US20070209070A1 - Integrated network intrusion detection - Google Patents
Integrated network intrusion detection Download PDFInfo
- Publication number
- US20070209070A1 US20070209070A1 US11/702,908 US70290807A US2007209070A1 US 20070209070 A1 US20070209070 A1 US 20070209070A1 US 70290807 A US70290807 A US 70290807A US 2007209070 A1 US2007209070 A1 US 2007209070A1
- Authority
- US
- United States
- Prior art keywords
- application
- network
- monitoring
- invoked
- intrusion
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
- H04L63/0218—Distributed architectures, e.g. distributed firewalls
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Telephonic Communication Services (AREA)
Abstract
Intrusion preludes may be detected (including detection using fabricated responses to blocked network requests), and particular sources of network communications may be singled out for greater scrutiny, by performing intrusion analysis on packets blocked by a firewall. An integrated intrusion detection system uses an end-node firewall that is dynamically controlled using invoked-application information and a network policy. The system may use various alert levels to trigger heightened monitoring states, alerts sent to a security operation center, and/or logging of network activity for later forensic analysis. The system may monitor network traffic to block traffic that violates the network policy, monitor blocked traffic to detect an intrusion prelude, and monitor traffic from a potential intruder when an intrusion prelude is detected. The system also may track behavior of applications using the network policy to identify abnormal application behavior, and monitor traffic from an abnormally behaving application to identify an intrusion.
Description
- This application is a continuation application of and claims priority to U.S. patent application Ser. No. 10/066,140, filed Feb. 1, 2002. The disclosure of the prior application is considered part of (and is incorporated by reference in) the disclosure of this application.
- The present application describes systems and techniques relating to network intrusion detection, for example, integrated network intrusion detection.
- A machine network is a collection of nodes coupled together with wired and/or wireless communication links, such as coax cable, fiber optics and radio frequency bands. A machine network may be a single network or a collection of networks (e.g., an internetwork), and may use multiple networking protocols, including internetworking protocols (e.g., Internet Protocol (IP)). These protocols define the manner in which information is prepared for transmission through the network, and typically involve breaking data into segments generically known as packets (e.g., IP packets, ATM (Asynchronous Transfer Mode) cells) for transmission. A node may be any machine capable of communicating with other nodes over the communication links using one or more of the networking protocols.
- These networking protocols are typically organized by a network architecture having multiple layers, where each layer provides communication services to the layer above it. A layered network architecture is commonly referred to as a protocol stack or network stack, where each layer of the stack has one or more protocols that provide specific services. The protocols may include shared-line protocols such as in Ethernet networks, connection-oriented switching protocols such as in ATM networks, and/or connectionless packet-switched protocols such as in IP.
- As packets travel through a network, they are typically encapsulated within other packets multiple times. Encapsulation enables data to travel from a source process on one node to a destination process on another node, through multiple networks using different protocols and addressing schemes, without the two end nodes knowing anything about the intermediate addressing schemes and protocols.
- Machine networks may provide powerful communication capabilities, but also may increase the difficulty of maintaining computer system security by making systems and data more accessible. Most networks are susceptible to attacks or improper use, both from inside and unauthorized access to data, destroy or bring down a computer system, prevent others from accessing a system and attempts to take control of a system. For example, some network intrusions exploit application anomalies to gain access to a system and infect it with a computer virus, such as Code Red or Nimba.
- A common technique used to improve network security is to install a firewall, which restricts and controls the flow of traffic between networks, typically between an enterprise network and the Internet. Firewalls typically monitor incoming and outgoing traffic and filter, redirect, repackage and/or discard packets. A firewall may serve as a proxy and may enforce an organization's security policies.
- Frequently, network administrators employ systems to detect network intrusions to improve network security. Traditional network intrusion detection (NID) systems attempt to examine every packet on a network in order to detect intrusions. These NID systems may be implemented as standalone systems (e.g., NFR (Network Flight Recorder), provided by Cisco Systems, Inc. of San Jose, Calif.), or they may be implemented as distributed node-based systems (e.g., BlackICE, provided by Network Ice Corporation of San Mateo California).
-
FIG. 1 is a combined flowchart and state diagram illustrating a method of monitoring network traffic to detect intrusions. -
FIG. 2A is a block diagram illustrating a system implementing integrated network intrusion detection. -
FIG. 2B is a block diagram illustrating another system implementing integrated network intrusion detection. -
FIG. 3 is a combined flowchart and state diagram illustrating a method of servicing network requests in an application rule enforcer component of an integrated network intrusion detection system. -
FIG. 4 is a combined flowchart and state diagram illustrating a method of filtering network communications in a network traffic enforcer component of an integrated network intrusion detection system. -
FIG. 5A is a combined flowchart and state diagram illustrating a method of detecting intrusion preludes and intrusions in a first detector component of an integrated network intrusion detection system. -
FIG. 5B is a combined flowchart and state diagram illustrating a method of detecting intrusions in a second detector component of an integrated network intrusion detection system. -
FIG. 6 is a block diagram illustrating an example data processing system. - Details of one or more embodiments are set forth in the accompanying drawings and the description below. Other features and advantages may be apparent from the description and drawings, and from the claims.
- The systems and techniques described here relate to integrated network intrusion detection. The description that follows frequently discusses intrusion detection in the context of IP networks, but the systems and techniques described apply equally to multiple types of machine communication networks and operating system environments.
- As used herein, the term “application” means a software program, which is a collection of computing operations embodied by a set of instructions (e.g., one or more binary objects, one or more scripts, and/or one or more interpretable programs). The term “component” means a software program designed to operate with other components and/or applications. The term “process” means an executing software program. The term “execution context” means a set of processing cycles given to a process, such as a task in a multitasking operating system. Both an invoked application and an invoked component are a separate process, even if their functionality is interrelated and they share a single execution context. For example, an applet and a Web browser in which the applet runs are each a process. The term “applet” means a component designed specifically to be run from within an application. The term “thread” means a part of a software program that is given its own execution context.
- The term “intrusion” means an attempt to break into and/or misuse a computing system. The term “intrusion prelude” means communication activities that typically precede an intrusion. The term “intrusion signature” means a communication pattern identified as corresponding to a known type of intrusion, including patterns that may be found in individual packets and patterns that may be gleaned from analyzing multiple packets.
- The present inventor recognized the potential advantages of integrating firewall filtering information with network intrusion analysis. In typical network environments, most network traffic is legitimate and only a small portion of network communications may contain intrusions. By performing intrusion analysis on packets blocked by a firewall, intrusion preludes may be detected (including detection using fabricated responses to blocked network requests), and particular sources of network communications may be singled out for greater scrutiny. Thus, an overall amount of network traffic that needs to be monitored may be reduced, real-time intrusion detection may be improved, and more information about an intruder and the intruder's system and/or network may be obtained.
- In addition, firewall functionality may be integrated with intrusion detection on end nodes (e.g., servers and hosts) in a network, such as an enterprise network, to further improve intrusion detection and network security. For example, a networked machine may include an intrusion detection system that functions in part as a dynamic firewall for the networked machine.
- The intrusion detection system may include three components. The first component may be an application rule enforcer that authorizes network service requests from applications invoked on the networked machine and identifies abnormal behavior by an invoked application. The second component may be a network traffic enforcer that monitors inbound network communications and blocks those communications that fail to correspond to an authorized network service request. The third component may be an intrusion detector that monitors the blocked communications and identifies abnormal application behavior to determine when additional traffic monitoring is needed to detect an intrusion. Thus, the total number of communications (e.g., packets) that are examined may be reduced while intrusions may be detected more effectively.
-
FIG. 1 is a combined flowchart and state diagram illustrating a method of monitoring network traffic to detect intrusions. The method begins by identifying one or more applications invoked on a machine (100). This identification may be performed for an application by examining network communications generated by the application, system records for the application, and/or a set of instructions embodying the application. - Next a
default state 105 is entered, in which inbound traffic (i.e., inbound network communications) and traffic corresponding to a watch list are monitored. These network communications are monitored to detect an intrusion prelude or an intrusion. Moreover, multiple levels of monitoring may be implemented in thedefault monitoring state 105. - When a new application is invoked, the new application is identified (100). When a request is received for network service (i.e., a network input/output (I/O) request) from an invoked application, a check is made as to whether the request violates a network policy (110). The network policy may include a system policy and/or an application-specific policy.
- For example, the request may include information such as destination IP address, destination port, source port and type of request (e.g., bind, connect, accept, listen, send, receive, etc.). The network policy may include application-specific rules such as Application=Internet Explorer, destination port=Any, destination address=Any, source port=80, request=Listen, action=Allow. This rule states that the network policy allows any inbound traffic for the Internet Explorer application from any remote server through port 80. In addition to permissive rules that specify allowed communications, the network policy may also include restrictive rules that specify communications that are not allowed (e.g., a Deny action).
- If the received request does not violate the network policy, the request is designated as authorized (115). Then, a communication channel for the request is enabled (120), and monitoring continues.
- Rules similar to the policy rule above may be dynamically added to and removed from a network filter driver to open and close communication channels. Such filtering rules identify authorized network flows associated with invoked applications. In an IP network, a channel may be created by specifying an open channel for a network flow using five values: (1) source IP address, (2) source port, (3) destination IP address, (4) destination port, and (5) protocol. Additional and/or alternative values may be used to specify an open channel.
- Following the creation of an open channel, inbound traffic that corresponds to the open channel is allowed, whereas inbound traffic that fails to correspond to an open channel is blocked in the
monitoring state 105. Moreover, outbound traffic may also be monitored in themonitoring state 105, and disabled channels may also be created, such as by using the Deny action discussed above. Blocked traffic is monitored to detect an intrusion prelude, for example, a system scan, a port scan and/or an operating system (OS) fingerprinting. The blocked traffic may be checked for patterns that span multiple communications and/or multiple communication channels (e.g., multiple TCP/IP (Transmission Control Protocol/Internet Protocol) connections). - When an intrusion prelude is detected, a source of the intrusion prelude is identified (125). For example, a source IP addresses may be extracted from a packet that is part of the intrusion prelude. This source is then added to a watch list for increased monitoring (130), and monitoring continues. All packets from the identified source may then be monitored and these packets may be checked for intrusion signature(s). Additionally, multiple sources may be associated with each other, both in intrusion prelude detection and in subsequent intrusion detection, to counter distributed attacks.
- If a received request violates the network policy, the request is designated as unauthorized (135). A determination is then made as to whether the application that generated the unauthorized request is behaving abnormally (140). This determination may be based on the number of unauthorized requests and/or on the severity of the unauthorized request generated by the application. For example, in one implementation, a single unauthorized request may be treated as abnormal behavior by an application. If the requesting application is behaving normally, monitoring continues.
- When an application behaves abnormally, a level of monitoring for the application is increased (145), and monitoring continues. For example, the application may be added to a watch list to initiate monitoring of network communications both to and from the application. This monitoring may include searching packets for application-specific intrusion signatures.
