定经过多个会话的数据流中的包是否是可疑的。
5.如权利要求4所述的网络防护系统，还包括：
一触发过滤器，也与包的数据流在线连接，并且用于响应于算法过滤器的可疑确定，根据为检测经过多个会话的威胁包而设计的标准，过滤出该数据流中的可疑包；以及
一包处理器，也与包的数据流在线连接，并且用于响应于检测到的威胁来阻止存在威胁的包。
6.如权利要求5所述的网络防护系统，其中该触发过滤器还用于根据为检测各个会话中的威胁包而设计的标准，过滤该数据流中的包。
7.如权利要求6所述的网络防护系统，其中该触发过滤器还用于确定各个会话的数据流中的包是否可疑，该包处理器还用于从该数据流中提取可疑包以用于进一步的检测。
8.如权利要求7所述的网络防护系统，还包括：
一威胁校验器，其接收所提取的包并对其执行过滤操作，该操作比由在线的触发过滤器执行的操作更全面，以确定可疑的提取包是否存在威胁。
9.如权利要求8所述的网络防护系统，其中该威胁校验器还用于当可疑的提取包被确认为不存在威胁时，将其返回到该数据流中。
10.如权利要求8所述的网络防护系统，还包括：
一危险评估器，其用于检查可疑的提取包，并且确定可疑的提取包对网络中出现的可识别资源是否造成某种危险。
11.如权利要求1所述的网络防护系统，还包括一流控制器，其也与包的数据流在线连接，并且用于管制沿着该数据流的包的经过。
12.如权利要求1所述的网络防护系统，其中：
该状态管理器功能组件以硬件来实现；并且
该算法过滤器以软件来实现。
13.一种网络防护的方法，包括如下步骤：
跟踪包的数据流上当前存在的会话；
收集关于所述会话的历史包的相关数据；
基于算法地过滤所跟踪的会话和收集的历史包的相关数据，以便根据统计分析而确定是否经过多个会话的数据流中的包引起对网络的威胁；以及
通过响应于所确定威胁的存在而阻止存在威胁的包来处理这些包的数据流中的包。
14.如权利要求13所述的方法，其中处理步骤还包括响应于所确定威胁的存在而终止存在威胁的会话的步骤。
15.如权利要求13所述的方法，其中对受保护网络的威胁包括对于多个会话的威胁，该多个会话的威胁来自于地址搜索攻击、端口扫描攻击和拒绝服务攻击组成的集合。
16.如权利要求13所述的方法，还包括根据统计分析确定是否经过多个会话的数据流中的包引起对网络产生威胁的怀疑的步骤。
17.如权利要求16所述的方法，还包括如下步骤：
根据为检测经过多个会话的存在威胁的包而设计的标准，响应于对威胁的怀疑而过滤这些包的数据流中的包；以及
通过响应于所检测威胁的存在而阻止存在威胁的包，处理这些包的数据流中的包。
18.如权利要求17所述的方法，其过滤包的步骤还包括根据为检测各个会话中存在威胁的包而设计的标准过滤数据流中的包的步骤。
19.如权利要求18所述的方法，其中过滤包的步骤还包括确定各个会话中的数据流的包是否可疑的步骤，处理步骤还包括从该数据流中提取可疑包以用于进一步的检测的步骤。
20.如权利要求19所述的方法，还包括如下步骤：
通过对提取的包执行过滤操作，而校验与其有关的威胁，该操作比用于确定可疑的提取包是否存在威胁的过滤包的步骤更全面。
21.如权利要求20所述的方法，其中校验该威胁的步骤还包括如果可疑的提取包被确认为没有危险，则将其返回到该数据流中的步骤。
22.如权利要求20所述的方法，还包括如下步骤：
通过确定是否可疑的提取包对网络中存在的可识别资源造成某种危险，而对可疑的提取包评估危险。
23.如权利要求13所述的方法，还包括通过管制沿着数据流的包的经过而控制该数据流的步骤。
24.一种防护网络的系统，包括：
一状态管理器功能组件，其与包的数据流在线连接，该状态管理器功能组件用于跟踪关于该数据流中当前存在的多个会话的信息；
一算法过滤器，其用于对该信息执行统计分析，以确定经过多个会话的该数据流中的包是否对网络造成威胁；
一触发过滤器，其也与包的数据流在线连接，并且用于根据为检测各个会话中存在威胁的包而设计的标准，过滤该数据流中的包；以及
一包处理器，其也与包的数据流在线连接，并且用于响应于算法过滤器和触发过滤器检测出的威胁来阻止存在威胁的包。
25.如权利要求24所述的系统，还包括流控制器，其也与该数据流在线连接，并且用于管制沿着该数据流的包的经过。
26.如权利要求24所述的系统，其中该算法过滤器还用于根据该统计分析确定经过多个会话的数据流中的包是否引起对网络构成威胁的怀疑，以及其中该触发过滤器还用于响应于可疑的确定，根据为检测经过多个会话的存在威胁的包而设计的标准，过滤该数据流中的可疑包。
27.如权利要求24所述的系统，其中该包处理器还用于响应于威胁的存在而终止存在威胁的会话。
28.如权利要求24所述的系统，其中对受保护网络的威胁包括关于多个会话的威胁，该多个会话的威胁来自于地址搜索攻击、端口扫描攻击和拒绝服务攻击组成的集合。
29.如权利要求24所述的系统，其中该触发过滤器还用于如果该触发过滤器确定该数据流的包可疑时，从该数据流中提取包。
30.如权利要求29所述的系统，还包括：
一威胁校验器，其接收所提取的包并对其执行过滤操作，该操作比由在线的触发过滤器执行的操作更全面，以确定可疑的提取包是否存在威胁。
31.如权利要求30所述的系统，其中该威胁校验器还用于当可疑的提取包被确认为没有危险时，将其返回到该数据流中。
32.如权利要求31所述的系统，还包括：
一危险评估器，其用于检查可疑的提取包，并且确定可疑的提取包是否对网络中出现的可识别资源造成某种危险。
33.如权利要求24所述的系统，其中由算法过滤器分析的信息包括关于包与已建立的某些会话的关联的会话跟踪数据。
34.如权利要求24所述的系统，其中由该算法过滤器分析的信息包括经过多个会话的历史包的相关数据。
35.如权利要求24所述的系统，其中该标准包括头和内容匹配标准。
36.如权利要求24所述的系统，其中该标准包括多包内容匹配标准。
37.如权利要求24所述系统，其中该算法过滤器执行统计阈值过滤。
CNB2003801047096A 2002-11-07 2003-11-07 主动网络防护系统与方法 Expired - Fee Related CN100443910C (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US10/291,095 2002-11-07
US10/291,095 US7454499B2 (en) 2002-11-07 2002-11-07 Active network defense system and method

Publications (2)

Publication Number Publication Date
CN1720459A CN1720459A (zh) 2006-01-11
CN100443910C true CN100443910C (zh) 2008-12-17

Family

ID=32229193

Family Applications (1)

Application Number Title Priority Date Filing Date
CNB2003801047096A Expired - Fee Related CN100443910C (zh) 2002-11-07 2003-11-07 主动网络防护系统与方法

Country Status (8)

Country Link
US (3) US7454499B2 (zh)
EP (1) EP1558937B1 (zh)
JP (2) JP2006506853A (zh)
KR (2) KR101111433B1 (zh)
CN (1) CN100443910C (zh)
AR (1) AR042020A1 (zh)
AU (1) AU2003290674A1 (zh)
WO (1) WO2004045126A2 (zh)