-
FIG. 2A is a block diagram illustrating a system implementing integrated network intrusion detection. Anetworked machine 200 includes a network stack, which is a set of layered software modules implementing a defined protocol stack. The number and composition of layers in the network stack will vary with machine and network architecture, but generally includes anetwork driver 205, a network transport layer 210 (e.g., TCP/IP) and anapplication layer 220. - An intrusion detection system (IDS) 230 may be implemented between the
network driver 205 and thenetwork transport layer 210 so that all incoming packets may be monitored. Packet-level intrusion detection may be implemented in an NDIS (Network Driver Interface Specification) intermediate driver in a Windows environment. In addition, theIDS 230 may haveadditional components 232 placed elsewhere in the network stack. System-level intrusion detection may be implemented in one or more TDI (Transport Driver Interface) filter drivers, and application-level intrusion detection may be implemented in one or more components placed just below and/or just inside the application layer 220 (i.e., as part of a network interface library). - If an application-
level component 234 is used as part of theIDS 230, network services requested byapplications 224 go to the application-level component 234 first. As a result, the application-level component 234 knows which application requested which network service. In a Windows operating system environment, the application-level component 234 may be implemented as a WinSock (Windows Socket) Layer Service Provider (LSP) and/or as a TDI filter driver. WinSock is an Application Programming Interface (API) for developing Windows programs that communicate over a network using TCP/IP. - Alternatively, or in addition, application-
level components 236 may be used for intrusion detection.Such components 236 load and run with eachnew network application 224 in anexecution context 222 for that network application. Thesecomponents 236 may perform authorization of network requests and application-specific intrusion signature detection such that the processing time consumed by these techniques affects only corresponding network applications. - The
networked machine 200 is coupled with anetwork 240 that may provide communication links to asecurity operation center 242 and apotential intruder 244. Thesecurity operation center 242 may include a central security server. Various alert levels may be used in theIDS 230. These alert levels may trigger heightened monitoring states, cause alerts to be sent to thesecurity operation center 242, and/or initiate logging of network activity, locally and/or with the central security server, for later forensic analysis. - The
IDS 230 functions as a dynamic firewall for thenetworked machine 200. TheIDS 230 monitors network traffic to block traffic that violates a network policy and monitors blocked traffic to detect an intrusion prelude. TheIDS 230 monitors traffic from thepotential intruder 244 when an intrusion prelude is detected. TheIDS 230 may track behavior ofapplications 224 using a network policy that specifies behavior criteria (which may be application-specific) to identify abnormal application behavior. TheIDS 230 may monitor traffic from an abnormally behavingapplication 224 a to identify an intrusion, including e.g. an intrusion connected with a Trojan Horse in the application. -
FIG. 2B is a block diagram illustrating a system implementing integrated network intrusion detection. Anetworked machine 250 includes a network stack, as described above, and generally includes anetwork driver 255, a network transport layer 260 (e.g., TCP/IP) and anapplication layer 270. Thenetworked machine 250 also includes an intrusion detection system divided into three components: anintrusion detector 280, anetwork traffic enforcer 282, and anapplication rule enforcer 284. - These
components intrusion detector 280 may include a kernel component that resides in a first module with thenetwork traffic enforcer 282, and theintrusion detector 280 also may include a user component that resides in a second module with theapplication rule enforcer 284. Additionally, theapplication rule enforcer 284 may be a component that is invoked separately with each of multiple invokedapplications 274, as described above. - The
networked machine 250 is coupled with anetwork 290 that may provide communication links to acentral security server 292 and apotential intruder 294. - As each
application 274 requests network I/O service, the request is either authorized or rejected by theapplication rule enforcer 284. If the request is authorized, corresponding authorizedcommunications 272 are allowed to pass from theapplication 274 to thenetwork 290, and from thenetwork 290 to theapplication 274. If a request is rejected, this rejected request is communicated to theintrusion detector 280. - If a
request 276 is rejected, theintrusion detector 280 may determine that anapplication 274 a is behaving abnormally, and theintrusion detector 280 may then begin monitoringother communications 278 for thesuspect application 274 a. This additional monitoring ofcommunications 278 may involve checking for application-specific intrusion signatures, which may be dynamically loaded from thecentral security server 292. - The
network traffic enforcer 282 monitors incoming network traffic. If aninbound communication 262 fails to correspond to an authorized request (i.e., the inbound communication was not effectively pre-approved by the application rule enforcer), the communication is dropped (i.e., blocked from passage to another layer in the network stack). Additionally, thenetwork traffic enforcer 282 may monitor outbound communications in a similar manner. For example, thenetwork traffic enforcer 282 may check all packets (both from thenetwork 290 and from the applications 274) to see if they match a channel opened by theapplication rule enforcer 284. - Moreover, the
network traffic enforcer 282 may also drop other communications in a manner similar to a firewall. For example, thenetwork traffic enforcer 282 may drop malformed packets and packets used for system scanning (e.g., ICMP (Internet Control Message Protocol) echo requests). Communications that are dropped by the network traffic enforcer are sent to theintrusion detector 280. - The
intrusion detector 280 examines the dropped communications to look for patterns signaling an intrusion prelude. For example, theintrusion detector 280 may look for system scans (e.g., ping), port scans (e.g., TCP-SYN (synchronization), TCP-FIN (finished), etc.), and OS fingerprinting. Frequently anintruder 294 will perform scanning operations on a system, or make some missteps, before an intrusion is launched. These operations may be detected by theintrusion detector 280 as an intrusion prelude. - Additionally, the
intrusion detector 280 may encourage these operations by generating fabricated responses to the dropped communications to catch theintruder 294. A fabricated response to blocked traffic may be used to gain knowledge about a potential intruder and their system for later use. For example, by selectively generating one or more fabricated responses to blocked inbound traffic, which would otherwise be blocked silently, significant information concerning a potential intruder's system and network may be obtained for use in later forensic analysis. If the potential intruder later turns out to be an actual intruder, this collected information may be associated with the detected intrusion and may be especially useful, such as for use in prosecution of the intruder and/or other legal action (e.g., legal action requiring an intruder's Internet Service Provider (ISP) to take action, such as denying future network services to the intruder). - When an intrusion prelude is detected, the
intrusion detector 280 then identifies and registers a source address for theintruder 294 and begins examining communications from that source to detect an intrusion. For example, theintrusion detector 280 may watch traffic from a potential intruder to look for packet level exploits such as launching intrusions using packet fragments (e.g., tear drop, Boink, etc.). Thus, theintrusion detector 280 may support packet reassembly to detect fragmentation related intrusions. - If the
intrusion detector 280 detects an intrusion (e.g., a packet exploit), it may block the traffic and/or report the intrusion to thecentral security server 292. Additionally, theintrusion detector 280 may log the communications associated with a detected intrusion and intrusion prelude for forensic analysis. -
FIG. 3 is a combined flowchart and state diagram illustrating a method of servicing network requests in an application rule enforcer (ARE) component of an integrated network intrusion detection system. The method begins when an application and the ARE component are invoked (300). The ARE component then identifies the invoked application (305). - To do so, the ARE component may determine the full path (directory and file name) of the loading application executable (e.g., “C:/Program Files/Application/application.exe”), examine machine instructions embodying the application (e.g., “application.exe”) to identify the application, and/or may crosscheck this identification with file properties information, such as name, size and version number. Examining the machine instructions may involve applying a hash function to the application's executable to generate a condensed representation (or hash value) of the executable. This hash value may then be compared with predefined hash values for known applications to identify the invoked application.
- The hash function may be a message digest algorithm with a mathematical property that effectively guarantees that for any size message, a unique value of a fixed size (e.g., 128 bits) is returned. The hash function may be part of a standardized message digest specification (e.g., Secure Hash Standard (SHA-1), defined in Federal Information Processing Standards Publication 180-1).
- Once the invoked application is identified, an application-specific network policy is loaded (310). This network policy information may be loaded from a local repository and/or from a remote repository of network policy information (including dynamic loading from the remote repository to the local repository to keep the network policy information up to date as network policies change). Then, the ARE component enters an
idle state 315. - When a network I/O request is made by the application, the request is compared with the application-specific network policy (320). If the policy is satisfied (325), a network traffic enforcer (NTE) component is notified to open a channel (330). For example, a message may be sent specifying a source IP address, a source port, a destination IP address, a destination port and a protocol for the opened channel.
- If the policy is not satisfied, an intrusion detector component is notified of the rejected request (335). Alternatively, the notice may be that the application is behaving abnormally. For example, a single violation of network policy may be considered abnormal behavior for the application. Alternatively, the application-specific network policy may be multi-tiered, such that certain violations are logged, but repeated and/or more severe violations of network policy constitute abnormal application behavior.
- Such policies may include configurable thresholds for one or more characteristics of network communications. The configurable thresholds may be set directly by the intrusion detector, and/or by a network administrator, after analysis of communication statistics for the application. Thus, network administrators may set the configurable thresholds, such as by including them with intrusion signatures provided by security service providers, and/or the configurable thresholds may be auto-configurable, such as by monitoring communications during a defined time window.
- When an open channel is closed, the NTE component is notified of this closing channel (340).
-
FIG. 4 is a combined flowchart and state diagram illustrating a method of filtering network communications in a network traffic enforcer (NTE) component of an integrated network intrusion detection system. The method begins in amonitoring state 400, where communications are monitored to block unauthorized communications. When a notification of an opened channel is received, the opened channel is added to an authorization list (405), and monitoring continues. - When an unauthorized communication is received, a copy of the communication is sent to an intrusion detector component (410). Then the unauthorized communication is blocked (i.e., dropped) (415), and monitoring continues. When a notification of a closed channel is received, the closed channel is removed from the authorization list (420), and monitoring continues. Thus, network communications that have not been pre-approved by the ARE component are blocked and copied to the intrusion detector.
-
FIG. 5A is a combined flowchart and state diagram illustrating a method of detecting intrusion preludes and intrusions in a first detector component of an integrated network intrusion detection system. The method begins in anidle state 500. When a blocked communication is received, it is checked for intrusion prelude patterns (505). Such patterns may include system scan, port scan and OS fingerprinting. - A check is made to determine if an intrusion prelude is present (510). If not, a check is made to determine if a response is needed to encourage an intruder (515). If so, a fabricated response is generated and sent to the potential intruder (520). Then, or if a fabricated response was not needed, the present communication activity is logged for future use in detecting intrusion preludes (525).
- If an intrusion prelude is detected, the source of the intrusion prelude is identified (530). The identified source is a potential intruder, and thus communications from the potential intruder are monitored in an
active monitoring state 535. This active monitoring may involve checking for packet level exploits, such as intrusions using packet fragments, as described above. When a blocked communication is received, it is checked for intrusion prelude patterns, as before (505). Thus, additional sources may be added to a list of potential intruders to be monitored in theactive monitoring state 535. - If an intrusion is detected, a remedy is provided (540). For example, the intrusion activity may be logged, the traffic may be cut, countermeasures may be employed and/or an alert may be sent to a security operation center.
- If a pre-defined time elapses for an identified source, the monitored activity for the source is logged for later analysis, and the source-specific monitoring for that source is terminated (545). If this is the last source being monitored in the
active monitoring state 535, the method returns to theidle state 500. -
FIG. 5B is a combined flowchart and state diagram illustrating a method of detecting intrusions in a second detector component of an integrated network intrusion detection system. The method begins in anidle state 550. When an unauthorized request occurs, the unauthorized request is compared with one or more configurable thresholds (555). These configurable thresholds specify the type and/or number of requests that constitute abnormal application behavior. The configurable thresholds may be set as described above. - A check is then made for abnormal behavior (560). If the application is not behaving abnormally, the unauthorized request is logged for later use (565). If the application is behaving abnormally, monitoring parameters for the application are loaded (570). These parameters may include application-specific intrusion detection signatures.
- Then, a
monitoring state 575 is entered, in which network communications for the application are monitored using the loaded parameters. If an intrusion is detected, a remedy is provided (580). For example, the intrusion activity may be logged, the traffic may be cut, countermeasures may be taken, and/or an alert may be sent to a security operation center. This remedy may be application-specific. - If a predefined time elapses, in which no intrusion is detected, the monitored communications for the application are logged for later analysis (585). Then, the method returns to the
idle state 550. - Although FIGS. 3 to 5C show methods being performed in four separate components, these methods may also be combined into a single component or two or more components. For example, a first component, being a combination of the NTE component and the first intrusion detector component, may perform a combination of the methods shown in
FIGS. 4 and 5 A. A second component, being a combination of the ARE component and the second intrusion detector component, may perform a combination of the methods shown inFIGS. 3 and 5 B. - Various implementations of the systems and techniques described here may be realized in digital electronic circuitry, integrated circuitry, specially designed ASICs (application specific integrated circuits), computer hardware, firmware, software, and/or combinations thereof. These various implementations may include implementation in one or more computer programs that are executable/interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.
-
FIG. 6 is a block diagram illustrating an exampledata processing system 600. Thedata processing system 600 includes acentral processor 610, which executes programs, performs data manipulations and controls tasks in thesystem 600, thereby enabling the features and function described above. Thecentral processor 610 is coupled with one or more communication busses 615. - The
data processing system 600 includes amemory 620, which may be volatile and/or non-volatile memory, and is coupled with thecommunications bus 615. Thesystem 600 may also include one or more cache memories. These memory devices enable storage of instructions and data close to thecentral processor 610 for retrieval and execution. - The
data processing system 600 may include astorage device 630 for accessing a medium 635, which may be removable. The medium 635 may be read-only or read/write media and may be magnetic-based, optical-based or magneto-optical-based media. Thedata processing system 600 may also include one or more peripheral devices 640(1)-640(n) (collectively, devices 640), and one or more controllers and/or adapters for providing interface functions. Thedevices 640 may be additional storage devices and media as described above, other storage interfaces and storage units, input devices and/or output devices. - The
system 600 may further include acommunication interface 650, which allows software and data to be transferred, in the form ofsignals 654 over achannel 652, between thesystem 600 and external devices, networks or information sources. Thesignals 654 may embody instructions for causing thesystem 600 to perform operations. Thecommunication interface 650 may be a network interface designed for a particular type of network, protocol and channel medium, or may be designed to serve multiple networks, protocols and/or channel media. - The
system 600 represents a programmable machine, and may include various devices such as embedded controllers and Programmable Logic Devices (PLDs). Machine instructions (also known as programs, software, software applications or code) may be stored in themachine 600 or delivered to themachine 600 over a communication interface. These instructions, when executed, enable themachine 600 to perform the features and function described above. - As used herein, the term “machine-readable medium” refers to any medium or device used to provide machine instructions and/or data to the
machine 600. The various implementations described above have been presented by way of example only, and not limitation. Thus, other embodiments may be within the scope of the following claims.
Claims (22)
1. (canceled)
2. A machine-implemented method comprising:
receiving requests for network communication services from an invoked application;
selectively designating each of the received requests as authorized or unauthorized based on a network policy; and monitoring network communications, for the invoked application, based on the designating of the requests.
3. The method of claim 2 , wherein selectively designating each of the received requests comprises selectively designating each of the received requests as authorized or unauthorized based on an application-specific network policy corresponding to the invoked application.
4. The method of claim 3 , wherein monitoring the network communications comprises monitoring outbound network communications.
5. The method of claim 2 , further comprising increasing a monitoring level for the invoked application when the invoked application behaves abnormally.
6. The method of claim 5 , wherein increasing the monitoring level for the invoked application comprises adding the invoked application to a watch list to initiate monitoring of network communications both to and from the application, including searching packets for application-specific intrusion signatures.
7. The method of claim 2 , wherein monitoring of the network communications for the invoked application comprises monitoring in an intrusion detection system component invoked with the invoked application.
8. The method of claim 7 , wherein the intrusion detection system component and the invoked application run within a single execution context.
9. A machine-readable medium embodying machine instructions for causing one or more machines to perform operations comprising:
receiving requests for network communication services from an invoked application;
selectively designating each of the received requests as authorized or unauthorized based on a network policy; and
monitoring network communications, for the invoked application, based on the designating of the requests.
10. The machine-readable medium of claim 9 , wherein selectively designating each of the received requests comprises selectively designating each of the received requests as authorized or unauthorized based on an application-specific network policy corresponding to the invoked application.
11. The machine-readable medium of claim 10 , wherein monitoring the network communications comprises monitoring outbound network communications.
12. The machine-readable medium of claim 9 , the operations further comprising increasing a monitoring level for the invoked application when the invoked application behaves abnormally.
13. The machine-readable medium of claim 12 , wherein increasing the monitoring level for the invoked application comprises adding the invoked application to a watch list to initiate monitoring of network communications both to and from the application, including searching packets for application-specific intrusion signatures.
14. The machine-readable medium of claim 9 , wherein monitoring of the network communications for the invoked application comprises monitoring in an intrusion detection system component invoked with the invoked application.
15. The machine-readable medium of claim 14 , wherein the intrusion detection system component and the invoked application run within a single execution context.
16. A system comprising:
a processor;
a communication interface coupled with the processor; and
a machine-readable medium operatively coupled with the processor and embodying machine instructions for causing the processor to perform operations comprising:
receiving requests for network communication services from an invoked application;
selectively designating each of the received requests as authorized or unauthorized based on a network policy; and
monitoring network communications, for the invoked application, based on the designating of the requests.
17. The system of claim 16 , wherein selectively designating each of the received requests comprises selectively designating each of the received requests as authorized or unauthorized based on an application-specific network policy corresponding to the invoked application.
18. The system of claim 17 , wherein monitoring the network communications comprises monitoring outbound network communications.
19. The system of claim 16 , the operations further comprising increasing a monitoring level for the invoked application when the invoked application behaves abnormally.
20. The system of claim 19 , wherein increasing the monitoring level for the invoked application comprises adding the invoked application to a watch list to initiate monitoring of network communications both to and from the application, including searching packets for application-specific intrusion signatures.
21. The system of claim 16 , wherein monitoring of the network communications for the invoked application comprises monitoring in an intrusion detection system component invoked with the invoked application.
22. The system of claim 21 , wherein the intrusion detection system component and the invoked application run within a single execution context.
Priority Applications (5)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/702,908 US20070209070A1 (en) | 2002-02-01 | 2007-02-05 | Integrated network intrusion detection |
US12/649,018 US8752173B2 (en) | 2002-02-01 | 2009-12-29 | Integrated network intrusion detection |
US14/300,420 US9143525B2 (en) | 2002-02-01 | 2014-06-10 | Integrated network intrusion detection |
US14/861,232 US10044738B2 (en) | 2002-02-01 | 2015-09-22 | Integrated network intrusion detection |
US15/982,318 US10771484B2 (en) | 2002-02-01 | 2018-05-17 | Integrated network intrusion detection |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/066,140 US7174566B2 (en) | 2002-02-01 | 2002-02-01 | Integrated network intrusion detection |
US11/702,908 US20070209070A1 (en) | 2002-02-01 | 2007-02-05 | Integrated network intrusion detection |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/066,140 Continuation US7174566B2 (en) | 2002-02-01 | 2002-02-01 | Integrated network intrusion detection |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/649,018 Continuation US8752173B2 (en) | 2002-02-01 | 2009-12-29 | Integrated network intrusion detection |
Publications (1)
Publication Number | Publication Date |
---|---|
US20070209070A1 true US20070209070A1 (en) | 2007-09-06 |
Family
ID=27658645
Family Applications (6)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/066,140 Active 2024-05-28 US7174566B2 (en) | 2002-02-01 | 2002-02-01 | Integrated network intrusion detection |
US11/702,908 Abandoned US20070209070A1 (en) | 2002-02-01 | 2007-02-05 | Integrated network intrusion detection |
US12/649,018 Expired - Lifetime US8752173B2 (en) | 2002-02-01 | 2009-12-29 | Integrated network intrusion detection |
US14/300,420 Expired - Fee Related US9143525B2 (en) | 2002-02-01 | 2014-06-10 | Integrated network intrusion detection |
US14/861,232 Expired - Fee Related US10044738B2 (en) | 2002-02-01 | 2015-09-22 | Integrated network intrusion detection |
US15/982,318 Expired - Lifetime US10771484B2 (en) | 2002-02-01 | 2018-05-17 | Integrated network intrusion detection |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/066,140 Active 2024-05-28 US7174566B2 (en) | 2002-02-01 | 2002-02-01 | Integrated network intrusion detection |
Family Applications After (4)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/649,018 Expired - Lifetime US8752173B2 (en) | 2002-02-01 | 2009-12-29 | Integrated network intrusion detection |
US14/300,420 Expired - Fee Related US9143525B2 (en) | 2002-02-01 | 2014-06-10 | Integrated network intrusion detection |
US14/861,232 Expired - Fee Related US10044738B2 (en) | 2002-02-01 | 2015-09-22 | Integrated network intrusion detection |
US15/982,318 Expired - Lifetime US10771484B2 (en) | 2002-02-01 | 2018-05-17 | Integrated network intrusion detection |
Country Status (5)
Country | Link |
---|---|
US (6) | US7174566B2 (en) |
EP (3) | EP1470691B1 (en) |
AU (1) | AU2003225531A1 (en) |
HK (1) | HK1067823A1 (en) |
WO (1) | WO2003067847A2 (en) |
Cited By (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070147239A1 (en) * | 2005-12-28 | 2007-06-28 | Chun-Te Wu | Terminal and Related Computer-Implemented Method for Detecting Malicious Data for Computer Network |
US20080313738A1 (en) * | 2007-06-15 | 2008-12-18 | Broadcom Corporation | Multi-Stage Deep Packet Inspection for Lightweight Devices |
US20100122317A1 (en) * | 2002-02-01 | 2010-05-13 | Satyendra Yadav | Integrated Network Intrusion Detection |
US20150128246A1 (en) * | 2013-11-07 | 2015-05-07 | Attivo Networks Inc. | Methods and apparatus for redirecting attacks on a network |
US20160173452A1 (en) * | 2013-06-27 | 2016-06-16 | Jeong Hoan Seo | Multi-connection system and method for service using internet protocol |
US20190140958A1 (en) * | 2017-11-07 | 2019-05-09 | Facebook, Inc. | Hierarchical orchestration of a computer network |
US11580218B2 (en) | 2019-05-20 | 2023-02-14 | Sentinel Labs Israel Ltd. | Systems and methods for executable code detection, automatic feature extraction and position independent code detection |
US11579857B2 (en) | 2020-12-16 | 2023-02-14 | Sentinel Labs Israel Ltd. | Systems, methods and devices for device fingerprinting and automatic deployment of software in a computing network using a peer-to-peer approach |
US11616812B2 (en) | 2016-12-19 | 2023-03-28 | Attivo Networks Inc. | Deceiving attackers accessing active directory data |
US11625485B2 (en) | 2014-08-11 | 2023-04-11 | Sentinel Labs Israel Ltd. | Method of malware detection and system thereof |
US11695800B2 (en) | 2016-12-19 | 2023-07-04 | SentinelOne, Inc. | Deceiving attackers accessing network data |
US11716342B2 (en) | 2017-08-08 | 2023-08-01 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
US11888897B2 (en) | 2018-02-09 | 2024-01-30 | SentinelOne, Inc. | Implementing decoys in a network environment |
US11886591B2 (en) | 2014-08-11 | 2024-01-30 | Sentinel Labs Israel Ltd. | Method of remediating operations performed by a program and system thereof |
US11899782B1 (en) | 2021-07-13 | 2024-02-13 | SentinelOne, Inc. | Preserving DLL hooks |
US11973781B2 (en) | 2022-04-21 | 2024-04-30 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
Families Citing this family (301)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040073617A1 (en) | 2000-06-19 | 2004-04-15 | Milliken Walter Clark | Hash-based systems and methods for detecting and preventing transmission of unwanted e-mail |
US20030149887A1 (en) * | 2002-02-01 | 2003-08-07 | Satyendra Yadav | Application-specific network intrusion detection |
US7734752B2 (en) | 2002-02-08 | 2010-06-08 | Juniper Networks, Inc. | Intelligent integrated network security device for high-availability applications |
US8370936B2 (en) | 2002-02-08 | 2013-02-05 | Juniper Networks, Inc. | Multi-method gateway-based network security systems and methods |
US7650634B2 (en) | 2002-02-08 | 2010-01-19 | Juniper Networks, Inc. | Intelligent integrated network security device |
US8209756B1 (en) | 2002-02-08 | 2012-06-26 | Juniper Networks, Inc. | Compound attack detection in a computer network |
US8561167B2 (en) | 2002-03-08 | 2013-10-15 | Mcafee, Inc. | Web reputation scoring |
US7694128B2 (en) | 2002-03-08 | 2010-04-06 | Mcafee, Inc. | Systems and methods for secure communication delivery |
US7693947B2 (en) | 2002-03-08 | 2010-04-06 | Mcafee, Inc. | Systems and methods for graphically displaying messaging traffic |
US7870203B2 (en) | 2002-03-08 | 2011-01-11 | Mcafee, Inc. | Methods and systems for exposing messaging reputation to an end user |
US20060015942A1 (en) | 2002-03-08 | 2006-01-19 | Ciphertrust, Inc. | Systems and methods for classification of messaging entities |
US7124438B2 (en) | 2002-03-08 | 2006-10-17 | Ciphertrust, Inc. | Systems and methods for anomaly detection in patterns of monitored communications |
US7903549B2 (en) | 2002-03-08 | 2011-03-08 | Secure Computing Corporation | Content-based policy compliance systems and methods |
US8132250B2 (en) | 2002-03-08 | 2012-03-06 | Mcafee, Inc. | Message profiling systems and methods |
US8578480B2 (en) | 2002-03-08 | 2013-11-05 | Mcafee, Inc. | Systems and methods for identifying potentially malicious messages |
US6941467B2 (en) * | 2002-03-08 | 2005-09-06 | Ciphertrust, Inc. | Systems and methods for adaptive message interrogation through multiple queues |
US20030172291A1 (en) | 2002-03-08 | 2003-09-11 | Paul Judge | Systems and methods for automated whitelisting in monitored communications |
WO2003090426A1 (en) * | 2002-04-17 | 2003-10-30 | Computer Associates Think, Inc. | Detecting and countering malicious code in enterprise networks |
US8910241B2 (en) * | 2002-04-25 | 2014-12-09 | Citrix Systems, Inc. | Computer security system |
US20030204596A1 (en) * | 2002-04-29 | 2003-10-30 | Satyendra Yadav | Application-based network quality of service provisioning |
US7359962B2 (en) * | 2002-04-30 | 2008-04-15 | 3Com Corporation | Network security system integration |
US7086089B2 (en) * | 2002-05-20 | 2006-08-01 | Airdefense, Inc. | Systems and methods for network security |
US7532895B2 (en) * | 2002-05-20 | 2009-05-12 | Air Defense, Inc. | Systems and methods for adaptive location tracking |
US7383577B2 (en) * | 2002-05-20 | 2008-06-03 | Airdefense, Inc. | Method and system for encrypted network management and intrusion detection |
US7277404B2 (en) * | 2002-05-20 | 2007-10-02 | Airdefense, Inc. | System and method for sensing wireless LAN activity |
US7058796B2 (en) | 2002-05-20 | 2006-06-06 | Airdefense, Inc. | Method and system for actively defending a wireless LAN against attacks |
US7042852B2 (en) * | 2002-05-20 | 2006-05-09 | Airdefense, Inc. | System and method for wireless LAN dynamic channel change with honeypot trap |
EP1512075A1 (en) * | 2002-05-22 | 2005-03-09 | Lucid Security Corporation | Adaptive intrusion detection system |
US20030232598A1 (en) * | 2002-06-13 | 2003-12-18 | Daniel Aljadeff | Method and apparatus for intrusion management in a wireless network using physical location determination |
DE60214993T2 (en) * | 2002-07-12 | 2007-04-05 | Alcatel | Firewall for dynamic access granting and denial on network resources |
US8788650B1 (en) * | 2002-07-19 | 2014-07-22 | Fortinet, Inc. | Hardware based detection devices for detecting network traffic content and methods of using the same |
US7114183B1 (en) * | 2002-08-28 | 2006-09-26 | Mcafee, Inc. | Network adaptive baseline monitoring system and method |
US7748039B2 (en) * | 2002-08-30 | 2010-06-29 | Symantec Corporation | Method and apparatus for detecting malicious code in an information handling system |
US7509679B2 (en) * | 2002-08-30 | 2009-03-24 | Symantec Corporation | Method, system and computer program product for security in a global computer network transaction |
US7331062B2 (en) * | 2002-08-30 | 2008-02-12 | Symantec Corporation | Method, computer software, and system for providing end to end security protection of an online transaction |
US7454499B2 (en) | 2002-11-07 | 2008-11-18 | Tippingpoint Technologies, Inc. | Active network defense system and method |
US8122498B1 (en) | 2002-12-12 | 2012-02-21 | Mcafee, Inc. | Combined multiple-application alert system and method |
US8312535B1 (en) * | 2002-12-12 | 2012-11-13 | Mcafee, Inc. | System, method, and computer program product for interfacing a plurality of related applications |
US8990723B1 (en) | 2002-12-13 | 2015-03-24 | Mcafee, Inc. | System, method, and computer program product for managing a plurality of applications via a single interface |
US8239941B1 (en) | 2002-12-13 | 2012-08-07 | Mcafee, Inc. | Push alert system, method, and computer program product |
US7418730B2 (en) * | 2002-12-17 | 2008-08-26 | International Business Machines Corporation | Automatic client responses to worm or hacker attacks |
US20040205183A1 (en) * | 2003-03-10 | 2004-10-14 | Sandvine Incorporated | Method and system for avoiding tracking communication connection state until accepted |
US7603710B2 (en) * | 2003-04-03 | 2009-10-13 | Network Security Technologies, Inc. | Method and system for detecting characteristics of a wireless network |
US7355996B2 (en) * | 2004-02-06 | 2008-04-08 | Airdefense, Inc. | Systems and methods for adaptive monitoring with bandwidth constraints |
US7730175B1 (en) | 2003-05-12 | 2010-06-01 | Sourcefire, Inc. | Systems and methods for identifying the services of a network |
US8065725B2 (en) * | 2003-05-30 | 2011-11-22 | Yuliang Zheng | Systems and methods for enhanced network security |
US7596807B2 (en) * | 2003-07-03 | 2009-09-29 | Arbor Networks, Inc. | Method and system for reducing scope of self-propagating attack code in network |
DE60321972D1 (en) * | 2003-08-11 | 2008-08-14 | Telecom Italia Spa | METHOD AND SYSTEM FOR DETECTING UNAUTHORIZED USE OF A COMMUNICATION NETWORK |
US20050050213A1 (en) * | 2003-09-03 | 2005-03-03 | James Clough | Authorizing network requests |
US7725936B2 (en) * | 2003-10-31 | 2010-05-25 | International Business Machines Corporation | Host-based network intrusion detection systems |
US7581249B2 (en) * | 2003-11-14 | 2009-08-25 | Enterasys Networks, Inc. | Distributed intrusion response system |
US8839417B1 (en) * | 2003-11-17 | 2014-09-16 | Mcafee, Inc. | Device, system and method for defending a computer network |
KR100522138B1 (en) | 2003-12-31 | 2005-10-18 | 주식회사 잉카인터넷 | Flexible network security system and method to permit trustful process |
WO2005071923A1 (en) * | 2004-01-20 | 2005-08-04 | Intrusic, Inc | Systems and methods for monitoring data transmissions to detect a compromised network |
KR100609170B1 (en) * | 2004-02-13 | 2006-08-02 | 엘지엔시스(주) | system of network security and working method thereof |
US7895448B1 (en) * | 2004-02-18 | 2011-02-22 | Symantec Corporation | Risk profiling |
US20050188080A1 (en) * | 2004-02-24 | 2005-08-25 | Covelight Systems, Inc. | Methods, systems and computer program products for monitoring user access for a server application |
US20050188222A1 (en) * | 2004-02-24 | 2005-08-25 | Covelight Systems, Inc. | Methods, systems and computer program products for monitoring user login activity for a server application |
US7373524B2 (en) * | 2004-02-24 | 2008-05-13 | Covelight Systems, Inc. | Methods, systems and computer program products for monitoring user behavior for a server application |
US20050187934A1 (en) * | 2004-02-24 | 2005-08-25 | Covelight Systems, Inc. | Methods, systems and computer program products for geography and time monitoring of a server application user |
US7496500B2 (en) * | 2004-03-01 | 2009-02-24 | Microsoft Corporation | Systems and methods that determine intent of data and respond to the data based on the intent |