Families Citing this family (484)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7711790B1 (en) 2000-08-24 2010-05-04 Foundry Networks, Inc. Securing an accessible computer system
US7725587B1 (en) 2000-08-24 2010-05-25 Aol Llc Deep packet scan hacker identification
US8438241B2 (en) * 2001-08-14 2013-05-07 Cisco Technology, Inc. Detecting and protecting against worm traffic on a network
US7313815B2 (en) * 2001-08-30 2007-12-25 Cisco Technology, Inc. Protecting against spoofed DNS messages
US7398389B2 (en) * 2001-12-20 2008-07-08 Coretrace Corporation Kernel-based network security infrastructure
US7359962B2 (en) * 2002-04-30 2008-04-15 3Com Corporation Network security system integration
WO2004034229A2 (en) 2002-10-10 2004-04-22 Rocksteady Networks, Inc. System and method for providing access control
US7587512B2 (en) 2002-10-16 2009-09-08 Eric White System and method for dynamic bandwidth provisioning
US7401360B2 (en) * 2002-12-03 2008-07-15 Tekelec Methods and systems for identifying and mitigating telecommunications network security threats
US8683016B1 (en) * 2002-12-20 2014-03-25 Versata Development Group, Inc. Data recording components and processes for acquiring selected web site data
US20040148520A1 (en) * 2003-01-29 2004-07-29 Rajesh Talpade Mitigating denial of service attacks
US8296452B2 (en) * 2003-03-06 2012-10-23 Cisco Technology, Inc. Apparatus and method for detecting tiny fragment attacks
US7895649B1 (en) * 2003-04-04 2011-02-22 Raytheon Company Dynamic rule generation for an enterprise intrusion detection system
US7796515B2 (en) * 2003-04-29 2010-09-14 Hewlett-Packard Development Company, L.P. Propagation of viruses through an information technology network
GB2401281B (en) * 2003-04-29 2006-02-08 Hewlett Packard Development Co Propagation of viruses through an information technology network
US7730175B1 (en) 2003-05-12 2010-06-01 Sourcefire, Inc. Systems and methods for identifying the services of a network
US7684432B2 (en) * 2003-05-15 2010-03-23 At&T Intellectual Property I, L.P. Methods of providing data services over data networks and related data networks, data service providers, routing gateways and computer program products
US8174970B2 (en) * 2003-05-15 2012-05-08 At&T Intellectual Property I, L.P. Methods of implementing dynamic QoS and/or bandwidth provisioning and related data networks, data service providers, routing gateways, and computer program products
US8239516B2 (en) 2003-05-15 2012-08-07 At&T Intellectual Property I, L.P. Methods, systems and computer program products for proactively offering a network turbo boost service to end users
US8521889B2 (en) 2003-05-15 2013-08-27 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for modifying bandwidth and/or quality of service for a user session in a network
US8204042B2 (en) 2003-05-15 2012-06-19 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for establishing VoIP service in a network
US20050021739A1 (en) * 2003-05-15 2005-01-27 Carter Sharon E. Methods, systems and computer program products for communicating the expected efficacy of invoking a network turbo boost service
US7681235B2 (en) * 2003-05-19 2010-03-16 Radware Ltd. Dynamic network protection
US20040252722A1 (en) * 2003-06-13 2004-12-16 Samsung Electronics Co., Ltd. Apparatus and method for implementing VLAN bridging and a VPN in a distributed architecture router
US7463590B2 (en) * 2003-07-25 2008-12-09 Reflex Security, Inc. System and method for threat detection and response
US7624438B2 (en) 2003-08-20 2009-11-24 Eric White System and method for providing a secure connection between networked computers
IL158309A (en) * 2003-10-08 2011-06-30 Ammon Yacoby Centralized network control
US7237267B2 (en) * 2003-10-16 2007-06-26 Cisco Technology, Inc. Policy-based network security management
US7310815B2 (en) * 2003-10-29 2007-12-18 Sonicwall, Inc. Method and apparatus for datastream analysis and blocking
WO2005050369A2 (en) 2003-11-12 2005-06-02 The Trustees Of Columbia University In The City Ofnew York Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data
US8839417B1 (en) 2003-11-17 2014-09-16 Mcafee, Inc. Device, system and method for defending a computer network
US7487542B2 (en) * 2004-01-14 2009-02-03 International Business Machines Corporation Intrusion detection using a network processor and a parallel pattern detection engine
WO2005069732A2 (en) * 2004-01-26 2005-08-04 Cisco Technology Inc. Upper-level protocol authentication
US7526804B2 (en) * 2004-02-02 2009-04-28 Microsoft Corporation Hardware assist for pattern matches
US7792147B1 (en) * 2004-02-09 2010-09-07 Symantec Corporation Efficient assembly of fragmented network traffic for data security
US7603716B2 (en) * 2004-02-13 2009-10-13 Microsoft Corporation Distributed network security service
US7392295B2 (en) 2004-02-19 2008-06-24 Microsoft Corporation Method and system for collecting information from computer systems based on a trusted relationship
US7694022B2 (en) * 2004-02-24 2010-04-06 Microsoft Corporation Method and system for filtering communications to prevent exploitation of a software vulnerability
US7665130B2 (en) 2004-03-10 2010-02-16 Eric White System and method for double-capture/double-redirect to a different location
US7590728B2 (en) 2004-03-10 2009-09-15 Eric White System and method for detection of aberrant network behavior by clients of a network access gateway
US7610621B2 (en) * 2004-03-10 2009-10-27 Eric White System and method for behavior-based firewall modeling
US20050204022A1 (en) * 2004-03-10 2005-09-15 Keith Johnston System and method for network management XML architectural abstraction
US7509625B2 (en) * 2004-03-10 2009-03-24 Eric White System and method for comprehensive code generation for system management
US8543710B2 (en) 2004-03-10 2013-09-24 Rpx Corporation Method and system for controlling network access
US9106694B2 (en) 2004-04-01 2015-08-11 Fireeye, Inc. Electronic message analysis for malware detection
US9027135B1 (en) 2004-04-01 2015-05-05 Fireeye, Inc. Prospective client identification using malware attack detection
US8549638B2 (en) 2004-06-14 2013-10-01 Fireeye, Inc. System and method of containing computer worms
US8171553B2 (en) * 2004-04-01 2012-05-01 Fireeye, Inc. Heuristic based capture with replay to virtual machine
US8881282B1 (en) 2004-04-01 2014-11-04 Fireeye, Inc. Systems and methods for malware attack detection and identification
US7587537B1 (en) 2007-11-30 2009-09-08 Altera Corporation Serializer-deserializer circuits formed from input-output circuit registers
US8898788B1 (en) 2004-04-01 2014-11-25 Fireeye, Inc. Systems and methods for malware attack prevention
US8528086B1 (en) 2004-04-01 2013-09-03 Fireeye, Inc. System and method of detecting computer worms
US8793787B2 (en) * 2004-04-01 2014-07-29 Fireeye, Inc. Detecting malicious network content using virtual environment components
US8566946B1 (en) 2006-04-20 2013-10-22 Fireeye, Inc. Malware containment on connection
US8584239B2 (en) 2004-04-01 2013-11-12 Fireeye, Inc. Virtual machine with dynamic data flow analysis
ES2547716T3 (es) 2004-04-14 2015-10-08 Mbalance Research B.V. Método para prevenir la entrega de un mensaje basura del servicio de mensajes cortos
JP4755175B2 (ja) * 2004-04-19 2011-08-24 ザ・リージェンツ・オブ・ザ・ユニバーシティ・オブ・カリフォルニア 深いパケットフィルタリングのためのプログラム可能なハードウエア
GB2431316B (en) * 2005-10-12 2008-05-21 Hewlett Packard Development Co Propagation of malicious code through an information technology network
US7225468B2 (en) * 2004-05-07 2007-05-29 Digital Security Networks, Llc Methods and apparatus for computer network security using intrusion detection and prevention
US7539681B2 (en) 2004-07-26 2009-05-26 Sourcefire, Inc. Methods and systems for multi-pattern searching
US7496962B2 (en) * 2004-07-29 2009-02-24 Sourcefire, Inc. Intrusion detection strategies for hypertext transport protocol
US7562389B1 (en) 2004-07-30 2009-07-14 Cisco Technology, Inc. Method and system for network security
US7555774B2 (en) * 2004-08-02 2009-06-30 Cisco Technology, Inc. Inline intrusion detection using a single physical port
US7444588B2 (en) * 2004-08-05 2008-10-28 At&T Intellectual Property, I.L.P. Methods, systems, and storage mediums for providing multi-media content storage and management services
US7545788B2 (en) * 2004-08-20 2009-06-09 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for modifying bandwidth and/or quality of service in a core network
US20060045121A1 (en) * 2004-08-25 2006-03-02 Monk John M Methods and systems for analyzing network transmission events
WO2006040201A1 (en) * 2004-09-02 2006-04-20 Siemens Aktiengesellschaft Method and apparatus for denial of service defense
US8331234B1 (en) 2004-09-08 2012-12-11 Q1 Labs Inc. Network data flow collection and processing
JP4634456B2 (ja) * 2004-09-09 2011-02-16 アバイア インコーポレーテッド ネットワーク・トラフィックのセキュリティのための方法およびシステム
US7836506B2 (en) * 2004-09-22 2010-11-16 Cyberdefender Corporation Threat protection network
US20060075093A1 (en) * 2004-10-05 2006-04-06 Enterasys Networks, Inc. Using flow metric events to control network operation
US7849506B1 (en) * 2004-10-12 2010-12-07 Avaya Inc. Switching device, method, and computer program for efficient intrusion detection
US7835361B1 (en) 2004-10-13 2010-11-16 Sonicwall, Inc. Method and apparatus for identifying data patterns in a file
US7600257B2 (en) 2004-10-13 2009-10-06 Sonicwall, Inc. Method and an apparatus to perform multiple packet payloads analysis
JP4676499B2 (ja) * 2004-11-04 2011-04-27 テルコーディア ライセンシング カンパニー， リミテッド ライアビリティ カンパニー ネットワークフロー内のエクスプロイトコードの検出
US7540025B2 (en) * 2004-11-18 2009-05-26 Cisco Technology, Inc. Mitigating network attacks using automatic signature generation
US20070039051A1 (en) * 2004-11-30 2007-02-15 Sensory Networks, Inc. Apparatus And Method For Acceleration of Security Applications Through Pre-Filtering
US20060174343A1 (en) * 2004-11-30 2006-08-03 Sensory Networks, Inc. Apparatus and method for acceleration of security applications through pre-filtering
JP2006157760A (ja) * 2004-12-01 2006-06-15 Hitachi Ltd パケット転送装置およびパケット転送処理方法
KR100639969B1 (ko) * 2004-12-02 2006-11-01 한국전자통신연구원 이상 트래픽 제어 장치 및 그 제어 방법
CN101124801B (zh) * 2004-12-21 2013-04-03 高通股份有限公司 客户机协助的防火墙配置
FI20041681A0 (fi) * 2004-12-29 2004-12-29 Nokia Corp Liikenteen rajoittaminen kommunikaatiojärjestelmissä
US7725938B2 (en) * 2005-01-20 2010-05-25 Cisco Technology, Inc. Inline intrusion detection
JP4170299B2 (ja) * 2005-01-31 2008-10-22 独立行政法人 宇宙航空研究開発機構 通信状態遷移モニタ方法及びこれを利用した通信状態遷移モニタ装置
US7996894B1 (en) * 2005-02-15 2011-08-09 Sonicwall, Inc. MAC address modification of otherwise locally bridged client devices to provide security
US7774849B2 (en) * 2005-04-15 2010-08-10 Tekelec Methods, systems, and computer program products for detecting and mitigating denial of service attacks in a telecommunications signaling network
US20070097976A1 (en) * 2005-05-20 2007-05-03 Wood George D Suspect traffic redirection
US8028160B1 (en) * 2005-05-27 2011-09-27 Marvell International Ltd. Data link layer switch with protection against internet protocol spoofing attacks
US7562293B2 (en) * 2005-05-27 2009-07-14 International Business Machines Corporation Method and apparatus for processing a parseable document
US7757283B2 (en) 2005-07-08 2010-07-13 Alcatel Lucent System and method for detecting abnormal traffic based on early notification
FR2888695A1 (fr) * 2005-07-13 2007-01-19 France Telecom Detection d'une intrusion par detournement de paquets de donnees dans un reseau de telecommunication
US7873998B1 (en) * 2005-07-19 2011-01-18 Trustwave Holdings, Inc. Rapidly propagating threat detection
US7746862B1 (en) * 2005-08-02 2010-06-29 Juniper Networks, Inc. Packet processing in a multiple processor system
US8166547B2 (en) * 2005-09-06 2012-04-24 Fortinet, Inc. Method, apparatus, signals, and medium for managing a transfer of data in a data network
US20070056038A1 (en) * 2005-09-06 2007-03-08 Lok Technology, Inc. Fusion instrusion protection system