FR2868230B1 (en) * | 2004-03-25 | 2012-06-08 | Netasq | DEVICE AND METHOD FOR DETECTING AND PREVENTING INTRUSION IN A COMPUTER NETWORK |
US7904960B2 (en) * | 2004-04-27 | 2011-03-08 | Cisco Technology, Inc. | Source/destination operating system type-based IDS virtualization |
US20070192862A1 (en) * | 2004-05-12 | 2007-08-16 | Vincent Vermeulen | Automated containment of network intruder |
US8074277B2 (en) * | 2004-06-07 | 2011-12-06 | Check Point Software Technologies, Inc. | System and methodology for intrusion detection and prevention |
US7539681B2 (en) * | 2004-07-26 | 2009-05-26 | Sourcefire, Inc. | Methods and systems for multi-pattern searching |
US8196199B2 (en) * | 2004-10-19 | 2012-06-05 | Airdefense, Inc. | Personal wireless monitoring agent |
US8108929B2 (en) * | 2004-10-19 | 2012-01-31 | Reflex Systems, LLC | Method and system for detecting intrusive anomalous use of a software system using multiple detection algorithms |
US8635690B2 (en) | 2004-11-05 | 2014-01-21 | Mcafee, Inc. | Reputation based message processing |
KR100639969B1 (en) * | 2004-12-02 | 2006-11-01 | 한국전자통신연구원 | Apparatus for abnormal traffic control and method thereof |
US7990967B2 (en) | 2005-01-06 | 2011-08-02 | Rockwell Automation Technologies, Inc. | Firewall method and apparatus for industrial systems |
US7610610B2 (en) * | 2005-01-10 | 2009-10-27 | Mcafee, Inc. | Integrated firewall, IPS, and virus scanner system and method |
US7310669B2 (en) | 2005-01-19 | 2007-12-18 | Lockdown Networks, Inc. | Network appliance for vulnerability assessment auditing over multiple networks |
US7810138B2 (en) | 2005-01-26 | 2010-10-05 | Mcafee, Inc. | Enabling dynamic authentication with different protocols on the same port for a switch |
US20060164199A1 (en) * | 2005-01-26 | 2006-07-27 | Lockdown Networks, Inc. | Network appliance for securely quarantining a node on a network |
US8520512B2 (en) | 2005-01-26 | 2013-08-27 | Mcafee, Inc. | Network appliance for customizable quarantining of a node on a network |
US7769851B1 (en) | 2005-01-27 | 2010-08-03 | Juniper Networks, Inc. | Application-layer monitoring and profiling network traffic |
US7810151B1 (en) | 2005-01-27 | 2010-10-05 | Juniper Networks, Inc. | Automated change detection within a network environment |
US7809826B1 (en) | 2005-01-27 | 2010-10-05 | Juniper Networks, Inc. | Remote aggregation of network traffic profiling data |
US7937755B1 (en) | 2005-01-27 | 2011-05-03 | Juniper Networks, Inc. | Identification of network policy violations |
US7797411B1 (en) * | 2005-02-02 | 2010-09-14 | Juniper Networks, Inc. | Detection and prevention of encapsulated network attacks using an intermediate device |
US20060259950A1 (en) * | 2005-02-18 | 2006-11-16 | Ulf Mattsson | Multi-layer system for privacy enforcement and monitoring of suspicious data access behavior |
US7937480B2 (en) | 2005-06-02 | 2011-05-03 | Mcafee, Inc. | Aggregation of reputation data |
CA2610350C (en) * | 2005-06-06 | 2015-04-28 | International Business Machines Corporation | Computer network intrusion detection system and method |
US7746862B1 (en) | 2005-08-02 | 2010-06-29 | Juniper Networks, Inc. | Packet processing in a multiple processor system |
US7891000B1 (en) * | 2005-08-05 | 2011-02-15 | Cisco Technology, Inc. | Methods and apparatus for monitoring and reporting network activity of applications on a group of host computers |
US8621604B2 (en) * | 2005-09-06 | 2013-12-31 | Daniel Chien | Evaluating a questionable network communication |
US9015090B2 (en) | 2005-09-06 | 2015-04-21 | Daniel Chien | Evaluating a questionable network communication |
US9912677B2 (en) | 2005-09-06 | 2018-03-06 | Daniel Chien | Evaluating a questionable network communication |
US9674145B2 (en) | 2005-09-06 | 2017-06-06 | Daniel Chien | Evaluating a questionable network communication |
US7814548B2 (en) | 2005-09-13 | 2010-10-12 | Honeywell International Inc. | Instance based learning framework for effective behavior profiling and anomaly intrusion detection |
US8046833B2 (en) * | 2005-11-14 | 2011-10-25 | Sourcefire, Inc. | Intrusion event correlation with network discovery information |
US7733803B2 (en) * | 2005-11-14 | 2010-06-08 | Sourcefire, Inc. | Systems and methods for modifying network map attributes |
US8082586B2 (en) * | 2005-11-22 | 2011-12-20 | International Business Machines Corporation | Snoop echo response extractor |
US8763113B2 (en) * | 2005-11-28 | 2014-06-24 | Threatmetrix Pty Ltd | Method and system for processing a stream of information from a computer network using node based reputation characteristics |
US7921165B2 (en) * | 2005-11-30 | 2011-04-05 | Microsoft Corporation | Retaining mail for availability after relay |
US8495743B2 (en) * | 2005-12-16 | 2013-07-23 | Cisco Technology, Inc. | Methods and apparatus providing automatic signature generation and enforcement |
US7734754B2 (en) * | 2005-12-28 | 2010-06-08 | Microsoft Corporation | Reviewing effectiveness of communication rules system |
US7810160B2 (en) * | 2005-12-28 | 2010-10-05 | Microsoft Corporation | Combining communication policies into common rules store |
US7715800B2 (en) | 2006-01-13 | 2010-05-11 | Airdefense, Inc. | Systems and methods for wireless intrusion detection using spectral analysis |
US8214899B2 (en) * | 2006-03-15 | 2012-07-03 | Daniel Chien | Identifying unauthorized access to a network resource |
US7971251B2 (en) | 2006-03-17 | 2011-06-28 | Airdefense, Inc. | Systems and methods for wireless security using distributed collaboration of wireless clients |
KR100748246B1 (en) * | 2006-03-29 | 2007-08-10 | 한국전자통신연구원 | Multi-step integrated security monitoring system and method using intrusion detection system log collection engine and traffic statistic generation engine |
US8726020B2 (en) * | 2006-05-31 | 2014-05-13 | Microsoft Corporation | Updating configuration information to a perimeter network |
US8028026B2 (en) * | 2006-05-31 | 2011-09-27 | Microsoft Corporation | Perimeter message filtering with extracted user-specific preferences |
US8549295B2 (en) * | 2006-05-31 | 2013-10-01 | Microsoft Corporation | Establishing secure, mutually authenticated communication credentials |
US7970013B2 (en) | 2006-06-16 | 2011-06-28 | Airdefense, Inc. | Systems and methods for wireless network content filtering |
US20080010538A1 (en) * | 2006-06-27 | 2008-01-10 | Symantec Corporation | Detecting suspicious embedded malicious content in benign file formats |
US7948988B2 (en) * | 2006-07-27 | 2011-05-24 | Sourcefire, Inc. | Device, system and method for analysis of fragments in a fragment train |
US8166113B2 (en) * | 2006-08-02 | 2012-04-24 | Microsoft Corporation | Access limited EMM distribution lists |
US8281392B2 (en) | 2006-08-11 | 2012-10-02 | Airdefense, Inc. | Methods and systems for wired equivalent privacy and Wi-Fi protected access protection |
WO2008045302A2 (en) * | 2006-10-06 | 2008-04-17 | Sourcefire, Inc. | Device, system and method for use of micro-policies in intrusion detection/prevention |
US8763114B2 (en) | 2007-01-24 | 2014-06-24 | Mcafee, Inc. | Detecting image spam |
US7779156B2 (en) | 2007-01-24 | 2010-08-17 | Mcafee, Inc. | Reputation based load balancing |
US7949716B2 (en) | 2007-01-24 | 2011-05-24 | Mcafee, Inc. | Correlation and analysis of entity attributes |
US8179798B2 (en) | 2007-01-24 | 2012-05-15 | Mcafee, Inc. | Reputation based connection throttling |
US8214497B2 (en) | 2007-01-24 | 2012-07-03 | Mcafee, Inc. | Multi-dimensional reputation scoring |
US20080196104A1 (en) * | 2007-02-09 | 2008-08-14 | George Tuvell | Off-line mms malware scanning system and method |
US8069352B2 (en) * | 2007-02-28 | 2011-11-29 | Sourcefire, Inc. | Device, system and method for timestamp analysis of segments in a transmission control protocol (TCP) session |
US8413247B2 (en) * | 2007-03-14 | 2013-04-02 | Microsoft Corporation | Adaptive data collection for root-cause analysis and intrusion detection |
US8955105B2 (en) * | 2007-03-14 | 2015-02-10 | Microsoft Corporation | Endpoint enabled for enterprise security assessment sharing |
US8959568B2 (en) * | 2007-03-14 | 2015-02-17 | Microsoft Corporation | Enterprise security assessment sharing |
US20080229419A1 (en) * | 2007-03-16 | 2008-09-18 | Microsoft Corporation | Automated identification of firewall malware scanner deficiencies |
US20080244742A1 (en) * | 2007-04-02 | 2008-10-02 | Microsoft Corporation | Detecting adversaries by correlating detected malware with web access logs |
CA2685292C (en) * | 2007-04-30 | 2013-09-24 | Sourcefire, Inc. | Real-time user awareness for a computer network |
US20080307526A1 (en) * | 2007-06-07 | 2008-12-11 | Mi5 Networks | Method to perform botnet detection |
KR20090011481A (en) * | 2007-07-26 | 2009-02-02 | 삼성전자주식회사 | Method for intrusion detecting in a terminal device and apparatus therefor |
US8291495B1 (en) | 2007-08-08 | 2012-10-16 | Juniper Networks, Inc. | Identifying applications for intrusion detection systems |
US8214895B2 (en) * | 2007-09-26 | 2012-07-03 | Microsoft Corporation | Whitelist and blacklist identification data |
US8286243B2 (en) * | 2007-10-23 | 2012-10-09 | International Business Machines Corporation | Blocking intrusion attacks at an offending host |
US20090113039A1 (en) * | 2007-10-25 | 2009-04-30 | At&T Knowledge Ventures, L.P. | Method and system for content handling |
US8185930B2 (en) | 2007-11-06 | 2012-05-22 | Mcafee, Inc. | Adjusting filter or classification control settings |
US8045458B2 (en) | 2007-11-08 | 2011-10-25 | Mcafee, Inc. | Prioritizing network traffic |
US8112800B1 (en) | 2007-11-08 | 2012-02-07 | Juniper Networks, Inc. | Multi-layered application classification and decoding |
US8160975B2 (en) | 2008-01-25 | 2012-04-17 | Mcafee, Inc. | Granular support vector machine with random granularity |
US9264441B2 (en) * | 2008-03-24 | 2016-02-16 | Hewlett Packard Enterprise Development Lp | System and method for securing a network from zero-day vulnerability exploits |
US8589503B2 (en) | 2008-04-04 | 2013-11-19 | Mcafee, Inc. | Prioritizing network traffic |
US8474043B2 (en) * | 2008-04-17 | 2013-06-25 | Sourcefire, Inc. | Speed and memory optimization of intrusion detection system (IDS) and intrusion prevention system (IPS) rule processing |
US8621608B2 (en) * | 2008-04-29 | 2013-12-31 | Mcafee, Inc. | System, method, and computer program product for dynamically adjusting a level of security applied to a system |
US9779234B2 (en) * | 2008-06-18 | 2017-10-03 | Symantec Corporation | Software reputation establishment and monitoring system and method |
US8856926B2 (en) * | 2008-06-27 | 2014-10-07 | Juniper Networks, Inc. | Dynamic policy provisioning within network security devices |
US20090328210A1 (en) * | 2008-06-30 | 2009-12-31 | Microsoft Corporation | Chain of events tracking with data tainting for automated security feedback |
US7995496B2 (en) * | 2008-08-20 | 2011-08-09 | The Boeing Company | Methods and systems for internet protocol (IP) traffic conversation detection and storage |
US8762515B2 (en) * | 2008-08-20 | 2014-06-24 | The Boeing Company | Methods and systems for collection, tracking, and display of near real time multicast data |
US7903566B2 (en) * | 2008-08-20 | 2011-03-08 | The Boeing Company | Methods and systems for anomaly detection using internet protocol (IP) traffic conversation data |
US8726382B2 (en) * | 2008-08-20 | 2014-05-13 | The Boeing Company | Methods and systems for automated detection and tracking of network attacks |
US8813220B2 (en) * | 2008-08-20 | 2014-08-19 | The Boeing Company | Methods and systems for internet protocol (IP) packet header collection and storage |
WO2010045089A1 (en) * | 2008-10-08 | 2010-04-22 | Sourcefire, Inc. | Target-based smb and dce/rpc processing for an intrusion detection system or intrusion prevention system |
US8572717B2 (en) | 2008-10-09 | 2013-10-29 | Juniper Networks, Inc. | Dynamic access control policy with port restrictions for a network security appliance |
US7607174B1 (en) * | 2008-12-31 | 2009-10-20 | Kaspersky Lab Zao | Adaptive security for portable information devices |
US7584508B1 (en) | 2008-12-31 | 2009-09-01 | Kaspersky Lab Zao | Adaptive security for information devices |
US9398043B1 (en) * | 2009-03-24 | 2016-07-19 | Juniper Networks, Inc. | Applying fine-grain policy action to encapsulated network attacks |
CN101854340B (en) * | 2009-04-03 | 2015-04-01 | 瞻博网络公司 | Behavior based communication analysis carried out based on access control information |
US8694624B2 (en) * | 2009-05-19 | 2014-04-08 | Symbol Technologies, Inc. | Systems and methods for concurrent wireless local area network access and sensing |
JP5809238B2 (en) | 2010-04-16 | 2015-11-10 | シスコ テクノロジー,インコーポレイテッド | System and method for near real-time network attack detection, and system and method for integrated detection by detection routing |
US9098333B1 (en) | 2010-05-07 | 2015-08-04 | Ziften Technologies, Inc. | Monitoring computer process resource usage |
US8621638B2 (en) | 2010-05-14 | 2013-12-31 | Mcafee, Inc. | Systems and methods for classification of messaging entities |
US9552478B2 (en) | 2010-05-18 | 2017-01-24 | AO Kaspersky Lab | Team security for portable information devices |
US8433790B2 (en) | 2010-06-11 | 2013-04-30 | Sourcefire, Inc. | System and method for assigning network blocks to sensors |
US8671182B2 (en) | 2010-06-22 | 2014-03-11 | Sourcefire, Inc. | System and method for resolving operating system or service identity conflicts |
KR101188307B1 (en) | 2010-12-24 | 2012-10-09 | (주) 세인트 시큐리티 | System and method of network activity monitoring to particular process |
US8499348B1 (en) * | 2010-12-28 | 2013-07-30 | Amazon Technologies, Inc. | Detection of and responses to network attacks |
US8601034B2 (en) | 2011-03-11 | 2013-12-03 | Sourcefire, Inc. | System and method for real time data awareness |
US9467360B2 (en) * | 2011-06-27 | 2016-10-11 | Sk Telecom Co., Ltd. | System, device and method for managing network traffic by using monitoring and filtering policies |
WO2014038737A1 (en) * | 2012-09-07 | 2014-03-13 | 에스케이텔레콤 주식회사 | Network traffic management system using monitoring policy and filtering policy, and method thereof |
US8955128B1 (en) | 2011-07-27 | 2015-02-10 | Francesco Trama | Systems and methods for selectively regulating network traffic |
US8707434B2 (en) | 2011-08-17 | 2014-04-22 | Mcafee, Inc. | System and method for indirect interface monitoring and plumb-lining |
US8881258B2 (en) * | 2011-08-24 | 2014-11-04 | Mcafee, Inc. | System, method, and computer program for preventing infections from spreading in a network environment using dynamic application of a firewall policy |
US10620241B2 (en) | 2012-02-17 | 2020-04-14 | Perspecta Labs Inc. | Method and system for packet acquisition, analysis and intrusion detection in field area networks |
EP2815282A4 (en) | 2012-02-17 | 2015-08-19 | Vencore Labs Inc | Method and system for packet acquisition, analysis and intrusion detection in field area networks |
US8776180B2 (en) | 2012-05-01 | 2014-07-08 | Taasera, Inc. | Systems and methods for using reputation scores in network services and transactions to calculate security risks to computer systems and platforms |
CN103810424B (en) * | 2012-11-05 | 2017-02-08 | 腾讯科技(深圳)有限公司 | Method and device for identifying abnormal application programs |
GB2508174B (en) * | 2012-11-22 | 2015-04-08 | F Secure Corp | Detecting application behavior |
US9304955B2 (en) * | 2012-12-18 | 2016-04-05 | Advanced Micro Devices, Inc. | Techniques for identifying and handling processor interrupts |
US10097417B2 (en) | 2013-01-24 | 2018-10-09 | Vencore Labs, Inc. | Method and system for visualizing and analyzing a field area network |
US9245147B1 (en) * | 2013-01-30 | 2016-01-26 | White Badger Group, LLC | State machine reference monitor for information system security |
US8910285B2 (en) | 2013-04-19 | 2014-12-09 | Lastline, Inc. | Methods and systems for reciprocal generation of watch-lists and malware signatures |
US9910982B2 (en) | 2013-05-25 | 2018-03-06 | North Carolina State University | Large-scale, time-sensitive secure distributed control systems and methods |
US10084791B2 (en) | 2013-08-14 | 2018-09-25 | Daniel Chien | Evaluating a questionable network communication |
US9246935B2 (en) | 2013-10-14 | 2016-01-26 | Intuit Inc. | Method and system for dynamic and comprehensive vulnerability management |
US9313281B1 (en) | 2013-11-13 | 2016-04-12 | Intuit Inc. | Method and system for creating and dynamically deploying resource specific discovery agents for determining the state of a cloud computing environment |
US9501345B1 (en) | 2013-12-23 | 2016-11-22 | Intuit Inc. | Method and system for creating enriched log data |
US9323926B2 (en) | 2013-12-30 | 2016-04-26 | Intuit Inc. | Method and system for intrusion and extrusion detection |
US20150215327A1 (en) * | 2014-01-28 | 2015-07-30 | Intuit Inc. | Method and system for extrusion and intrusion detection in a cloud computing environment using network communications devices |
US9325726B2 (en) | 2014-02-03 | 2016-04-26 | Intuit Inc. | Method and system for virtual asset assisted extrusion and intrusion detection in a cloud computing environment |
US20150304343A1 (en) | 2014-04-18 | 2015-10-22 | Intuit Inc. | Method and system for providing self-monitoring, self-reporting, and self-repairing virtual assets in a cloud computing environment |
US10757133B2 (en) | 2014-02-21 | 2020-08-25 | Intuit Inc. | Method and system for creating and deploying virtual assets |
US9866581B2 (en) | 2014-06-30 | 2018-01-09 | Intuit Inc. | Method and system for secure delivery of information to computing environments |
US9276945B2 (en) | 2014-04-07 | 2016-03-01 | Intuit Inc. | Method and system for providing security aware applications |
US9245117B2 (en) | 2014-03-31 | 2016-01-26 | Intuit Inc. | Method and system for comparing different versions of a cloud based application in a production environment using segregated backend systems |
US11294700B2 (en) | 2014-04-18 | 2022-04-05 | Intuit Inc. | Method and system for enabling self-monitoring virtual assets to correlate external events with characteristic patterns associated with the virtual assets |
US9374389B2 (en) | 2014-04-25 | 2016-06-21 | Intuit Inc. | Method and system for ensuring an application conforms with security and regulatory controls prior to deployment |
US10122753B2 (en) | 2014-04-28 | 2018-11-06 | Sophos Limited | Using reputation to avoid false malware detections |
US9917851B2 (en) | 2014-04-28 | 2018-03-13 | Sophos Limited | Intrusion detection using a heartbeat |
US9392015B2 (en) * | 2014-04-28 | 2016-07-12 | Sophos Limited | Advanced persistent threat detection |
US9319415B2 (en) | 2014-04-30 | 2016-04-19 | Intuit Inc. | Method and system for providing reference architecture pattern-based permissions management |
US9900322B2 (en) | 2014-04-30 | 2018-02-20 | Intuit Inc. | Method and system for providing permissions management |
US9330263B2 (en) | 2014-05-27 | 2016-05-03 | Intuit Inc. | Method and apparatus for automating the building of threat models for the public cloud |
US10102082B2 (en) | 2014-07-31 | 2018-10-16 | Intuit Inc. | Method and system for providing automated self-healing virtual assets |
US9473481B2 (en) | 2014-07-31 | 2016-10-18 | Intuit Inc. | Method and system for providing a virtual asset perimeter |
EP3186921A1 (en) * | 2014-08-28 | 2017-07-05 | Hewlett-Packard Enterprise Development LP | Distributed detection of malicious cloud actors |
US9935829B1 (en) | 2014-09-24 | 2018-04-03 | Amazon Technologies, Inc. | Scalable packet processing service |
US10048974B1 (en) | 2014-09-30 | 2018-08-14 | Amazon Technologies, Inc. | Message-based computation request scheduling |
US9830193B1 (en) | 2014-09-30 | 2017-11-28 | Amazon Technologies, Inc. | Automatic management of low latency computational capacity |
US9146764B1 (en) | 2014-09-30 | 2015-09-29 | Amazon Technologies, Inc. | Processing event messages for user requests to execute program code |
US9323556B2 (en) | 2014-09-30 | 2016-04-26 | Amazon Technologies, Inc. | Programmatic event detection and message generation for requests to execute program code |
US9715402B2 (en) | 2014-09-30 | 2017-07-25 | Amazon Technologies, Inc. | Dynamic code deployment and versioning |
US9678773B1 (en) | 2014-09-30 | 2017-06-13 | Amazon Technologies, Inc. | Low latency computational capacity provisioning |
US9600312B2 (en) | 2014-09-30 | 2017-03-21 | Amazon Technologies, Inc. | Threading as a service |
US9948661B2 (en) | 2014-10-29 | 2018-04-17 | At&T Intellectual Property I, L.P. | Method and apparatus for detecting port scans in a network |
US20160164917A1 (en) | 2014-12-03 | 2016-06-09 | Phantom Cyber Corporation | Action recommendations for computing assets based on enrichment information |
US9537788B2 (en) | 2014-12-05 | 2017-01-03 | Amazon Technologies, Inc. | Automatic determination of resource sizing |
WO2016097757A1 (en) | 2014-12-18 | 2016-06-23 | Sophos Limited | A method and system for network access control based on traffic monitoring and vulnerability detection using process related information |
US9588790B1 (en) | 2015-02-04 | 2017-03-07 | Amazon Technologies, Inc. | Stateful virtual compute system |
US9733967B2 (en) | 2015-02-04 | 2017-08-15 | Amazon Technologies, Inc. | Security protocols for low latency execution of program code |
US9667656B2 (en) | 2015-03-30 | 2017-05-30 | Amazon Technologies, Inc. | Networking flow logs for multi-tenant environments |
US9930103B2 (en) | 2015-04-08 | 2018-03-27 | Amazon Technologies, Inc. | Endpoint management system providing an application programming interface proxy service |
US9785476B2 (en) | 2015-04-08 | 2017-10-10 | Amazon Technologies, Inc. | Endpoint management system and virtual compute system |
US10536357B2 (en) | 2015-06-05 | 2020-01-14 | Cisco Technology, Inc. | Late data detection in data center |
US10142353B2 (en) * | 2015-06-05 | 2018-11-27 | Cisco Technology, Inc. | System for monitoring and managing datacenters |
US20170012923A1 (en) | 2015-07-08 | 2017-01-12 | International Business Machines Corporation | Preventing a user from missing unread documents |
US10148694B1 (en) * | 2015-10-01 | 2018-12-04 | Symantec Corporation | Preventing data loss over network channels by dynamically monitoring file system operations of a process |
US9811434B1 (en) | 2015-12-16 | 2017-11-07 | Amazon Technologies, Inc. | Predictive management of on-demand code execution |
US10754701B1 (en) | 2015-12-16 | 2020-08-25 | Amazon Technologies, Inc. | Executing user-defined code in response to determining that resources expected to be utilized comply with resource restrictions |
US9910713B2 (en) | 2015-12-21 | 2018-03-06 | Amazon Technologies, Inc. | Code execution request routing |
US10067801B1 (en) | 2015-12-21 | 2018-09-04 | Amazon Technologies, Inc. | Acquisition and maintenance of compute capacity |
US10075416B2 (en) | 2015-12-30 | 2018-09-11 | Juniper Networks, Inc. | Network session data sharing |
US10014937B1 (en) | 2016-03-11 | 2018-07-03 | Juniper Networks, Inc. | Timing synchronization and intrusion detection via an optical supervisory channel (OSC) |
US10243971B2 (en) * | 2016-03-25 | 2019-03-26 | Arbor Networks, Inc. | System and method for retrospective network traffic analysis |
US11132213B1 (en) | 2016-03-30 | 2021-09-28 | Amazon Technologies, Inc. | Dependency-based process of pre-existing data sets at an on demand code execution environment |
US10891145B2 (en) | 2016-03-30 | 2021-01-12 | Amazon Technologies, Inc. | Processing pre-existing data sets at an on demand code execution environment |
US10567388B1 (en) | 2016-03-31 | 2020-02-18 | Amazon Technologies, Inc. | Automatic account resource and policy decommissioning |
US9948681B1 (en) * | 2016-03-31 | 2018-04-17 | Amazon Technologies, Inc. | Access control monitoring through policy management |
US10542044B2 (en) | 2016-04-29 | 2020-01-21 | Attivo Networks Inc. | Authentication incident detection and management |
US10102040B2 (en) | 2016-06-29 | 2018-10-16 | Amazon Technologies, Inc | Adjusting variable limit on concurrent code executions |
US10225234B2 (en) * | 2016-08-31 | 2019-03-05 | Fortress Cyber Security, LLC | Systems and methods for geoprocessing-based computing network security |
US11089064B1 (en) | 2016-09-12 | 2021-08-10 | Skyhigh Networks, Llc | Cloud security policy enforcement for custom web applications |
US10798111B2 (en) * | 2016-09-14 | 2020-10-06 | International Business Machines Corporation | Detecting intrusion attempts in data transmission sessions |
US10884787B1 (en) | 2016-09-23 | 2021-01-05 | Amazon Technologies, Inc. | Execution guarantees in an on-demand network code execution system |
US11119813B1 (en) | 2016-09-30 | 2021-09-14 | Amazon Technologies, Inc. | Mapreduce implementation using an on-demand network code execution system |
US10528725B2 (en) | 2016-11-04 | 2020-01-07 | Microsoft Technology Licensing, Llc | IoT security service |
US10972456B2 (en) | 2016-11-04 | 2021-04-06 | Microsoft Technology Licensing, Llc | IoT device authentication |
US10382436B2 (en) | 2016-11-22 | 2019-08-13 | Daniel Chien | Network security based on device identifiers and network addresses |
US10542006B2 (en) | 2016-11-22 | 2020-01-21 | Daniel Chien | Network security based on redirection of questionable network access |
US10491625B2 (en) | 2017-10-03 | 2019-11-26 | International Business Machines Corporation | Retrieving network packets corresponding to detected abnormal application activity |
TWI672605B (en) * | 2017-11-29 | 2019-09-21 | 財團法人資訊工業策進會 | System and method for identifying application layer behavior |
US10564946B1 (en) | 2017-12-13 | 2020-02-18 | Amazon Technologies, Inc. | Dependency handling in an on-demand network code execution system |
US10542025B2 (en) | 2017-12-26 | 2020-01-21 | International Business Machines Corporation | Automatic traffic classification of web applications and services based on dynamic analysis |
US10353678B1 (en) * | 2018-02-05 | 2019-07-16 | Amazon Technologies, Inc. | Detecting code characteristic alterations due to cross-service calls |
US10831898B1 (en) | 2018-02-05 | 2020-11-10 | Amazon Technologies, Inc. | Detecting privilege escalations in code including cross-service calls |
US10733085B1 (en) | 2018-02-05 | 2020-08-04 | Amazon Technologies, Inc. | Detecting impedance mismatches due to cross-service calls |
US10725752B1 (en) | 2018-02-13 | 2020-07-28 | Amazon Technologies, Inc. | Dependency handling in an on-demand network code execution system |
US10776091B1 (en) | 2018-02-26 | 2020-09-15 | Amazon Technologies, Inc. | Logging endpoint in an on-demand code execution system |
CN110213198A (en) * | 2018-02-28 | 2019-09-06 | 中标软件有限公司 | The monitoring method and system of network flow |
US11140020B1 (en) | 2018-03-01 | 2021-10-05 | Amazon Technologies, Inc. | Availability-enhancing gateways for network traffic in virtualized computing environments |
US10862912B2 (en) | 2018-03-23 | 2020-12-08 | Juniper Networks, Inc. | Tracking host threats in a network and enforcing threat policy actions for the host threats |
US10853115B2 (en) | 2018-06-25 | 2020-12-01 | Amazon Technologies, Inc. | Execution of auxiliary functions in an on-demand network code execution system |
US10649749B1 (en) | 2018-06-26 | 2020-05-12 | Amazon Technologies, Inc. | Cross-environment application of tracing information for improved code execution |