US7624447B1 (en) 2005-09-08 2009-11-24 Cisco Technology, Inc. Using threshold lists for worm detection
US8095984B2 (en) * 2005-09-22 2012-01-10 Alcatel Lucent Systems and methods of associating security vulnerabilities and assets
US8438643B2 (en) * 2005-09-22 2013-05-07 Alcatel Lucent Information system service-level security risk analysis
US8544098B2 (en) * 2005-09-22 2013-09-24 Alcatel Lucent Security vulnerability information aggregation
US8510833B2 (en) * 2005-10-27 2013-08-13 Hewlett-Packard Development Company, L.P. Connection-rate filtering using ARP requests
US8001602B2 (en) * 2005-10-31 2011-08-16 Freescale Semiconductor, Inc. Data scan mechanism
KR100718640B1 (ko) * 2005-11-10 2007-05-16 홍성호 셋션별 데이터 필터링 및 전달 기능을 구비한정보보안시스템 및 방법
US8046833B2 (en) * 2005-11-14 2011-10-25 Sourcefire, Inc. Intrusion event correlation with network discovery information
US7733803B2 (en) * 2005-11-14 2010-06-08 Sourcefire, Inc. Systems and methods for modifying network map attributes
US8352589B2 (en) * 2005-11-15 2013-01-08 Aternity Information Systems Ltd. System for monitoring computer systems and alerting users of faults
US8468589B2 (en) 2006-01-13 2013-06-18 Fortinet, Inc. Computerized system and method for advanced network content processing
US8270413B2 (en) * 2005-11-28 2012-09-18 Cisco Technology, Inc. Method and apparatus for self-learning of VPNS from combination of unidirectional tunnels in MPLS/VPN networks
CN100563246C (zh) * 2005-11-30 2009-11-25 华为技术有限公司 一种基于ip的语音通信边界安全控制系统及方法
KR100734872B1 (ko) * 2005-12-12 2007-07-03 한국전자통신연구원 Ｒｆｉｄ 응용레벨 이벤트 서비스에 대한 접근 제어 시스템및 그 방법
US8392999B2 (en) * 2005-12-19 2013-03-05 White Cyber Knight Ltd. Apparatus and methods for assessing and maintaining security of a computerized system under development
US7856100B2 (en) * 2005-12-19 2010-12-21 Microsoft Corporation Privacy-preserving data aggregation using homomorphic encryption
US7743123B2 (en) * 2005-12-19 2010-06-22 Microsoft Corporation Aggregating information from a cluster of peers
US20070143849A1 (en) * 2005-12-19 2007-06-21 Eyal Adar Method and a software system for end-to-end security assessment for security and CIP professionals
US8613088B2 (en) * 2006-02-03 2013-12-17 Cisco Technology, Inc. Methods and systems to detect an evasion attack
US9747439B2 (en) * 2006-02-06 2017-08-29 Trend Micro Incorporated Dynamic network tuner for the automated correlation of networking device functionality and network-related performance
MY150011A (en) * 2006-03-24 2013-11-15 Avg Technologies Cy Ltd Software vulnerability exploitation shield
US8244855B1 (en) * 2006-06-21 2012-08-14 Qurio Holdings, Inc. Application state aware mediating server
US8009566B2 (en) * 2006-06-26 2011-08-30 Palo Alto Networks, Inc. Packet classification in a network security device
US8102863B1 (en) 2006-06-27 2012-01-24 Qurio Holdings, Inc. High-speed WAN to wireless LAN gateway
US7948988B2 (en) * 2006-07-27 2011-05-24 Sourcefire, Inc. Device, system and method for analysis of fragments in a fragment train
US20080044018A1 (en) * 2006-07-31 2008-02-21 Scrimsher John P Method and system to detect and prevent computer network intrusion
US7701945B2 (en) * 2006-08-10 2010-04-20 Sourcefire, Inc. Device, system and method for analysis of segments in a transmission control protocol (TCP) session
US8856920B2 (en) * 2006-09-18 2014-10-07 Alcatel Lucent System and method of securely processing lawfully intercepted network traffic
DE102006045306A1 (de) * 2006-09-26 2008-04-10 Siemens Ag Netzwerkvorrichtung mit einer Filtervorrichtung zum Filtern empfangener Datenpakete und Verfahren zum Betreiben einer solchen Netzwerkvorrichtung
EP2076866A2 (en) * 2006-10-06 2009-07-08 Sourcefire, Inc. Device, system and method for use of micro-policies in intrusion detection/prevention
KR100862187B1 (ko) * 2006-10-27 2008-10-09 한국전자통신연구원 취약점 분석 및 공격방식 모델링을 이용한 네트워크기반의인터넷 웜 탐지 장치 및 그 방법
US8156557B2 (en) * 2007-01-04 2012-04-10 Cisco Technology, Inc. Protection against reflection distributed denial of service attacks
WO2008098260A1 (en) * 2007-02-09 2008-08-14 Smobile Systems, Inc. Off-line mms malware scanning system and method
US8069352B2 (en) 2007-02-28 2011-11-29 Sourcefire, Inc. Device, system and method for timestamp analysis of segments in a transmission control protocol (TCP) session
KR101367652B1 (ko) * 2007-03-12 2014-02-27 주식회사 엘지씨엔에스 정적 정책정보를 이용한 침입방지 장치 및 방법
US8850547B1 (en) 2007-03-14 2014-09-30 Volcano Corporation Remote access service inspector
US8509075B2 (en) * 2007-03-23 2013-08-13 Hewlett-Packard Development Company, Lp Data-type-based network path configuration
US8594085B2 (en) * 2007-04-11 2013-11-26 Palo Alto Networks, Inc. L2/L3 multi-mode switch including policy processing
US8996681B2 (en) * 2007-04-23 2015-03-31 The Mitre Corporation Passively attributing anonymous network events to their associated users
US8707431B2 (en) * 2007-04-24 2014-04-22 The Mitre Corporation Insider threat detection
WO2008134057A1 (en) * 2007-04-30 2008-11-06 Sourcefire, Inc. Real-time awareness for a computer network
US20080282346A1 (en) * 2007-05-10 2008-11-13 Motorola, Inc. Data Type Management Unit
US20080307525A1 (en) * 2007-06-05 2008-12-11 Computer Associates Think, Inc. System and method for evaluating security events in the context of an organizational structure
US8863286B1 (en) 2007-06-05 2014-10-14 Sonicwall, Inc. Notification for reassembly-free file scanning
US8006303B1 (en) * 2007-06-07 2011-08-23 International Business Machines Corporation System, method and program product for intrusion protection of a network
US8135007B2 (en) * 2007-06-29 2012-03-13 Extreme Networks, Inc. Method and mechanism for port redirects in a network switch
US7991723B1 (en) 2007-07-16 2011-08-02 Sonicwall, Inc. Data pattern analysis using optimized deterministic finite automaton
EP2018013A1 (en) * 2007-07-17 2009-01-21 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. Method and telecommunications apparatus for protecting VoIP services against attacks
US8291495B1 (en) 2007-08-08 2012-10-16 Juniper Networks, Inc. Identifying applications for intrusion detection systems
US7742945B2 (en) * 2007-08-27 2010-06-22 At&T Intellectual Property, I,L.P. Methods, systems and computer products to incentivize high speed internet access
US7996520B2 (en) * 2007-09-19 2011-08-09 Cisco Technology, Inc. Behavioral classification of communication sessions using active session initiation
CN101399749B (zh) * 2007-09-27 2012-04-04 华为技术有限公司 一种报文过滤的方法、系统和设备
RU2465661C2 (ru) * 2007-10-29 2012-10-27 Холтек Интернэшнл, Инк. Устройство для закрепления радиоактивных тепловыделяющих сборок
US8112800B1 (en) 2007-11-08 2012-02-07 Juniper Networks, Inc. Multi-layered application classification and decoding
US8370937B2 (en) * 2007-12-03 2013-02-05 Cisco Technology, Inc. Handling of DDoS attacks from NAT or proxy devices
US20090158433A1 (en) * 2007-12-18 2009-06-18 Motorola, Inc. Method and Apparatus to Facilitate Generating Worm-Detection Signatures Using Data Packet Field Lengths
US8479284B1 (en) * 2007-12-20 2013-07-02 Symantec Corporation Referrer context identification for remote object links
US8180761B1 (en) 2007-12-27 2012-05-15 Symantec Corporation Referrer context aware target queue prioritization
US20090182818A1 (en) * 2008-01-11 2009-07-16 Fortinet, Inc. A Delaware Corporation Heuristic detection of probable misspelled addresses in electronic communications
US9237167B1 (en) * 2008-01-18 2016-01-12 Jpmorgan Chase Bank, N.A. Systems and methods for performing network counter measures
US20090216875A1 (en) * 2008-02-26 2009-08-27 Barracuda Inc. Filtering secure network messages without cryptographic processes method
US8443440B2 (en) * 2008-04-05 2013-05-14 Trend Micro Incorporated System and method for intelligent coordination of host and guest intrusion prevention in virtualized environment
US8474043B2 (en) * 2008-04-17 2013-06-25 Sourcefire, Inc. Speed and memory optimization of intrusion detection system (IDS) and intrusion prevention system (IPS) rule processing
US20090265777A1 (en) * 2008-04-21 2009-10-22 Zytron Corp. Collaborative and proactive defense of networks and information systems
US8339959B1 (en) 2008-05-20 2012-12-25 Juniper Networks, Inc. Streamlined packet forwarding using dynamic filters for routing and security in a shared forwarding plane
US8341740B2 (en) * 2008-05-21 2012-12-25 Alcatel Lucent Method and system for identifying enterprise network hosts infected with slow and/or distributed scanning malware
KR100870871B1 (ko) * 2008-05-29 2008-11-27 (주)한드림넷 액세스레벨에서의 유해트래픽 차단장치 및 보안시스템
US8391157B2 (en) * 2008-06-16 2013-03-05 Ixia Distributed flow analysis
JP5473406B2 (ja) * 2008-07-18 2014-04-16 キヤノン株式会社 ネットワーク処理装置及びその処理方法
US8955107B2 (en) * 2008-09-12 2015-02-10 Juniper Networks, Inc. Hierarchical application of security services within a computer network
US8769682B2 (en) * 2008-09-18 2014-07-01 Alcatel Lucent Mechanism for identifying malicious content, DoS attacks, and illegal IPTV services
US8813221B1 (en) 2008-09-25 2014-08-19 Sonicwall, Inc. Reassembly-free deep packet inspection on multi-core hardware
US8272055B2 (en) 2008-10-08 2012-09-18 Sourcefire, Inc. Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention system
US8572717B2 (en) 2008-10-09 2013-10-29 Juniper Networks, Inc. Dynamic access control policy with port restrictions for a network security appliance
US8040808B1 (en) 2008-10-20 2011-10-18 Juniper Networks, Inc. Service aware path selection with a network acceleration device
US8997219B2 (en) 2008-11-03 2015-03-31 Fireeye, Inc. Systems and methods for detecting malicious PDF network content
US8850571B2 (en) * 2008-11-03 2014-09-30 Fireeye, Inc. Systems and methods for detecting malicious network content
US10007486B2 (en) * 2008-12-01 2018-06-26 Micron Technology, Inc. Systems and methods to enable identification of different data sets
US8578491B2 (en) * 2008-12-11 2013-11-05 Alcatel Lucent Network based malware detection and reporting
KR101195944B1 (ko) * 2008-12-17 2012-10-29 고려대학교 산학협력단 심층 패킷 검사 장치 및 심층 패킷 검사 방법
US8873556B1 (en) 2008-12-24 2014-10-28 Palo Alto Networks, Inc. Application based packet forwarding
US8661155B2 (en) * 2008-12-30 2014-02-25 Telefonaktiebolaget Lm Ericsson (Publ) Service layer assisted change of multimedia stream access delivery
US8769664B1 (en) 2009-01-30 2014-07-01 Palo Alto Networks, Inc. Security processing in active security devices
US8321938B2 (en) * 2009-02-12 2012-11-27 Raytheon Bbn Technologies Corp. Multi-tiered scalable network monitoring
US8051167B2 (en) * 2009-02-13 2011-11-01 Alcatel Lucent Optimized mirror for content identification
US20100229234A1 (en) * 2009-03-03 2010-09-09 Tandberg Television Inc. Systems and methods for detecting and preventing denial of service attacks in an iptv system
US9398043B1 (en) 2009-03-24 2016-07-19 Juniper Networks, Inc. Applying fine-grain policy action to encapsulated network attacks
DE102009022851A1 (de) * 2009-05-27 2010-12-02 Siemens Aktiengesellschaft Netzwerkkomponente und Verfahren zum Überwachen von Kommunikationsverbindungen
US20100332593A1 (en) * 2009-06-29 2010-12-30 Igor Barash Systems and methods for operating an anti-malware network on a cloud computing platform
US9769149B1 (en) 2009-07-02 2017-09-19 Sonicwall Inc. Proxy-less secure sockets layer (SSL) data inspection
KR100959264B1 (ko) * 2009-08-26 2010-05-26 에스지에이 주식회사 네트워크를 이용하는 프로세스의 감시를 통한 좀비ｐｃ 차단 시스템 및 그 방법
US8793151B2 (en) * 2009-08-28 2014-07-29 Src, Inc. System and method for organizational risk analysis and reporting by mapping detected risk patterns onto a risk ontology
CN101997859B (zh) * 2009-08-28 2014-10-08 国际商业机器公司 识别tcp流中的数据包的载荷的方法和设备
EP2477362A4 (en) * 2009-09-10 2013-12-04 Nec Corp RELAY CONTROL DEVICE, RELAY CONTROL SYSTEM, RELAY CONTROL METHOD, AND RELAY CONTROL PROGRAM
US8832829B2 (en) 2009-09-30 2014-09-09 Fireeye, Inc. Network-based binary file extraction and analysis for malware detection