US11146569B1 (en) | 2018-06-28 | 2021-10-12 | Amazon Technologies, Inc. | Escalation-resistant secure network services using request-scoped authentication information |
US10949237B2 (en) | 2018-06-29 | 2021-03-16 | Amazon Technologies, Inc. | Operating system customization in an on-demand network code execution system |
US11099870B1 (en) | 2018-07-25 | 2021-08-24 | Amazon Technologies, Inc. | Reducing execution times in an on-demand network code execution system using saved machine states |
US11099917B2 (en) | 2018-09-27 | 2021-08-24 | Amazon Technologies, Inc. | Efficient state maintenance for execution environments in an on-demand code execution system |
US11243953B2 (en) | 2018-09-27 | 2022-02-08 | Amazon Technologies, Inc. | Mapreduce implementation in an on-demand network code execution system and stream data processing system |
US11188622B2 (en) | 2018-09-28 | 2021-11-30 | Daniel Chien | Systems and methods for computer security |
US11943093B1 (en) | 2018-11-20 | 2024-03-26 | Amazon Technologies, Inc. | Network connection recovery after virtual machine transition in an on-demand network code execution system |
US10884812B2 (en) | 2018-12-13 | 2021-01-05 | Amazon Technologies, Inc. | Performance-based hardware emulation in an on-demand network code execution system |
US10848489B2 (en) | 2018-12-14 | 2020-11-24 | Daniel Chien | Timestamp-based authentication with redirection |
US10826912B2 (en) | 2018-12-14 | 2020-11-03 | Daniel Chien | Timestamp-based authentication |
US11010188B1 (en) | 2019-02-05 | 2021-05-18 | Amazon Technologies, Inc. | Simulated data object storage using on-demand computation of data objects |
US11861386B1 (en) | 2019-03-22 | 2024-01-02 | Amazon Technologies, Inc. | Application gateways in an on-demand network code execution system |
US11119809B1 (en) | 2019-06-20 | 2021-09-14 | Amazon Technologies, Inc. | Virtualization-based transaction handling in an on-demand network code execution system |
US11159528B2 (en) | 2019-06-28 | 2021-10-26 | Amazon Technologies, Inc. | Authentication to network-services using hosted authentication information |
US11115404B2 (en) | 2019-06-28 | 2021-09-07 | Amazon Technologies, Inc. | Facilitating service connections in serverless code executions |
US11190609B2 (en) | 2019-06-28 | 2021-11-30 | Amazon Technologies, Inc. | Connection pooling for scalable network services |
US11416628B2 (en) | 2019-09-27 | 2022-08-16 | Amazon Technologies, Inc. | User-specific data manipulation system for object storage service based on user-submitted code |
US11394761B1 (en) | 2019-09-27 | 2022-07-19 | Amazon Technologies, Inc. | Execution of user-submitted code on a stream of data |
US10996961B2 (en) | 2019-09-27 | 2021-05-04 | Amazon Technologies, Inc. | On-demand indexing of data in input path of object storage service |
US11263220B2 (en) | 2019-09-27 | 2022-03-01 | Amazon Technologies, Inc. | On-demand execution of object transformation code in output path of object storage service |
US11250007B1 (en) | 2019-09-27 | 2022-02-15 | Amazon Technologies, Inc. | On-demand execution of object combination code in output path of object storage service |
US11023416B2 (en) | 2019-09-27 | 2021-06-01 | Amazon Technologies, Inc. | Data access control system for object storage service based on owner-defined code |
US10908927B1 (en) | 2019-09-27 | 2021-02-02 | Amazon Technologies, Inc. | On-demand execution of object filter code in output path of object storage service |
US11386230B2 (en) | 2019-09-27 | 2022-07-12 | Amazon Technologies, Inc. | On-demand code obfuscation of data in input path of object storage service |
US11360948B2 (en) | 2019-09-27 | 2022-06-14 | Amazon Technologies, Inc. | Inserting owner-specified data processing pipelines into input/output path of object storage service |
US11055112B2 (en) | 2019-09-27 | 2021-07-06 | Amazon Technologies, Inc. | Inserting executions of owner-specified code into input/output path of object storage service |
US11023311B2 (en) | 2019-09-27 | 2021-06-01 | Amazon Technologies, Inc. | On-demand code execution in input path of data uploaded to storage service in multiple data portions |
US11656892B1 (en) | 2019-09-27 | 2023-05-23 | Amazon Technologies, Inc. | Sequential execution of user-submitted code and native functions |
US11106477B2 (en) | 2019-09-27 | 2021-08-31 | Amazon Technologies, Inc. | Execution of owner-specified code during input/output path to object storage service |
US11550944B2 (en) | 2019-09-27 | 2023-01-10 | Amazon Technologies, Inc. | Code execution environment customization system for object storage service |
US11119826B2 (en) | 2019-11-27 | 2021-09-14 | Amazon Technologies, Inc. | Serverless call distribution to implement spillover while avoiding cold starts |
US10942795B1 (en) | 2019-11-27 | 2021-03-09 | Amazon Technologies, Inc. | Serverless call distribution to utilize reserved capacity without inhibiting scaling |
US11677754B2 (en) | 2019-12-09 | 2023-06-13 | Daniel Chien | Access control systems and methods |
US11714682B1 (en) | 2020-03-03 | 2023-08-01 | Amazon Technologies, Inc. | Reclaiming computing resources in an on-demand code execution system |
US11188391B1 (en) | 2020-03-11 | 2021-11-30 | Amazon Technologies, Inc. | Allocating resources to on-demand code executions under scarcity conditions |
US11775640B1 (en) | 2020-03-30 | 2023-10-03 | Amazon Technologies, Inc. | Resource utilization-based malicious task detection in an on-demand code execution system |
US11509463B2 (en) | 2020-05-31 | 2022-11-22 | Daniel Chien | Timestamp-based shared key generation |
US11438145B2 (en) | 2020-05-31 | 2022-09-06 | Daniel Chien | Shared key generation based on dual clocks |
US11593270B1 (en) | 2020-11-25 | 2023-02-28 | Amazon Technologies, Inc. | Fast distributed caching using erasure coded object parts |
US11550713B1 (en) | 2020-11-25 | 2023-01-10 | Amazon Technologies, Inc. | Garbage collection in distributed systems using life cycled storage roots |
US11388210B1 (en) | 2021-06-30 | 2022-07-12 | Amazon Technologies, Inc. | Streaming analytics using a serverless compute system |
US20220014551A1 (en) * | 2021-09-24 | 2022-01-13 | Intel Corporation | Method and apparatus to reduce risk of denial of service resource acquisition attacks in a data center |
EP4235470A1 (en) | 2022-03-25 | 2023-08-30 | ZOE Life Technologies AG | Method and network component for protecting networked infrastructures |
Citations (76)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5008936A (en) * | 1988-12-09 | 1991-04-16 | The Exchange System Limited Partnership | Backup/restore technique in a microcomputer-based encryption system |
US5421006A (en) * | 1992-05-07 | 1995-05-30 | Compaq Computer Corp. | Method and apparatus for assessing integrity of computer system software |
US5787409A (en) * | 1996-05-17 | 1998-07-28 | International Business Machines Corporation | Dynamic monitoring architecture |
US5802275A (en) * | 1994-06-22 | 1998-09-01 | Lucent Technologies Inc. | Isolation of non-secure software from secure software to limit virus infection |
US5919257A (en) * | 1997-08-08 | 1999-07-06 | Novell, Inc. | Networked workstation intrusion detection system |
US5948104A (en) * | 1997-05-23 | 1999-09-07 | Neuromedical Systems, Inc. | System and method for automated anti-viral file update |
US5960798A (en) * | 1998-02-26 | 1999-10-05 | Fashion Nails, Inc. | Method and apparatus for creating art on an object such as a person's fingernail or toenail |
US5970143A (en) * | 1995-11-22 | 1999-10-19 | Walker Asset Management Lp | Remote-auditing of computer generated outcomes, authenticated billing and access control, and software metering system using cryptographic and other protocols |
US5978936A (en) * | 1997-11-19 | 1999-11-02 | International Business Machines Corporation | Run time error probe in a network computing environment |
US5983348A (en) * | 1997-09-10 | 1999-11-09 | Trend Micro Incorporated | Computer network malicious code scanner |
US5987611A (en) * | 1996-12-31 | 1999-11-16 | Zone Labs, Inc. | System and methodology for managing internet access on a per application basis for client computers connected to the internet |
US6065118A (en) * | 1996-08-09 | 2000-05-16 | Citrix Systems, Inc. | Mobile code isolation cage |
US6219706B1 (en) * | 1998-10-16 | 2001-04-17 | Cisco Technology, Inc. | Access control for networks |
US6266811B1 (en) * | 1997-12-31 | 2001-07-24 | Network Associates | Method and system for custom computer software installation using rule-based installation engine and simplified script computer program |
US6279113B1 (en) * | 1998-03-16 | 2001-08-21 | Internet Tools, Inc. | Dynamic signature inspection-based network intrusion detection |
US6282546B1 (en) * | 1998-06-30 | 2001-08-28 | Cisco Technology, Inc. | System and method for real-time insertion of data into a multi-dimensional database for network intrusion detection and vulnerability assessment |
US6301668B1 (en) * | 1998-12-29 | 2001-10-09 | Cisco Technology, Inc. | Method and system for adaptive network security using network vulnerability assessment |
US20010052012A1 (en) * | 2000-06-30 | 2001-12-13 | Rinne Janne Petri | Quality of service definition for data streams |
US20020010771A1 (en) * | 2000-05-24 | 2002-01-24 | Davide Mandato | Universal QoS adaptation framework for mobile multimedia applications |
US6370584B1 (en) * | 1998-01-13 | 2002-04-09 | Trustees Of Boston University | Distributed routing |
US6411941B1 (en) * | 1998-05-21 | 2002-06-25 | Beeble, Inc. | Method of restricting software operation within a license limitation |
US20020103720A1 (en) * | 2001-01-29 | 2002-08-01 | Cline Linda S. | Extensible network services system |
US20020120853A1 (en) * | 2001-02-27 | 2002-08-29 | Networks Associates Technology, Inc. | Scripted distributed denial-of-service (DDoS) attack discrimination using turing tests |
US20020129278A1 (en) * | 1998-10-15 | 2002-09-12 | Doron Elgressy | Method and system for the prevention of undesirable activities of executable objects |
US20020143911A1 (en) * | 2001-03-30 | 2002-10-03 | John Vicente | Host-based network traffic control system |
US20020143914A1 (en) * | 2001-03-29 | 2002-10-03 | Cihula Joseph F. | Network-aware policy deployment |
US6463470B1 (en) * | 1998-10-26 | 2002-10-08 | Cisco Technology, Inc. | Method and apparatus of storing policies for policy-based management of quality of service treatments of network data traffic flows |
US6466984B1 (en) * | 1999-07-02 | 2002-10-15 | Cisco Technology, Inc. | Method and apparatus for policy-based management of quality of service treatments of network data traffic flows by integrating policies with application programs |
US6484203B1 (en) * | 1998-11-09 | 2002-11-19 | Sri International, Inc. | Hierarchical event monitoring and analysis |
US6496483B1 (en) * | 1999-08-18 | 2002-12-17 | At&T Corp. | Secure detection of an intercepted targeted IP phone from multiple monitoring locations |
US20020194317A1 (en) * | 2001-04-26 | 2002-12-19 | Yasusi Kanada | Method and system for controlling a policy-based network |
US6501752B1 (en) * | 1999-08-18 | 2002-12-31 | At&T Corp. | Flexible packet technique for monitoring calls spanning different backbone networks |
US6553377B1 (en) * | 2000-03-31 | 2003-04-22 | Network Associates, Inc. | System and process for maintaining a plurality of remote security applications using a modular framework in a distributed computing environment |
US20030084323A1 (en) * | 2001-10-31 | 2003-05-01 | Gales George S. | Network intrusion detection system and method |
US6574663B1 (en) * | 1999-08-31 | 2003-06-03 | Intel Corporation | Active topology discovery in active networks |
US20030126468A1 (en) * | 2001-05-25 | 2003-07-03 | Markham Thomas R. | Distributed firewall system and method |
US20030149888A1 (en) * | 2002-02-01 | 2003-08-07 | Satyendra Yadav | Integrated network intrusion detection |
US20030149887A1 (en) * | 2002-02-01 | 2003-08-07 | Satyendra Yadav | Application-specific network intrusion detection |
US20030159070A1 (en) * | 2001-05-28 | 2003-08-21 | Yaron Mayer | System and method for comprehensive general generic protection for computers against malicious programs that may steal information and/or cause damages |
US20030200439A1 (en) * | 2002-04-17 | 2003-10-23 | Moskowitz Scott A. | Methods, systems and devices for packet watermarking and efficient provisioning of bandwidth |
US6640248B1 (en) * | 1998-07-10 | 2003-10-28 | Malibu Networks, Inc. | Application-aware, quality of service (QoS) sensitive, media access control (MAC) layer |
US20030204596A1 (en) * | 2002-04-29 | 2003-10-30 | Satyendra Yadav | Application-based network quality of service provisioning |
US6665799B1 (en) * | 1999-04-28 | 2003-12-16 | Dvi Acquisition Corp. | Method and computer software code for providing security for a computer software program |
US6681331B1 (en) * | 1999-05-11 | 2004-01-20 | Cylant, Inc. | Dynamic software system intrusion detection |
US6694436B1 (en) * | 1998-05-22 | 2004-02-17 | Activcard | Terminal and system for performing secure electronic transactions |
US6701463B1 (en) * | 2000-09-05 | 2004-03-02 | Motorola, Inc. | Host specific monitor script for networked computer clusters |
US20040078467A1 (en) * | 2000-11-02 | 2004-04-22 | George Grosner | Switching system |
US6735702B1 (en) * | 1999-08-31 | 2004-05-11 | Intel Corporation | Method and system for diagnosing network intrusion |
US6742015B1 (en) * | 1999-08-31 | 2004-05-25 | Accenture Llp | Base services patterns in a netcentric environment |
US6751659B1 (en) * | 2000-03-31 | 2004-06-15 | Intel Corporation | Distributing policy information in a communication network |