US8782787B2 (en) 2009-10-28 2014-07-15 Hewlett-Packard Development Company, L.P. Distributed packet flow inspection and processing
KR101269790B1 (ko) * 2009-12-10 2013-05-30 한국전자통신연구원 데이터 플로우 병렬 처리 장치 및 방법
KR101326983B1 (ko) * 2009-12-21 2014-01-15 한국전자통신연구원 트래픽 제어 장치 및 방법
US8560552B2 (en) * 2010-01-08 2013-10-15 Sycamore Networks, Inc. Method for lossless data reduction of redundant patterns
US8514697B2 (en) * 2010-01-08 2013-08-20 Sycamore Networks, Inc. Mobile broadband packet switched traffic optimization
US9325625B2 (en) * 2010-01-08 2016-04-26 Citrix Systems, Inc. Mobile broadband packet switched traffic optimization
CN102137059B (zh) * 2010-01-21 2014-12-10 阿里巴巴集团控股有限公司 一种恶意访问的拦截方法和系统
EP2559217B1 (en) 2010-04-16 2019-08-14 Cisco Technology, Inc. System and method for near-real time network attack detection, and system and method for unified detection via detection routing
US8433790B2 (en) 2010-06-11 2013-04-30 Sourcefire, Inc. System and method for assigning network blocks to sensors
US8671182B2 (en) 2010-06-22 2014-03-11 Sourcefire, Inc. System and method for resolving operating system or service identity conflicts
US8607353B2 (en) * 2010-07-29 2013-12-10 Accenture Global Services Gmbh System and method for performing threat assessments using situational awareness
KR101370511B1 (ko) * 2010-09-15 2014-03-06 한국전자통신연구원 메타데이터 분류를 이용한 패킷 검사 방법 및 그 장치
US8509071B1 (en) 2010-10-06 2013-08-13 Juniper Networks, Inc. Multi-dimensional traffic management
KR101021948B1 (ko) * 2010-11-10 2011-03-16 (주) 위즈네트 네트워크 보안 하드웨어 인터넷 패킷 처리장치
WO2012069094A1 (en) * 2010-11-26 2012-05-31 Hewlett-Packard Development Company, L P Mitigation system
GB201101875D0 (en) 2011-02-03 2011-03-23 Roke Manor Research A method and apparatus for communications analysis
US8458796B2 (en) * 2011-03-08 2013-06-04 Hewlett-Packard Development Company, L.P. Methods and systems for full pattern matching in hardware
US8601034B2 (en) 2011-03-11 2013-12-03 Sourcefire, Inc. System and method for real time data awareness
US8151341B1 (en) 2011-05-23 2012-04-03 Kaspersky Lab Zao System and method for reducing false positives during detection of network attacks
US9047441B2 (en) 2011-05-24 2015-06-02 Palo Alto Networks, Inc. Malware analysis system
US8695096B1 (en) 2011-05-24 2014-04-08 Palo Alto Networks, Inc. Automatic signature generation for malicious PDF files
US9553817B1 (en) 2011-07-14 2017-01-24 Sprint Communications Company L.P. Diverse transmission of packet content
US8726379B1 (en) 2011-07-15 2014-05-13 Norse Corporation Systems and methods for dynamic protection from electronic attacks
US8893274B2 (en) * 2011-08-03 2014-11-18 Trend Micro, Inc. Cross-VM network filtering
US10068227B1 (en) * 2011-09-13 2018-09-04 Tellabs Operations, Inc. Methods and apparatus for authenticating identity of web access from a network element
US9251535B1 (en) 2012-01-05 2016-02-02 Juniper Networks, Inc. Offload of data transfer statistics from a mobile access gateway
US9391878B2 (en) * 2012-01-25 2016-07-12 Cisco Technology, Inc. Reliable packet delivery with overlay network (RPDON)
KR20160101204A (ko) * 2012-01-27 2016-08-24 노키아 솔루션스 앤드 네트웍스 오와이 모바일 패킷 코어 네트워크에서의 세션 종결
KR101414959B1 (ko) * 2012-02-29 2014-07-09 주식회사 팬택 네트워크 공격을 감지하는 이동 통신 단말기 및 그 감지 방법
US8955093B2 (en) * 2012-04-11 2015-02-10 Varmour Networks, Inc. Cooperative network security inspection
US8776243B2 (en) * 2012-04-27 2014-07-08 Ixia Methods, systems, and computer readable media for combining IP fragmentation evasion techniques
EP2847680A4 (en) * 2012-05-08 2016-02-17 Fireblade Ltd CENTERIZED DEVICE REPUTATION CENTER
BR112015002323A2 (pt) * 2012-07-31 2017-07-04 Hewlett Packard Development Co sistema de processamento de tráfego de rede
US9215208B2 (en) * 2012-08-17 2015-12-15 The Keyw Corporation Network attack offensive appliance
CN104718721A (zh) * 2012-08-17 2015-06-17 诺基亚通信公司 计算机系统中的数据服务
US9258321B2 (en) 2012-08-23 2016-02-09 Raytheon Foreground Security, Inc. Automated internet threat detection and mitigation system and associated methods
US9392003B2 (en) 2012-08-23 2016-07-12 Raytheon Foreground Security, Inc. Internet security cyber threat reporting system and method
US8943587B2 (en) * 2012-09-13 2015-01-27 Symantec Corporation Systems and methods for performing selective deep packet inspection
US9565213B2 (en) 2012-10-22 2017-02-07 Centripetal Networks, Inc. Methods and systems for protecting a secured network
US9137205B2 (en) 2012-10-22 2015-09-15 Centripetal Networks, Inc. Methods and systems for protecting a secured network
US10572665B2 (en) 2012-12-28 2020-02-25 Fireeye, Inc. System and method to create a number of breakpoints in a virtual machine via virtual machine trapping events
US9203806B2 (en) 2013-01-11 2015-12-01 Centripetal Networks, Inc. Rule swapping in a packet network
US9165142B1 (en) * 2013-01-30 2015-10-20 Palo Alto Networks, Inc. Malware family identification using profile signatures
US8990944B1 (en) 2013-02-23 2015-03-24 Fireeye, Inc. Systems and methods for automatically detecting backdoors
US9009822B1 (en) 2013-02-23 2015-04-14 Fireeye, Inc. Framework for multi-phase analysis of mobile applications
US9367681B1 (en) 2013-02-23 2016-06-14 Fireeye, Inc. Framework for efficient security coverage of mobile software applications using symbolic execution to reach regions of interest within an application
US9195829B1 (en) 2013-02-23 2015-11-24 Fireeye, Inc. User interface with real-time visual playback along with synchronous textual analysis log display and event/time index for anomalous behavior detection in applications
US9159035B1 (en) 2013-02-23 2015-10-13 Fireeye, Inc. Framework for computer application analysis of sensitive information tracking
US9176843B1 (en) 2013-02-23 2015-11-03 Fireeye, Inc. Framework for efficient security coverage of mobile software applications
US9824209B1 (en) 2013-02-23 2017-11-21 Fireeye, Inc. Framework for efficient security coverage of mobile software applications that is usable to harden in the field code
US9009823B1 (en) 2013-02-23 2015-04-14 Fireeye, Inc. Framework for efficient security coverage of mobile software applications installed on mobile devices
US9124552B2 (en) 2013-03-12 2015-09-01 Centripetal Networks, Inc. Filtering network data transfers
US9104867B1 (en) 2013-03-13 2015-08-11 Fireeye, Inc. Malicious content analysis using simulated user interaction without user involvement
US9355247B1 (en) 2013-03-13 2016-05-31 Fireeye, Inc. File extraction from memory dump for malicious content analysis
US9626509B1 (en) 2013-03-13 2017-04-18 Fireeye, Inc. Malicious content analysis with multi-version application support within single operating environment
US9565202B1 (en) 2013-03-13 2017-02-07 Fireeye, Inc. System and method for detecting exfiltration content
CN105103496A (zh) 2013-03-14 2015-11-25 菲德利斯网络安全有限公司 用于提取和保存用于分析网络通信的元数据的系统和方法
US9311479B1 (en) 2013-03-14 2016-04-12 Fireeye, Inc. Correlation and consolidation of analytic data for holistic view of a malware attack
US9430646B1 (en) 2013-03-14 2016-08-30 Fireeye, Inc. Distributed systems and methods for automatically detecting unknown bots and botnets
US10713358B2 (en) 2013-03-15 2020-07-14 Fireeye, Inc. System and method to extract and utilize disassembly features to classify software intent
US9251343B1 (en) 2013-03-15 2016-02-02 Fireeye, Inc. Detecting bootkits resident on compromised computers
US8626912B1 (en) 2013-03-15 2014-01-07 Extrahop Networks, Inc. Automated passive discovery of applications
US8867343B2 (en) 2013-03-15 2014-10-21 Extrahop Networks, Inc. Trigger based recording of flows with play back
WO2014145805A1 (en) 2013-03-15 2014-09-18 Mandiant, Llc System and method employing structured intelligence to verify and contain threats at endpoints
US9094445B2 (en) 2013-03-15 2015-07-28 Centripetal Networks, Inc. Protecting networks from cyber attacks and overloading
US8619579B1 (en) * 2013-03-15 2013-12-31 Extrahop Networks, Inc. De-duplicating of packets in flows at layer 3
US9495180B2 (en) 2013-05-10 2016-11-15 Fireeye, Inc. Optimized resource allocation for virtual machines within a malware content detection system
US9635039B1 (en) 2013-05-13 2017-04-25 Fireeye, Inc. Classifying sets of malicious indicators for detecting command and control communications associated with malware
US10133863B2 (en) 2013-06-24 2018-11-20 Fireeye, Inc. Zero-day discovery system
US9536091B2 (en) 2013-06-24 2017-01-03 Fireeye, Inc. System and method for detecting time-bomb malware
US9888016B1 (en) 2013-06-28 2018-02-06 Fireeye, Inc. System and method for detecting phishing using password prediction
US9300686B2 (en) 2013-06-28 2016-03-29 Fireeye, Inc. System and method for detecting malicious links in electronic messages
US9282043B1 (en) 2013-09-24 2016-03-08 Juniper Networks, Inc. Trend-based flow aggregation for flow suppression
US9736179B2 (en) 2013-09-30 2017-08-15 Fireeye, Inc. System, apparatus and method for using malware analysis results to drive adaptive instrumentation of virtual machines to improve exploit detection
US10192052B1 (en) 2013-09-30 2019-01-29 Fireeye, Inc. System, apparatus and method for classifying a file as malicious using static scanning
US9171160B2 (en) 2013-09-30 2015-10-27 Fireeye, Inc. Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses
US10515214B1 (en) 2013-09-30 2019-12-24 Fireeye, Inc. System and method for classifying malware within content created during analysis of a specimen
US9690936B1 (en) 2013-09-30 2017-06-27 Fireeye, Inc. Multistage system and method for analyzing obfuscated content for malware
US9294501B2 (en) 2013-09-30 2016-03-22 Fireeye, Inc. Fuzzy hash of behavioral results
US9628507B2 (en) 2013-09-30 2017-04-18 Fireeye, Inc. Advanced persistent threat (APT) detection center
CN104579730A (zh) * 2013-10-18 2015-04-29 宁夏先锋软件有限公司 一种有效阻止威胁的网络攻击防护系统
US9921978B1 (en) 2013-11-08 2018-03-20 Fireeye, Inc. System and method for enhanced security of storage devices
US9189627B1 (en) 2013-11-21 2015-11-17 Fireeye, Inc. System, apparatus and method for conducting on-the-fly decryption of encrypted objects for malware detection
US10367827B2 (en) 2013-12-19 2019-07-30 Splunk Inc. Using network locations obtained from multiple threat lists to evaluate network data or machine data
US9756074B2 (en) 2013-12-26 2017-09-05 Fireeye, Inc. System and method for IPS and VM-based detection of suspicious objects
US9747446B1 (en) 2013-12-26 2017-08-29 Fireeye, Inc. System and method for run-time object classification
US9292686B2 (en) 2014-01-16 2016-03-22 Fireeye, Inc. Micro-virtualization architecture for threat-aware microvisor deployment in a node of a network environment
CA2938318C (en) * 2014-01-30 2023-10-03 Nasdaq, Inc. Systems and methods for continuous active data security
US9262635B2 (en) 2014-02-05 2016-02-16 Fireeye, Inc. Detection efficacy of virtual machine-based analysis with application specific events
US9973472B2 (en) 2015-04-02 2018-05-15 Varmour Networks, Inc. Methods and systems for orchestrating physical and virtual switches to enforce security boundaries
US9560081B1 (en) 2016-06-24 2017-01-31 Varmour Networks, Inc. Data network microsegmentation
US9544182B2 (en) * 2014-02-19 2017-01-10 Steven Waldbusser Monitoring gateway systems and methods for openflow type networks
US9241010B1 (en) 2014-03-20 2016-01-19 Fireeye, Inc. System and method for network behavior detection
US10242185B1 (en) 2014-03-21 2019-03-26 Fireeye, Inc. Dynamic guest image creation and rollback
US9591015B1 (en) 2014-03-28 2017-03-07 Fireeye, Inc. System and method for offloading packet processing and static analysis operations
US9223972B1 (en) 2014-03-31 2015-12-29 Fireeye, Inc. Dynamically remote tuning of a malware content detection system
US9432389B1 (en) 2014-03-31 2016-08-30 Fireeye, Inc. System, apparatus and method for detecting a malicious attack based on static analysis of a multi-flow object
US9438623B1 (en) 2014-06-06 2016-09-06 Fireeye, Inc. Computer exploit detection using heap spray pattern matching