US6807156B1 (en) * | 2000-11-07 | 2004-10-19 | Telefonaktiebolaget Lm Ericsson (Publ) | Scalable real-time quality of service monitoring and analysis of service dependent subscriber satisfaction in IP networks |
US6807583B2 (en) * | 1997-09-24 | 2004-10-19 | Carleton University | Method of determining causal connections between events recorded during process execution |
US6816903B1 (en) * | 1997-05-27 | 2004-11-09 | Novell, Inc. | Directory enabled policy management tool for intelligent traffic management |
US6816973B1 (en) * | 1998-12-29 | 2004-11-09 | Cisco Technology, Inc. | Method and system for adaptive network security using intelligent packet analysis |
US6826716B2 (en) * | 2001-09-26 | 2004-11-30 | International Business Machines Corporation | Test programs for enterprise web applications |
US6832260B2 (en) * | 2001-07-26 | 2004-12-14 | International Business Machines Corporation | Methods, systems and computer program products for kernel based transaction processing |
US6842861B1 (en) * | 2000-03-24 | 2005-01-11 | Networks Associates Technology, Inc. | Method and system for detecting viruses on handheld computers |
US6851057B1 (en) * | 1999-11-30 | 2005-02-01 | Symantec Corporation | Data driven detection of viruses |
US6868062B1 (en) * | 2000-03-28 | 2005-03-15 | Intel Corporation | Managing data traffic on multiple ports |
US6871224B1 (en) * | 1999-01-04 | 2005-03-22 | Cisco Technology, Inc. | Facility to transmit network management data to an umbrella management system |
US6879587B1 (en) * | 2000-06-30 | 2005-04-12 | Intel Corporation | Packet processing in a router architecture |
US6892303B2 (en) * | 2000-01-06 | 2005-05-10 | International Business Machines Corporation | Method and system for caching virus-free file certificates |
US20050193218A1 (en) * | 1999-01-22 | 2005-09-01 | Joshua Susser | Techniques for permitting access across a context barrier on a small footprint device using an entry point object |
US6952776B1 (en) * | 1999-09-22 | 2005-10-04 | International Business Machines Corporation | Method and apparatus for increasing virus detection speed using a database |
US6957348B1 (en) * | 2000-01-10 | 2005-10-18 | Ncircle Network Security, Inc. | Interoperability of vulnerability and intrusion detection systems |
US6971015B1 (en) * | 2000-03-29 | 2005-11-29 | Microsoft Corporation | Methods and arrangements for limiting access to computer controlled functions and devices |
US6973577B1 (en) * | 2000-05-26 | 2005-12-06 | Mcafee, Inc. | System and method for dynamically detecting computer viruses through associative behavioral analysis of runtime state |
US6996845B1 (en) * | 2000-11-28 | 2006-02-07 | S.P.I. Dynamics Incorporated | Internet security analysis system and process |
US6996843B1 (en) * | 1999-08-30 | 2006-02-07 | Symantec Corporation | System and method for detecting computer intrusions |
US7065790B1 (en) * | 2001-12-21 | 2006-06-20 | Mcafee, Inc. | Method and system for providing computer malware names from multiple anti-virus scanners |
US7069330B1 (en) * | 2001-07-05 | 2006-06-27 | Mcafee, Inc. | Control of interaction between client computer applications and network resources |
US7089294B1 (en) * | 2000-08-24 | 2006-08-08 | International Business Machines Corporation | Methods, systems and computer program products for server based type of service classification of a communication request |
US7103666B2 (en) * | 2001-01-12 | 2006-09-05 | Siemens Medical Solutions Health Services Corporation | System and user interface supporting concurrent application operation and interoperability |
US7171688B2 (en) * | 2001-06-25 | 2007-01-30 | Intel Corporation | System, method and computer program for the detection and restriction of the network activity of denial of service attack software |
US7181768B1 (en) * | 1999-10-28 | 2007-02-20 | Cigital | Computer intrusion detection system and method based on application monitoring |
US7225430B2 (en) * | 2001-07-26 | 2007-05-29 | Landesk Software Limited | Software code management method and apparatus |
Family Cites Families (38)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5398196A (en) | 1993-07-29 | 1995-03-14 | Chambers; David A. | Method and apparatus for detection of computer viruses |
US5864683A (en) * | 1994-10-12 | 1999-01-26 | Secure Computing Corporartion | System for providing secure internetwork by connecting type enforcing secure computers to external network for limiting access to data based on user and process access rights |
US5623601A (en) * | 1994-11-18 | 1997-04-22 | Milkway Networks Corporation | Apparatus and method for providing a secure gateway for communication and data exchanges between networks |
WO1997005551A1 (en) | 1995-07-31 | 1997-02-13 | Verifone, Inc. | Method and apparatus for operating resources under control of a security module or other secure processor |
US6072857A (en) * | 1996-12-19 | 2000-06-06 | Bellsouth Intellectual Property Management Corporation | Methods and system for monitoring the operational status of a network component in an advanced intelligent network |
US5968176A (en) * | 1997-05-29 | 1999-10-19 | 3Com Corporation | Multilayer firewall system |
US6104700A (en) | 1997-08-29 | 2000-08-15 | Extreme Networks | Policy based quality of service |
US6400707B1 (en) * | 1998-08-27 | 2002-06-04 | Bell Atlantic Network Services, Inc. | Real time firewall security |
US6158010A (en) * | 1998-10-28 | 2000-12-05 | Crosslogix, Inc. | System and method for maintaining security in a distributed computer network |
IL143573A0 (en) | 1998-12-09 | 2002-04-21 | Network Ice Corp | A method and apparatus for providing network and computer system security |
US6725377B1 (en) * | 1999-03-12 | 2004-04-20 | Networks Associates Technology, Inc. | Method and system for updating anti-intrusion software |
US6981155B1 (en) | 1999-07-14 | 2005-12-27 | Symantec Corporation | System and method for computer security |
US7089591B1 (en) | 1999-07-30 | 2006-08-08 | Symantec Corporation | Generic detection and elimination of marco viruses |
US6226811B1 (en) * | 1999-11-05 | 2001-05-08 | Edwin W. Fagan | Epidermal scrubbing device |
US6990591B1 (en) | 1999-11-18 | 2006-01-24 | Secureworks, Inc. | Method and system for remotely configuring and monitoring a communication device |
US7822629B2 (en) * | 1999-12-15 | 2010-10-26 | Hewlett-Packard Development Company, L.P. | Customer profiling apparatus for conducting customer behavior pattern analysis, and method for comparing customer behavior patterns |
AUPQ621600A0 (en) * | 2000-03-14 | 2000-04-06 | Overs, Ronald Ernest | Grand piano action |
US7159237B2 (en) | 2000-03-16 | 2007-01-02 | Counterpane Internet Security, Inc. | Method and system for dynamic network intrusion monitoring, detection and response |
US7574740B1 (en) | 2000-04-28 | 2009-08-11 | International Business Machines Corporation | Method and system for intrusion detection in a computer network |
US20020069356A1 (en) * | 2000-06-12 | 2002-06-06 | Kwang Tae Kim | Integrated security gateway apparatus |
US7024694B1 (en) * | 2000-06-13 | 2006-04-04 | Mcafee, Inc. | Method and apparatus for content-based instrusion detection using an agile kernel-based auditor |
US20020032871A1 (en) * | 2000-09-08 | 2002-03-14 | The Regents Of The University Of Michigan | Method and system for detecting, tracking and blocking denial of service attacks over a computer network |
US9027121B2 (en) * | 2000-10-10 | 2015-05-05 | International Business Machines Corporation | Method and system for creating a record for one or more computer security incidents |
US20060212572A1 (en) * | 2000-10-17 | 2006-09-21 | Yehuda Afek | Protecting against malicious traffic |
US7150045B2 (en) * | 2000-12-14 | 2006-12-12 | Widevine Technologies, Inc. | Method and apparatus for protection of electronic media |
EP1381928B1 (en) * | 2001-01-10 | 2008-12-31 | Cisco Technology, Inc. | Computer security and management system |
US7237264B1 (en) * | 2001-06-04 | 2007-06-26 | Internet Security Systems, Inc. | System and method for preventing network misuse |
US7039953B2 (en) * | 2001-08-30 | 2006-05-02 | International Business Machines Corporation | Hierarchical correlation of intrusion detection events |
US6928556B2 (en) * | 2001-08-30 | 2005-08-09 | International Business Machines Corporation | Method and apparatus in a data processing system for managing situations from correlated events |
US7331061B1 (en) * | 2001-09-07 | 2008-02-12 | Secureworks, Inc. | Integrated computer security management system and method |
US7836503B2 (en) * | 2001-10-31 | 2010-11-16 | Hewlett-Packard Development Company, L.P. | Node, method and computer readable medium for optimizing performance of signature rule matching in a network |
US7197762B2 (en) * | 2001-10-31 | 2007-03-27 | Hewlett-Packard Development Company, L.P. | Method, computer readable medium, and node for a three-layered intrusion prevention system for detecting network exploits |
US20030101353A1 (en) * | 2001-10-31 | 2003-05-29 | Tarquini Richard Paul | Method, computer-readable medium, and node for detecting exploits based on an inbound signature of the exploit and an outbound signature in response thereto |
US6546493B1 (en) * | 2001-11-30 | 2003-04-08 | Networks Associates Technology, Inc. | System, method and computer program product for risk assessment scanning based on detected anomalous events |
US7150043B2 (en) * | 2001-12-12 | 2006-12-12 | International Business Machines Corporation | Intrusion detection method and signature table |
WO2003063449A1 (en) * | 2002-01-18 | 2003-07-31 | Metrowerks Corporation | System and method for monitoring network security |
US7222366B2 (en) * | 2002-01-28 | 2007-05-22 | International Business Machines Corporation | Intrusion event filtering |
US7076803B2 (en) * | 2002-01-28 | 2006-07-11 | International Business Machines Corporation | Integrated intrusion detection services |
-
2002
- 2002-02-01 US US10/066,140 patent/US7174566B2/en active Active
-
2003
- 2003-01-24 WO PCT/US2003/002185 patent/WO2003067847A2/en not_active Application Discontinuation
- 2003-01-24 AU AU2003225531A patent/AU2003225531A1/en not_active Abandoned
- 2003-01-24 EP EP20030737553 patent/EP1470691B1/en not_active Expired - Lifetime
- 2003-01-24 EP EP14001691.6A patent/EP2790372B1/en not_active Expired - Lifetime
- 2003-01-24 EP EP20100011583 patent/EP2276216B1/en not_active Expired - Lifetime
-
2004
- 2004-11-12 HK HK04108946A patent/HK1067823A1/en not_active IP Right Cessation
-
2007
- 2007-02-05 US US11/702,908 patent/US20070209070A1/en not_active Abandoned
-
2009
- 2009-12-29 US US12/649,018 patent/US8752173B2/en not_active Expired - Lifetime
-
2014
- 2014-06-10 US US14/300,420 patent/US9143525B2/en not_active Expired - Fee Related
-
2015
- 2015-09-22 US US14/861,232 patent/US10044738B2/en not_active Expired - Fee Related
-
2018
- 2018-05-17 US US15/982,318 patent/US10771484B2/en not_active Expired - Lifetime
Patent Citations (80)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5008936A (en) * | 1988-12-09 | 1991-04-16 | The Exchange System Limited Partnership | Backup/restore technique in a microcomputer-based encryption system |
US5421006A (en) * | 1992-05-07 | 1995-05-30 | Compaq Computer Corp. | Method and apparatus for assessing integrity of computer system software |
US5802275A (en) * | 1994-06-22 | 1998-09-01 | Lucent Technologies Inc. | Isolation of non-secure software from secure software to limit virus infection |
US5970143A (en) * | 1995-11-22 | 1999-10-19 | Walker Asset Management Lp | Remote-auditing of computer generated outcomes, authenticated billing and access control, and software metering system using cryptographic and other protocols |
US5787409A (en) * | 1996-05-17 | 1998-07-28 | International Business Machines Corporation | Dynamic monitoring architecture |
US6065118A (en) * | 1996-08-09 | 2000-05-16 | Citrix Systems, Inc. | Mobile code isolation cage |
US5987611A (en) * | 1996-12-31 | 1999-11-16 | Zone Labs, Inc. | System and methodology for managing internet access on a per application basis for client computers connected to the internet |
US5948104A (en) * | 1997-05-23 | 1999-09-07 | Neuromedical Systems, Inc. | System and method for automated anti-viral file update |
US6816903B1 (en) * | 1997-05-27 | 2004-11-09 | Novell, Inc. | Directory enabled policy management tool for intelligent traffic management |
US5919257A (en) * | 1997-08-08 | 1999-07-06 | Novell, Inc. | Networked workstation intrusion detection system |
US5983348A (en) * | 1997-09-10 | 1999-11-09 | Trend Micro Incorporated | Computer network malicious code scanner |
US6272641B1 (en) * | 1997-09-10 | 2001-08-07 | Trend Micro, Inc. | Computer network malicious code scanner method and apparatus |
US6807583B2 (en) * | 1997-09-24 | 2004-10-19 | Carleton University | Method of determining causal connections between events recorded during process execution |
US5978936A (en) * | 1997-11-19 | 1999-11-02 | International Business Machines Corporation | Run time error probe in a network computing environment |
US6266811B1 (en) * | 1997-12-31 | 2001-07-24 | Network Associates | Method and system for custom computer software installation using rule-based installation engine and simplified script computer program |
US6370584B1 (en) * | 1998-01-13 | 2002-04-09 | Trustees Of Boston University | Distributed routing |
US5960798A (en) * | 1998-02-26 | 1999-10-05 | Fashion Nails, Inc. | Method and apparatus for creating art on an object such as a person's fingernail or toenail |
US6279113B1 (en) * | 1998-03-16 | 2001-08-21 | Internet Tools, Inc. | Dynamic signature inspection-based network intrusion detection |