US9973531B1 (en) 2014-06-06 2018-05-15 Fireeye, Inc. Shellcode detection
US9594912B1 (en) 2014-06-06 2017-03-14 Fireeye, Inc. Return-oriented programming detection
US10084813B2 (en) 2014-06-24 2018-09-25 Fireeye, Inc. Intrusion prevention and remedy system
US9398028B1 (en) 2014-06-26 2016-07-19 Fireeye, Inc. System, device and method for detecting a malicious attack based on communcations between remotely hosted virtual machines and malicious web servers
US10805340B1 (en) 2014-06-26 2020-10-13 Fireeye, Inc. Infection vector and malware tracking with an interactive user display
US10002252B2 (en) 2014-07-01 2018-06-19 Fireeye, Inc. Verification of trusted threat-aware microvisor
US9942250B2 (en) * 2014-08-06 2018-04-10 Norse Networks, Inc. Network appliance for dynamic protection from risky network activities
US9363280B1 (en) 2014-08-22 2016-06-07 Fireeye, Inc. System and method of detecting delivery of malware using cross-customer data
US9967283B2 (en) * 2014-09-14 2018-05-08 Sophos Limited Normalized indications of compromise
US20160088001A1 (en) * 2014-09-22 2016-03-24 Alcatel-Lucent Usa Inc. Collaborative deep packet inspection systems and methods
US10671726B1 (en) 2014-09-22 2020-06-02 Fireeye Inc. System and method for malware analysis using thread-level event monitoring
US10027689B1 (en) 2014-09-29 2018-07-17 Fireeye, Inc. Interactive infection visualization for improved exploit detection and signature generation for malware and malware families
US9773112B1 (en) 2014-09-29 2017-09-26 Fireeye, Inc. Exploit detection of malware and malware families
SG11201703164RA (en) 2014-10-21 2017-05-30 Ironnet Cybersecurity Inc Cybersecurity system
EP3222024A1 (en) * 2014-11-21 2017-09-27 Bluvector, Inc. System and method for network data characterization
US9690933B1 (en) 2014-12-22 2017-06-27 Fireeye, Inc. Framework for classifying an object as malicious with machine learning for deploying updated predictive models
KR101599213B1 (ko) * 2014-12-23 2016-03-04 주식회사 윈스 네트워크 보안 시스템에서 탐지규칙 제공 서비스 방법 및 시스템
US10075455B2 (en) 2014-12-26 2018-09-11 Fireeye, Inc. Zero-day rotating guest image profile
US9934376B1 (en) 2014-12-29 2018-04-03 Fireeye, Inc. Malware detection appliance architecture
US9838417B1 (en) 2014-12-30 2017-12-05 Fireeye, Inc. Intelligent context aware user interaction for malware detection
CN105827472B (zh) * 2015-01-04 2019-08-20 华为技术有限公司 网络数据流类型检测方法及装置
US9264370B1 (en) 2015-02-10 2016-02-16 Centripetal Networks, Inc. Correlating packets in communications networks
USD814494S1 (en) 2015-03-02 2018-04-03 Norse Networks, Inc. Computer display panel with an icon image of a live electronic threat intelligence visualization interface
US9609026B2 (en) 2015-03-13 2017-03-28 Varmour Networks, Inc. Segmented networks that implement scanning
US10178070B2 (en) 2015-03-13 2019-01-08 Varmour Networks, Inc. Methods and systems for providing security to distributed microservices
US9467476B1 (en) 2015-03-13 2016-10-11 Varmour Networks, Inc. Context aware microsegmentation
US10148693B2 (en) 2015-03-25 2018-12-04 Fireeye, Inc. Exploit detection system
US9690606B1 (en) 2015-03-25 2017-06-27 Fireeye, Inc. Selective system call monitoring
US9438613B1 (en) 2015-03-30 2016-09-06 Fireeye, Inc. Dynamic content activation for automated analysis of embedded objects
US10417031B2 (en) 2015-03-31 2019-09-17 Fireeye, Inc. Selective virtualization for security threat detection
US10474813B1 (en) 2015-03-31 2019-11-12 Fireeye, Inc. Code injection technique for remediation at an endpoint of a network
US9483644B1 (en) 2015-03-31 2016-11-01 Fireeye, Inc. Methods for detecting file altering malware in VM based analysis
US9525697B2 (en) 2015-04-02 2016-12-20 Varmour Networks, Inc. Delivering security functions to distributed networks
US9654485B1 (en) 2015-04-13 2017-05-16 Fireeye, Inc. Analytics-based security monitoring system and method
US9866576B2 (en) 2015-04-17 2018-01-09 Centripetal Networks, Inc. Rule-based network-threat detection
USD810775S1 (en) 2015-04-21 2018-02-20 Norse Networks, Inc. Computer display panel with a graphical live electronic threat intelligence visualization interface
US9594904B1 (en) 2015-04-23 2017-03-14 Fireeye, Inc. Detecting malware based on reflection
US9338147B1 (en) 2015-04-24 2016-05-10 Extrahop Networks, Inc. Secure communication secret sharing
KR101551729B1 (ko) * 2015-05-22 2015-09-10 (주) 위즈네트 인터넷 공격에 안전한 통신 칩셋 및 통신 장치
US10063446B2 (en) 2015-06-26 2018-08-28 Intel Corporation Netflow collection and export offload using network silicon
US10642753B1 (en) 2015-06-30 2020-05-05 Fireeye, Inc. System and method for protecting a software component running in virtual machine using a virtualization layer
US9923914B2 (en) 2015-06-30 2018-03-20 Norse Networks, Inc. Systems and platforms for intelligently monitoring risky network activities
US11113086B1 (en) 2015-06-30 2021-09-07 Fireeye, Inc. Virtual system and method for securing external network connectivity
US10454950B1 (en) 2015-06-30 2019-10-22 Fireeye, Inc. Centralized aggregation technique for detecting lateral movement of stealthy cyber-attacks
US10726127B1 (en) 2015-06-30 2020-07-28 Fireeye, Inc. System and method for protecting a software component running in a virtual machine through virtual interrupts by the virtualization layer
TWI583152B (zh) * 2015-08-14 2017-05-11 緯創資通股份有限公司 適用於異質網路架構的異常預測方法及系統
US10715542B1 (en) 2015-08-14 2020-07-14 Fireeye, Inc. Mobile application risk analysis
US9483317B1 (en) 2015-08-17 2016-11-01 Varmour Networks, Inc. Using multiple central processing unit cores for packet forwarding in virtualized networks
CN204948505U (zh) * 2015-09-18 2016-01-06 京东方科技集团股份有限公司 一种柔性基板和显示装置
US10176321B2 (en) 2015-09-22 2019-01-08 Fireeye, Inc. Leveraging behavior-based rules for malware family classification
US10033747B1 (en) 2015-09-29 2018-07-24 Fireeye, Inc. System and method for detecting interpreter-based exploit attacks
US10706149B1 (en) 2015-09-30 2020-07-07 Fireeye, Inc. Detecting delayed activation malware using a primary controller and plural time controllers
US9825976B1 (en) 2015-09-30 2017-11-21 Fireeye, Inc. Detection and classification of exploit kits
US10817606B1 (en) 2015-09-30 2020-10-27 Fireeye, Inc. Detecting delayed activation malware using a run-time monitoring agent and time-dilation logic
US10601865B1 (en) 2015-09-30 2020-03-24 Fireeye, Inc. Detection of credential spearphishing attacks using email analysis
US9825989B1 (en) 2015-09-30 2017-11-21 Fireeye, Inc. Cyber attack early warning system
US10210329B1 (en) 2015-09-30 2019-02-19 Fireeye, Inc. Method to detect application execution hijacking using memory protection
US10284575B2 (en) 2015-11-10 2019-05-07 Fireeye, Inc. Launcher for setting analysis environment variations for malware detection
FR3043872B1 (fr) * 2015-11-12 2019-05-24 Qosmos Tech Analyse asynchrone d'un flux de donnees
WO2017082918A1 (en) * 2015-11-13 2017-05-18 Hewlett Packard Enterprise Development Lp Redirecting flow control packets
US9825911B1 (en) * 2015-11-18 2017-11-21 Amazon Technologies, Inc. Security policy check based on communication establishment handshake packet
US10846117B1 (en) 2015-12-10 2020-11-24 Fireeye, Inc. Technique for establishing secure communication between host and guest processes of a virtualization architecture
US10447728B1 (en) 2015-12-10 2019-10-15 Fireeye, Inc. Technique for protecting guest processes using a layered virtualization architecture
US10108446B1 (en) 2015-12-11 2018-10-23 Fireeye, Inc. Late load technique for deploying a virtualization layer underneath a running operating system
US9917856B2 (en) 2015-12-23 2018-03-13 Centripetal Networks, Inc. Rule-based network-threat detection for encrypted communications
US10075416B2 (en) 2015-12-30 2018-09-11 Juniper Networks, Inc. Network session data sharing
US10050998B1 (en) 2015-12-30 2018-08-14 Fireeye, Inc. Malicious message analysis system
US10133866B1 (en) 2015-12-30 2018-11-20 Fireeye, Inc. System and method for triggering analysis of an object for malware in response to modification of that object
US10621338B1 (en) 2015-12-30 2020-04-14 Fireeye, Inc. Method to detect forgery and exploits using last branch recording registers
US10565378B1 (en) 2015-12-30 2020-02-18 Fireeye, Inc. Exploit of privilege detection framework
CN105681211B (zh) * 2015-12-31 2020-07-28 北京安天网络安全技术有限公司 基于信息萃取的流量记录方法和系统
US10581874B1 (en) 2015-12-31 2020-03-03 Fireeye, Inc. Malware detection system with contextual analysis
US9824216B1 (en) 2015-12-31 2017-11-21 Fireeye, Inc. Susceptible environment detection system
US11552986B1 (en) 2015-12-31 2023-01-10 Fireeye Security Holdings Us Llc Cyber-security framework for application of virtual features
US11729144B2 (en) 2016-01-04 2023-08-15 Centripetal Networks, Llc Efficient packet capture for cyber threat analysis
US10204211B2 (en) 2016-02-03 2019-02-12 Extrahop Networks, Inc. Healthcare operations with passive network monitoring
US10243971B2 (en) * 2016-03-25 2019-03-26 Arbor Networks, Inc. System and method for retrospective network traffic analysis
US10601863B1 (en) 2016-03-25 2020-03-24 Fireeye, Inc. System and method for managing sensor enrollment
US10785255B1 (en) 2016-03-25 2020-09-22 Fireeye, Inc. Cluster configuration within a scalable malware detection system
US10671721B1 (en) 2016-03-25 2020-06-02 Fireeye, Inc. Timeout management services
US10616266B1 (en) 2016-03-25 2020-04-07 Fireeye, Inc. Distributed malware detection system and submission workflow thereof
US10893059B1 (en) 2016-03-31 2021-01-12 Fireeye, Inc. Verification and enhancement using detection systems located at the network periphery and endpoint devices
US10169585B1 (en) 2016-06-22 2019-01-01 Fireeye, Inc. System and methods for advanced malware detection through placement of transition events
WO2017220139A1 (en) * 2016-06-22 2017-12-28 Huawei Technologies Co., Ltd. System and method for detecting and preventing network intrusion of malicious data flows
US9787639B1 (en) 2016-06-24 2017-10-10 Varmour Networks, Inc. Granular segmentation using events
US10462173B1 (en) 2016-06-30 2019-10-29 Fireeye, Inc. Malware detection verification and enhancement by coordinating endpoint and malware detection systems
JP6781109B2 (ja) * 2016-07-06 2020-11-04 日本電信電話株式会社 トラヒック制御装置および方法
US9729416B1 (en) 2016-07-11 2017-08-08 Extrahop Networks, Inc. Anomaly detection using device relationship graphs
US9910993B2 (en) 2016-07-14 2018-03-06 IronNet Cybersecurity, Inc. Simulation and virtual reality based cyber behavioral systems
US10536476B2 (en) 2016-07-21 2020-01-14 Sap Se Realtime triggering framework
CN107645478B (zh) 2016-07-22 2020-12-22 阿里巴巴集团控股有限公司 网络攻击防御系统、方法及装置
US9660879B1 (en) 2016-07-25 2017-05-23 Extrahop Networks, Inc. Flow deduplication across a cluster of network monitoring devices
US10482241B2 (en) 2016-08-24 2019-11-19 Sap Se Visualization of data distributed in multiple dimensions
US10542016B2 (en) * 2016-08-31 2020-01-21 Sap Se Location enrichment in enterprise threat detection
US11349852B2 (en) * 2016-08-31 2022-05-31 Wedge Networks Inc. Apparatus and methods for network-based line-rate detection of unknown malware
US10592678B1 (en) 2016-09-09 2020-03-17 Fireeye, Inc. Secure communications between peers using a verified virtual trusted platform module
US10673879B2 (en) 2016-09-23 2020-06-02 Sap Se Snapshot of a forensic investigation for enterprise threat detection
US10630705B2 (en) 2016-09-23 2020-04-21 Sap Se Real-time push API for log events in enterprise threat detection
US10491627B1 (en) 2016-09-29 2019-11-26 Fireeye, Inc. Advanced malware detection using similarity analysis
US10795991B1 (en) 2016-11-08 2020-10-06 Fireeye, Inc. Enterprise search
US10587647B1 (en) 2016-11-22 2020-03-10 Fireeye, Inc. Technique for malware detection capability comparison of network security devices
WO2018097422A1 (ko) * 2016-11-24 2018-05-31 성균관대학교 산학협력단 네트워크 보안 기능에 의해 트리거되는 트래픽 스티어링을 위한 방법 및 시스템, 이를 위한 장치
US10534908B2 (en) 2016-12-06 2020-01-14 Sap Se Alerts based on entities in security information and event management products
US10530792B2 (en) 2016-12-15 2020-01-07 Sap Se Using frequency analysis in enterprise threat detection to detect intrusions in a computer system
US10534907B2 (en) 2016-12-15 2020-01-14 Sap Se Providing semantic connectivity between a java application server and enterprise threat detection system using a J2EE data
US11470094B2 (en) 2016-12-16 2022-10-11 Sap Se Bi-directional content replication logic for enterprise threat detection
US10552605B2 (en) 2016-12-16 2020-02-04 Sap Se Anomaly detection in enterprise threat detection
US10764306B2 (en) 2016-12-19 2020-09-01 Sap Se Distributing cloud-computing platform content to enterprise threat detection systems
US10552610B1 (en) 2016-12-22 2020-02-04 Fireeye, Inc. Adaptive virtual machine snapshot update framework for malware behavioral analysis
US10581879B1 (en) 2016-12-22 2020-03-03 Fireeye, Inc. Enhanced malware detection for generated objects
US10523609B1 (en) 2016-12-27 2019-12-31 Fireeye, Inc. Multi-vector malware detection and analysis
JP6602799B2 (ja) * 2017-01-26 2019-11-06 日本電信電話株式会社 セキュリティ監視サーバ、セキュリティ監視方法、プログラム
US10397258B2 (en) 2017-01-30 2019-08-27 Microsoft Technology Licensing, Llc Continuous learning for intrusion detection
CN106790292A (zh) * 2017-03-13 2017-05-31 摩贝（上海）生物科技有限公司 基于行为特征匹配和分析的web应用层攻击检测与防御方法
US10581802B2 (en) * 2017-03-16 2020-03-03 Keysight Technologies Singapore (Sales) Pte. Ltd. Methods, systems, and computer readable media for advertising network security capabilities
US10476673B2 (en) 2017-03-22 2019-11-12 Extrahop Networks, Inc. Managing session secrets for continuous packet capture systems
US10904286B1 (en) 2017-03-24 2021-01-26 Fireeye, Inc. Detection of phishing attacks using similarity analysis
US10798112B2 (en) 2017-03-30 2020-10-06 Fireeye, Inc. Attribute-controlled malware detection
US10791138B1 (en) 2017-03-30 2020-09-29 Fireeye, Inc. Subscription-based malware detection
US10848397B1 (en) 2017-03-30 2020-11-24 Fireeye, Inc. System and method for enforcing compliance with subscription requirements for cyber-attack detection service
US10902119B1 (en) 2017-03-30 2021-01-26 Fireeye, Inc. Data extraction system for malware analysis
JP6721542B2 (ja) * 2017-06-09 2020-07-15 日本電信電話株式会社 トラヒック制御装置、方法、およびプログラム
US10503904B1 (en) 2017-06-29 2019-12-10 Fireeye, Inc. Ransomware detection and mitigation
US10855700B1 (en) 2017-06-29 2020-12-01 Fireeye, Inc. Post-intrusion detection of cyber-attacks during lateral movement within networks
US10601848B1 (en) 2017-06-29 2020-03-24 Fireeye, Inc. Cyber-security system and method for weak indicator detection and correlation to generate strong indicators
US10893068B1 (en) 2017-06-30 2021-01-12 Fireeye, Inc. Ransomware file modification prevention technique
US10530794B2 (en) 2017-06-30 2020-01-07 Sap Se Pattern creation in enterprise threat detection
US10503899B2 (en) 2017-07-10 2019-12-10 Centripetal Networks, Inc. Cyberanalysis workflow acceleration
US11233777B2 (en) 2017-07-24 2022-01-25 Centripetal Networks, Inc. Efficient SSL/TLS proxy
US10284526B2 (en) 2017-07-24 2019-05-07 Centripetal Networks, Inc. Efficient SSL/TLS proxy
US10263863B2 (en) 2017-08-11 2019-04-16 Extrahop Networks, Inc. Real-time configuration discovery and management
US10063434B1 (en) 2017-08-29 2018-08-28 Extrahop Networks, Inc. Classifying applications or activities based on network behavior
US10747872B1 (en) 2017-09-27 2020-08-18 Fireeye, Inc. System and method for preventing malware evasion
US10805346B2 (en) 2017-10-01 2020-10-13 Fireeye, Inc. Phishing attack detection
US9967292B1 (en) 2017-10-25 2018-05-08 Extrahop Networks, Inc. Inline secret sharing
US11108809B2 (en) 2017-10-27 2021-08-31 Fireeye, Inc. System and method for analyzing binary code for malware classification using artificial neural network techniques
US10986111B2 (en) 2017-12-19 2021-04-20 Sap Se Displaying a series of events along a time axis in enterprise threat detection
US10681064B2 (en) 2017-12-19 2020-06-09 Sap Se Analysis of complex relationships among information technology security-relevant entities using a network graph
RU2697698C2 (ru) * 2017-12-27 2019-08-16 Общество с ограниченной ответственностью "АСП Лабс" Способ обработки сетевого трафика с использованием межсетевого экранирования
RU2691192C1 (ru) * 2017-12-27 2019-06-11 Общество с ограниченной ответственностью "АСП Лабс" Система межсетевого экранирования
US11271955B2 (en) 2017-12-28 2022-03-08 Fireeye Security Holdings Us Llc Platform and method for retroactive reclassification employing a cybersecurity-based global data store
US11240275B1 (en) 2017-12-28 2022-02-01 Fireeye Security Holdings Us Llc Platform and method for performing cybersecurity analyses employing an intelligence hub with a modular architecture
US11005860B1 (en) 2017-12-28 2021-05-11 Fireeye, Inc. Method and system for efficient cybersecurity analysis of endpoint events
US11347871B2 (en) * 2018-01-16 2022-05-31 International Business Machines Corporation Dynamic cybersecurity protection mechanism for data storage devices
CA3058867C (en) * 2018-01-17 2021-01-05 Mkit North America Inc. Device and method for securing a network connection
US10764309B2 (en) 2018-01-31 2020-09-01 Palo Alto Networks, Inc. Context profiling for malware detection
US11159538B2 (en) 2018-01-31 2021-10-26 Palo Alto Networks, Inc. Context for malware forensics and detection
US10264003B1 (en) 2018-02-07 2019-04-16 Extrahop Networks, Inc. Adaptive network monitoring with tuneable elastic granularity
US10389574B1 (en) 2018-02-07 2019-08-20 Extrahop Networks, Inc. Ranking alerts based on network monitoring
US10038611B1 (en) 2018-02-08 2018-07-31 Extrahop Networks, Inc. Personalization of alerts based on network monitoring
US10270794B1 (en) 2018-02-09 2019-04-23 Extrahop Networks, Inc. Detection of denial of service attacks
US10826931B1 (en) 2018-03-29 2020-11-03 Fireeye, Inc. System and method for predicting and mitigating cybersecurity system misconfigurations
US11003773B1 (en) 2018-03-30 2021-05-11 Fireeye, Inc. System and method for automatically generating malware detection rule recommendations
US10956477B1 (en) 2018-03-30 2021-03-23 Fireeye, Inc. System and method for detecting malicious scripts through natural language processing modeling
US11558401B1 (en) 2018-03-30 2023-01-17 Fireeye Security Holdings Us Llc Multi-vector malware detection data sharing system for improved detection
CN111819558A (zh) * 2018-04-30 2020-10-23 慧与发展有限责任合伙企业 更新三元内容可寻址存储器中的正则表达式模式组
US10116679B1 (en) 2018-05-18 2018-10-30 Extrahop Networks, Inc. Privilege inference and monitoring based on network behavior
US10862866B2 (en) 2018-06-26 2020-12-08 Oracle International Corporation Methods, systems, and computer readable media for multiple transaction capabilities application part (TCAP) operation code (opcode) screening
US11314859B1 (en) 2018-06-27 2022-04-26 FireEye Security Holdings, Inc. Cyber-security system and method for detecting escalation of privileges within an access token
US11075930B1 (en) 2018-06-27 2021-07-27 Fireeye, Inc. System and method for detecting repetitive cybersecurity attacks constituting an email campaign
US11228491B1 (en) 2018-06-28 2022-01-18 Fireeye Security Holdings Us Llc System and method for distributed cluster configuration monitoring and management
US11316900B1 (en) 2018-06-29 2022-04-26 FireEye Security Holdings Inc. System and method for automatically prioritizing rules for cyber-threat detection and mitigation
US10333898B1 (en) * 2018-07-09 2019-06-25 Centripetal Networks, Inc. Methods and systems for efficient network protection
US10411978B1 (en) 2018-08-09 2019-09-10 Extrahop Networks, Inc. Correlating causes and effects associated with network activity
US10594718B1 (en) 2018-08-21 2020-03-17 Extrahop Networks, Inc. Managing incident response operations based on monitored network activity
US11182473B1 (en) 2018-09-13 2021-11-23 Fireeye Security Holdings Us Llc System and method for mitigating cyberattacks against processor operability by a guest process
US11763004B1 (en) 2018-09-27 2023-09-19 Fireeye Security Holdings Us Llc System and method for bootkit detection
US11245667B2 (en) * 2018-10-23 2022-02-08 Akamai Technologies, Inc. Network security system with enhanced traffic analysis based on feedback loop and low-risk domain identification
US11368475B1 (en) 2018-12-21 2022-06-21 Fireeye Security Holdings Us Llc System and method for scanning remote services to locate stored objects with malware
US11308209B2 (en) 2019-01-18 2022-04-19 Cobalt Iron, Inc. Data protection automatic optimization system and method
US11063907B2 (en) 2019-01-18 2021-07-13 Cobalt Iron, Inc. Data protection automatic optimization system and method
US11212304B2 (en) 2019-01-18 2021-12-28 Cobalt Iron, Inc. Data protection automatic optimization system and method
CN110099058B (zh) * 2019-05-06 2021-08-13 江苏亨通工控安全研究院有限公司 Modbus报文检测方法、装置、电子设备及存储介质
JP6801046B2 (ja) * 2019-05-28 2020-12-16 ホアウェイ・テクノロジーズ・カンパニー・リミテッド 悪意があるデータフローのネットワーク侵入を検知および防止するシステムおよび方法
US10965702B2 (en) 2019-05-28 2021-03-30 Extrahop Networks, Inc. Detecting injection attacks using passive network monitoring
US11258806B1 (en) 2019-06-24 2022-02-22 Mandiant, Inc. System and method for automatically associating cybersecurity intelligence to cyberthreat actors
US11556640B1 (en) 2019-06-27 2023-01-17 Mandiant, Inc. Systems and methods for automated cybersecurity analysis of extracted binary string sets
US11392700B1 (en) 2019-06-28 2022-07-19 Fireeye Security Holdings Us Llc System and method for supporting cross-platform data verification
US11165814B2 (en) 2019-07-29 2021-11-02 Extrahop Networks, Inc. Modifying triage information based on network monitoring
US11388072B2 (en) 2019-08-05 2022-07-12 Extrahop Networks, Inc. Correlating network traffic that crosses opaque endpoints
US10742530B1 (en) 2019-08-05 2020-08-11 Extrahop Networks, Inc. Correlating network traffic that crosses opaque endpoints
US10742677B1 (en) 2019-09-04 2020-08-11 Extrahop Networks, Inc. Automatic determination of user roles and asset types based on network monitoring
US11533329B2 (en) 2019-09-27 2022-12-20 Keysight Technologies, Inc. Methods, systems and computer readable media for threat simulation and threat mitigation recommendations
US11886585B1 (en) 2019-09-27 2024-01-30 Musarubra Us Llc System and method for identifying and mitigating cyberattacks through malicious position-independent code execution
US11637862B1 (en) 2019-09-30 2023-04-25 Mandiant, Inc. System and method for surfacing cyber-security threats with a self-learning recommendation engine
US11165823B2 (en) 2019-12-17 2021-11-02 Extrahop Networks, Inc. Automated preemptive polymorphic deception
EP4218212A1 (en) 2020-09-23 2023-08-02 ExtraHop Networks, Inc. Monitoring encrypted network traffic
US11463466B2 (en) 2020-09-23 2022-10-04 Extrahop Networks, Inc. Monitoring encrypted network traffic
US11362996B2 (en) 2020-10-27 2022-06-14 Centripetal Networks, Inc. Methods and systems for efficient adaptive logging of cyber threat incidents
US11201887B1 (en) * 2021-03-23 2021-12-14 Lookingglass Cyber Solutions, Inc. Systems and methods for low latency stateful threat detection and mitigation
US11159546B1 (en) 2021-04-20 2021-10-26 Centripetal Networks, Inc. Methods and systems for efficient threat context-aware packet filtering for network protection
KR102328879B1 (ko) * 2021-06-10 2021-11-22 (주)시큐레이어 학습 데이터의 불균형 상황에서 이상 웹로그를 탐지할 수 있도록 하는 비지도 학습 방법 및 학습 장치, 그리고 이를 이용한 테스트 방법 및 테스트 장치
US11349861B1 (en) 2021-06-18 2022-05-31 Extrahop Networks, Inc. Identifying network entities based on beaconing activity
CN113596050B (zh) * 2021-08-04 2023-06-30 四川英得赛克科技有限公司 异常流量的分离过滤方法、系统、存储介质及电子设备
US11296967B1 (en) 2021-09-23 2022-04-05 Extrahop Networks, Inc. Combining passive network analysis and active probing
US11843606B2 (en) 2022-03-30 2023-12-12 Extrahop Networks, Inc. Detecting abnormal data access based on data similarity

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1216657A (zh) * 1996-04-24 1999-05-12 北方电讯有限公司 互联网协议过滤器
CN1253685A (zh) * 1997-03-11 2000-05-17 西格技术公司 管理因特网和企业内部网活动的方法和装置
CN1363171A (zh) * 2000-02-10 2002-08-07 第八特许科技公司 在互联网的服务器与具芯片卡的终端间传送数据的方法
CN1363172A (zh) * 2000-02-10 2002-08-07 第八特许科技公司 通过互联网传送多媒体数据的管理方法及实施该方法所用的芯片卡

Family Cites Families (45)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5813001A (en) 1993-10-22 1998-09-22 Nodel Corporation Method for performing optimized intelligent searches of knowledge bases using submaps associated with search objects
US5835726A (en) 1993-12-15 1998-11-10 Check Point Software Technologies Ltd. System for securing the flow of and selectively modifying packets in a computer network
US5802320A (en) 1995-05-18 1998-09-01 Sun Microsystems, Inc. System for packet filtering of data packets at a computer network interface
US6453345B2 (en) * 1996-11-06 2002-09-17 Datadirect Networks, Inc. Network security and surveillance system
US6134591A (en) 1997-06-18 2000-10-17 Client/Server Technologies, Inc. Network security and integration method and system
US6279113B1 (en) 1998-03-16 2001-08-21 Internet Tools, Inc. Dynamic signature inspection-based network intrusion detection
US6738814B1 (en) * 1998-03-18 2004-05-18 Cisco Technology, Inc. Method for blocking denial of service and address spoofing attacks on a private network
US6725378B1 (en) * 1998-04-15 2004-04-20 Purdue Research Foundation Network protection for denial of service attacks
US6625650B2 (en) * 1998-06-27 2003-09-23 Intel Corporation System for multi-layer broadband provisioning in computer networks
US6269447B1 (en) 1998-07-21 2001-07-31 Raytheon Company Information security analysis system
US6219706B1 (en) * 1998-10-16 2001-04-17 Cisco Technology, Inc. Access control for networks
US6321338B1 (en) * 1998-11-09 2001-11-20 Sri International Network surveillance
US6550012B1 (en) 1998-12-11 2003-04-15 Network Associates, Inc. Active firewall system and methodology
US6499107B1 (en) * 1998-12-29 2002-12-24 Cisco Technology, Inc. Method and system for adaptive network security using intelligent packet analysis
US6611875B1 (en) * 1998-12-31 2003-08-26 Pmc-Sierra, Inc. Control system for high speed rule processors
US6477651B1 (en) 1999-01-08 2002-11-05 Cisco Technology, Inc. Intrusion detection system and method having dynamically loaded signatures
US6963912B1 (en) 1999-06-28 2005-11-08 Xacct Technologies, Ltd. Method and apparatus for session reconstruction
CN100384180C (zh) * 1999-06-30 2008-04-23 倾向探测公司 用于监控网络流量的方法和设备
US6901517B1 (en) 1999-07-16 2005-05-31 Marconi Communications, Inc. Hardware based security groups, firewall load sharing, and firewall redundancy
US6735702B1 (en) 1999-08-31 2004-05-11 Intel Corporation Method and system for diagnosing network intrusion
US6988238B1 (en) * 2000-01-24 2006-01-17 Ati Technologies, Inc. Method and system for handling errors and a system for receiving packet stream data
US6553377B1 (en) 2000-03-31 2003-04-22 Network Associates, Inc. System and process for maintaining a plurality of remote security applications using a modular framework in a distributed computing environment
US6519703B1 (en) 2000-04-14 2003-02-11 James B. Joyce Methods and apparatus for heuristic firewall
KR20010090014A (ko) * 2000-05-09 2001-10-18 김대연 네트워크 보호 시스템
US7089303B2 (en) 2000-05-31 2006-08-08 Invicta Networks, Inc. Systems and methods for distributed network protection
AU2001281150A1 (en) 2000-08-07 2002-02-18 Xacct Technologies Limited System, method and computer program product for processing network accounting information
AU2001281401A1 (en) 2000-08-18 2002-03-04 Invicta Networks, Inc. Systems and methods for distributed network protection
US6381242B1 (en) * 2000-08-29 2002-04-30 Netrake Corporation Content processor
US20020032871A1 (en) * 2000-09-08 2002-03-14 The Regents Of The University Of Michigan Method and system for detecting, tracking and blocking denial of service attacks over a computer network
WO2002045380A2 (en) * 2000-11-30 2002-06-06 Lancope, Inc. Flow-based detection of network intrusions
US20020116639A1 (en) 2001-02-21 2002-08-22 International Business Machines Corporation Method and apparatus for providing a business service for the detection, notification, and elimination of computer viruses
JP3731111B2 (ja) * 2001-02-23 2006-01-05 三菱電機株式会社 侵入検出装置およびシステムならびにルータ
KR20020072618A (ko) * 2001-03-12 2002-09-18 (주)세보아 네트워크 기반 침입탐지 시스템
JP2002342279A (ja) * 2001-03-13 2002-11-29 Fujitsu Ltd フィルタリング装置、フィルタリング方法およびこの方法をコンピュータに実行させるプログラム
US6816455B2 (en) 2001-05-09 2004-11-09 Telecom Italia S.P.A. Dynamic packet filter utilizing session tracking
US6513122B1 (en) 2001-06-29 2003-01-28 Networks Associates Technology, Inc. Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilities
KR100424724B1 (ko) * 2001-07-27 2004-03-27 김상욱 네트워크 흐름 분석에 의한 침입 탐지 장치
US20030135749A1 (en) 2001-10-31 2003-07-17 Gales George S. System and method of defining the security vulnerabilities of a computer system
US20030159060A1 (en) 2001-10-31 2003-08-21 Gales George S. System and method of defining the security condition of a computer system
US7174566B2 (en) 2002-02-01 2007-02-06 Intel Corporation Integrated network intrusion detection
US8370936B2 (en) 2002-02-08 2013-02-05 Juniper Networks, Inc. Multi-method gateway-based network security systems and methods
US6654882B1 (en) 2002-05-24 2003-11-25 Rackspace, Ltd Network security system protecting against disclosure of information to unauthorized agents
US6741595B2 (en) * 2002-06-11 2004-05-25 Netrake Corporation Device for enabling trap and trace of internet protocol communications
KR20020075319A (ko) * 2002-07-19 2002-10-04 주식회사 싸이버텍홀딩스 지능형 보안 엔진과 이를 포함하는 지능형 통합 보안 시스템
US7356585B1 (en) * 2003-04-04 2008-04-08 Raytheon Company Vertically extensible intrusion detection system and method

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1216657A (zh) * 1996-04-24 1999-05-12 北方电讯有限公司 互联网协议过滤器
US6128298A (en) * 1996-04-24 2000-10-03 Nortel Networks Corporation Internet protocol filter
CN1253685A (zh) * 1997-03-11 2000-05-17 西格技术公司 管理因特网和企业内部网活动的方法和装置
CN1363171A (zh) * 2000-02-10 2002-08-07 第八特许科技公司 在互联网的服务器与具芯片卡的终端间传送数据的方法
CN1363172A (zh) * 2000-02-10 2002-08-07 第八特许科技公司 通过互联网传送多媒体数据的管理方法及实施该方法所用的芯片卡

Also Published As

Publication number Publication date
AU2003290674A1 (en) 2004-06-03
AU2003290674A8 (en) 2004-06-03
EP1558937B1 (en) 2011-08-24
US7454499B2 (en) 2008-11-18
US7454792B2 (en) 2008-11-18
CN1720459A (zh) 2006-01-11
KR20050086441A (ko) 2005-08-30
JP2006506853A (ja) 2006-02-23
KR20100132079A (ko) 2010-12-16
WO2004045126A2 (en) 2004-05-27
KR101111433B1 (ko) 2012-02-17
KR101045362B1 (ko) 2011-06-30
EP1558937A4 (en) 2009-01-28
US20050044422A1 (en) 2005-02-24
AR042020A1 (es) 2005-06-08
US20050028013A1 (en) 2005-02-03
JP2010268483A (ja) 2010-11-25
WO2004045126A3 (en) 2004-12-02
EP1558937A2 (en) 2005-08-03
US7451489B2 (en) 2008-11-11
US20040093513A1 (en) 2004-05-13

Similar Documents

Publication Publication Date Title
CN100443910C (zh) 主动网络防护系统与方法
Gaddam et al. An analysis of various snort based techniques to detect and prevent intrusions in networks proposal with code refactoring snort tool in Kali Linux environment
KR100684602B1 (ko) 세션 상태전이를 이용한 시나리오 기반 침입대응 시스템 및그 방법
KR102501372B1 (ko) Ai 기반 이상징후 침입 탐지 및 대응 시스템
WO2005026872A2 (en) Internal lan perimeter security appliance composed of a pci card and complementary software
Stanciu Technologies, methodologies and challenges in network intrusion detection and prevention systems.
Mallissery et al. Survey on intrusion detection methods
Ahmed et al. Characterizing strengths of snort-based IDPS
Mishra et al. Artificial intelligent firewall
CN113206852A (zh) 一种安全防护方法、装置、设备及存储介质
Rizvi et al. A review on intrusion detection system
Cansian et al. An attack signature model to computer security intrusion detection
Sourour et al. Collaboration between security devices toward improving network defense
Rodas et al. A novel classification-based hybrid ids
Mohammed DESIGNING RULES TO IMPLEMENT RECONNAISSANCE AND UNAUTHORIZED ACCESS ATTACKS FOR INTRUSION DETECTION SYSTEM
Suhag Paradigmatic Approaches for Network Security and Preventing Intrusions: A Secure Computer Shield
Asgharian et al. Intrusion Response System for SIP based Applications with Engineered Feature Set
Cisar et al. Intrusion detection-one of the security methods
Hooper An intelligent detection and response strategy to false positives and network attacks: operation of network quarantine channels and feedback methods to IDS
Nakato Networks security: attacks and defense mechanism by designing an intelligent firewall agent
KR20050063477A (ko) 네트워크 정보에 대한 보안 시스템 및 그 방법
Agrawal et al. Analysis of Intrusion Detection System Using Trusted Clients
CN116232613A (zh) 一种轨道交通网络零信任的保护方法
CN113691501A (zh) 一种网络安全系统及安全方法
Dwivedi et al. A Real Time Host and Network Mobile Agent based Intrusion Detection System (HNMAIDS)

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
ASS Succession or assignment of patent right

Owner name: HEWLETT PACKARD DEVELOPMENT CO., LLP

Free format text: FORMER OWNER: TIPPINGPOINT TECHNOLOGIES INC.

Effective date: 20150814

C41 Transfer of patent application or patent right or utility model
TR01 Transfer of patent right

Effective date of registration: 20150814

Address after: American Texas

Patentee after: Hewlett-Packard Development Company, Limited Liability Partnership

Address before: American Texas

Patentee before: Tippingpoint Technologies Inc.

CF01 Termination of patent right due to non-payment of annual fee
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20081217

Termination date: 20161107