US6411941B1 (en) * | 1998-05-21 | 2002-06-25 | Beeble, Inc. | Method of restricting software operation within a license limitation |
US6694436B1 (en) * | 1998-05-22 | 2004-02-17 | Activcard | Terminal and system for performing secure electronic transactions |
US6282546B1 (en) * | 1998-06-30 | 2001-08-28 | Cisco Technology, Inc. | System and method for real-time insertion of data into a multi-dimensional database for network intrusion detection and vulnerability assessment |
US6640248B1 (en) * | 1998-07-10 | 2003-10-28 | Malibu Networks, Inc. | Application-aware, quality of service (QoS) sensitive, media access control (MAC) layer |
US20020129278A1 (en) * | 1998-10-15 | 2002-09-12 | Doron Elgressy | Method and system for the prevention of undesirable activities of executable objects |
US6219706B1 (en) * | 1998-10-16 | 2001-04-17 | Cisco Technology, Inc. | Access control for networks |
US6463470B1 (en) * | 1998-10-26 | 2002-10-08 | Cisco Technology, Inc. | Method and apparatus of storing policies for policy-based management of quality of service treatments of network data traffic flows |
US6484203B1 (en) * | 1998-11-09 | 2002-11-19 | Sri International, Inc. | Hierarchical event monitoring and analysis |
US6301668B1 (en) * | 1998-12-29 | 2001-10-09 | Cisco Technology, Inc. | Method and system for adaptive network security using network vulnerability assessment |
US6816973B1 (en) * | 1998-12-29 | 2004-11-09 | Cisco Technology, Inc. | Method and system for adaptive network security using intelligent packet analysis |
US6871224B1 (en) * | 1999-01-04 | 2005-03-22 | Cisco Technology, Inc. | Facility to transmit network management data to an umbrella management system |
US20050193218A1 (en) * | 1999-01-22 | 2005-09-01 | Joshua Susser | Techniques for permitting access across a context barrier on a small footprint device using an entry point object |
US6665799B1 (en) * | 1999-04-28 | 2003-12-16 | Dvi Acquisition Corp. | Method and computer software code for providing security for a computer software program |
US6681331B1 (en) * | 1999-05-11 | 2004-01-20 | Cylant, Inc. | Dynamic software system intrusion detection |
US6466984B1 (en) * | 1999-07-02 | 2002-10-15 | Cisco Technology, Inc. | Method and apparatus for policy-based management of quality of service treatments of network data traffic flows by integrating policies with application programs |
US6496483B1 (en) * | 1999-08-18 | 2002-12-17 | At&T Corp. | Secure detection of an intercepted targeted IP phone from multiple monitoring locations |
US6501752B1 (en) * | 1999-08-18 | 2002-12-31 | At&T Corp. | Flexible packet technique for monitoring calls spanning different backbone networks |
US6996843B1 (en) * | 1999-08-30 | 2006-02-07 | Symantec Corporation | System and method for detecting computer intrusions |
US6574663B1 (en) * | 1999-08-31 | 2003-06-03 | Intel Corporation | Active topology discovery in active networks |
US6742015B1 (en) * | 1999-08-31 | 2004-05-25 | Accenture Llp | Base services patterns in a netcentric environment |
US6735702B1 (en) * | 1999-08-31 | 2004-05-11 | Intel Corporation | Method and system for diagnosing network intrusion |
US6952776B1 (en) * | 1999-09-22 | 2005-10-04 | International Business Machines Corporation | Method and apparatus for increasing virus detection speed using a database |
US7181768B1 (en) * | 1999-10-28 | 2007-02-20 | Cigital | Computer intrusion detection system and method based on application monitoring |
US6851057B1 (en) * | 1999-11-30 | 2005-02-01 | Symantec Corporation | Data driven detection of viruses |
US6892303B2 (en) * | 2000-01-06 | 2005-05-10 | International Business Machines Corporation | Method and system for caching virus-free file certificates |
US6957348B1 (en) * | 2000-01-10 | 2005-10-18 | Ncircle Network Security, Inc. | Interoperability of vulnerability and intrusion detection systems |
US6842861B1 (en) * | 2000-03-24 | 2005-01-11 | Networks Associates Technology, Inc. | Method and system for detecting viruses on handheld computers |
US6868062B1 (en) * | 2000-03-28 | 2005-03-15 | Intel Corporation | Managing data traffic on multiple ports |
US6971015B1 (en) * | 2000-03-29 | 2005-11-29 | Microsoft Corporation | Methods and arrangements for limiting access to computer controlled functions and devices |
US6553377B1 (en) * | 2000-03-31 | 2003-04-22 | Network Associates, Inc. | System and process for maintaining a plurality of remote security applications using a modular framework in a distributed computing environment |
US6751659B1 (en) * | 2000-03-31 | 2004-06-15 | Intel Corporation | Distributing policy information in a communication network |
US20020010771A1 (en) * | 2000-05-24 | 2002-01-24 | Davide Mandato | Universal QoS adaptation framework for mobile multimedia applications |
US6973577B1 (en) * | 2000-05-26 | 2005-12-06 | Mcafee, Inc. | System and method for dynamically detecting computer viruses through associative behavioral analysis of runtime state |
US20010052012A1 (en) * | 2000-06-30 | 2001-12-13 | Rinne Janne Petri | Quality of service definition for data streams |
US6879587B1 (en) * | 2000-06-30 | 2005-04-12 | Intel Corporation | Packet processing in a router architecture |
US7089294B1 (en) * | 2000-08-24 | 2006-08-08 | International Business Machines Corporation | Methods, systems and computer program products for server based type of service classification of a communication request |
US6701463B1 (en) * | 2000-09-05 | 2004-03-02 | Motorola, Inc. | Host specific monitor script for networked computer clusters |
US20040078467A1 (en) * | 2000-11-02 | 2004-04-22 | George Grosner | Switching system |
US6807156B1 (en) * | 2000-11-07 | 2004-10-19 | Telefonaktiebolaget Lm Ericsson (Publ) | Scalable real-time quality of service monitoring and analysis of service dependent subscriber satisfaction in IP networks |
US6996845B1 (en) * | 2000-11-28 | 2006-02-07 | S.P.I. Dynamics Incorporated | Internet security analysis system and process |
US7103666B2 (en) * | 2001-01-12 | 2006-09-05 | Siemens Medical Solutions Health Services Corporation | System and user interface supporting concurrent application operation and interoperability |
US20070043631A1 (en) * | 2001-01-29 | 2007-02-22 | Cline Linda S | Extensible network services system |
US7136908B2 (en) * | 2001-01-29 | 2006-11-14 | Intel Corporation | Extensible network services system |
US20020103720A1 (en) * | 2001-01-29 | 2002-08-01 | Cline Linda S. | Extensible network services system |
US20020120853A1 (en) * | 2001-02-27 | 2002-08-29 | Networks Associates Technology, Inc. | Scripted distributed denial-of-service (DDoS) attack discrimination using turing tests |
US20020143914A1 (en) * | 2001-03-29 | 2002-10-03 | Cihula Joseph F. | Network-aware policy deployment |
US20020143911A1 (en) * | 2001-03-30 | 2002-10-03 | John Vicente | Host-based network traffic control system |
US20020194317A1 (en) * | 2001-04-26 | 2002-12-19 | Yasusi Kanada | Method and system for controlling a policy-based network |
US20030126468A1 (en) * | 2001-05-25 | 2003-07-03 | Markham Thomas R. | Distributed firewall system and method |
US20030159070A1 (en) * | 2001-05-28 | 2003-08-21 | Yaron Mayer | System and method for comprehensive general generic protection for computers against malicious programs that may steal information and/or cause damages |
US7171688B2 (en) * | 2001-06-25 | 2007-01-30 | Intel Corporation | System, method and computer program for the detection and restriction of the network activity of denial of service attack software |
US7069330B1 (en) * | 2001-07-05 | 2006-06-27 | Mcafee, Inc. | Control of interaction between client computer applications and network resources |
US7225430B2 (en) * | 2001-07-26 | 2007-05-29 | Landesk Software Limited | Software code management method and apparatus |
US6832260B2 (en) * | 2001-07-26 | 2004-12-14 | International Business Machines Corporation | Methods, systems and computer program products for kernel based transaction processing |
US6826716B2 (en) * | 2001-09-26 | 2004-11-30 | International Business Machines Corporation | Test programs for enterprise web applications |
US20030084323A1 (en) * | 2001-10-31 | 2003-05-01 | Gales George S. | Network intrusion detection system and method |
US7065790B1 (en) * | 2001-12-21 | 2006-06-20 | Mcafee, Inc. | Method and system for providing computer malware names from multiple anti-virus scanners |
US20030149888A1 (en) * | 2002-02-01 | 2003-08-07 | Satyendra Yadav | Integrated network intrusion detection |
US7174566B2 (en) * | 2002-02-01 | 2007-02-06 | Intel Corporation | Integrated network intrusion detection |
US20030149887A1 (en) * | 2002-02-01 | 2003-08-07 | Satyendra Yadav | Application-specific network intrusion detection |
US20030200439A1 (en) * | 2002-04-17 | 2003-10-23 | Moskowitz Scott A. | Methods, systems and devices for packet watermarking and efficient provisioning of bandwidth |
US20030204596A1 (en) * | 2002-04-29 | 2003-10-30 | Satyendra Yadav | Application-based network quality of service provisioning |
Cited By (30)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10044738B2 (en) | 2002-02-01 | 2018-08-07 | Intel Corporation | Integrated network intrusion detection |
US20100122317A1 (en) * | 2002-02-01 | 2010-05-13 | Satyendra Yadav | Integrated Network Intrusion Detection |
US8752173B2 (en) | 2002-02-01 | 2014-06-10 | Intel Corporation | Integrated network intrusion detection |
US7761915B2 (en) * | 2005-12-28 | 2010-07-20 | Zyxel Communications Corp. | Terminal and related computer-implemented method for detecting malicious data for computer network |
US20070147239A1 (en) * | 2005-12-28 | 2007-06-28 | Chun-Te Wu | Terminal and Related Computer-Implemented Method for Detecting Malicious Data for Computer Network |
US20080313738A1 (en) * | 2007-06-15 | 2008-12-18 | Broadcom Corporation | Multi-Stage Deep Packet Inspection for Lightweight Devices |
US7853689B2 (en) * | 2007-06-15 | 2010-12-14 | Broadcom Corporation | Multi-stage deep packet inspection for lightweight devices |
US9762546B2 (en) * | 2013-06-27 | 2017-09-12 | Jeong Hoan Seo | Multi-connection system and method for service using internet protocol |
US20160173452A1 (en) * | 2013-06-27 | 2016-06-16 | Jeong Hoan Seo | Multi-connection system and method for service using internet protocol |
US9407602B2 (en) * | 2013-11-07 | 2016-08-02 | Attivo Networks, Inc. | Methods and apparatus for redirecting attacks on a network |
US20150128246A1 (en) * | 2013-11-07 | 2015-05-07 | Attivo Networks Inc. | Methods and apparatus for redirecting attacks on a network |
US11886591B2 (en) | 2014-08-11 | 2024-01-30 | Sentinel Labs Israel Ltd. | Method of remediating operations performed by a program and system thereof |
US11625485B2 (en) | 2014-08-11 | 2023-04-11 | Sentinel Labs Israel Ltd. | Method of malware detection and system thereof |
US11616812B2 (en) | 2016-12-19 | 2023-03-28 | Attivo Networks Inc. | Deceiving attackers accessing active directory data |
US11695800B2 (en) | 2016-12-19 | 2023-07-04 | SentinelOne, Inc. | Deceiving attackers accessing network data |
US11716342B2 (en) | 2017-08-08 | 2023-08-01 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
US11716341B2 (en) | 2017-08-08 | 2023-08-01 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
US11722506B2 (en) | 2017-08-08 | 2023-08-08 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
US11838305B2 (en) | 2017-08-08 | 2023-12-05 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
US11838306B2 (en) | 2017-08-08 | 2023-12-05 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
US11876819B2 (en) | 2017-08-08 | 2024-01-16 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
US10587521B2 (en) * | 2017-11-07 | 2020-03-10 | Facebook, Inc. | Hierarchical orchestration of a computer network |
US20190140958A1 (en) * | 2017-11-07 | 2019-05-09 | Facebook, Inc. | Hierarchical orchestration of a computer network |
US11888897B2 (en) | 2018-02-09 | 2024-01-30 | SentinelOne, Inc. | Implementing decoys in a network environment |
US11580218B2 (en) | 2019-05-20 | 2023-02-14 | Sentinel Labs Israel Ltd. | Systems and methods for executable code detection, automatic feature extraction and position independent code detection |
US11790079B2 (en) | 2019-05-20 | 2023-10-17 | Sentinel Labs Israel Ltd. | Systems and methods for executable code detection, automatic feature extraction and position independent code detection |
US11579857B2 (en) | 2020-12-16 | 2023-02-14 | Sentinel Labs Israel Ltd. | Systems, methods and devices for device fingerprinting and automatic deployment of software in a computing network using a peer-to-peer approach |
US11748083B2 (en) | 2020-12-16 | 2023-09-05 | Sentinel Labs Israel Ltd. | Systems, methods and devices for device fingerprinting and automatic deployment of software in a computing network using a peer-to-peer approach |
US11899782B1 (en) | 2021-07-13 | 2024-02-13 | SentinelOne, Inc. | Preserving DLL hooks |
US11973781B2 (en) | 2022-04-21 | 2024-04-30 | Sentinel Labs Israel Ltd. | Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking |
Also Published As
Publication number | Publication date |
---|---|
EP1470691A2 (en) | 2004-10-27 |
WO2003067847A2 (en) | 2003-08-14 |
US10044738B2 (en) | 2018-08-07 |
EP2790372B1 (en) | 2017-11-01 |
EP1470691B1 (en) | 2012-06-13 |
US9143525B2 (en) | 2015-09-22 |
US20160088002A1 (en) | 2016-03-24 |
US10771484B2 (en) | 2020-09-08 |
AU2003225531A1 (en) | 2003-09-02 |
US20150058914A1 (en) | 2015-02-26 |
EP2276216B1 (en) | 2014-06-04 |
EP2276216A1 (en) | 2011-01-19 |
US7174566B2 (en) | 2007-02-06 |
US20100122317A1 (en) | 2010-05-13 |
US20190124095A1 (en) | 2019-04-25 |
US8752173B2 (en) | 2014-06-10 |
WO2003067847A3 (en) | 2004-03-25 |
US20030149888A1 (en) | 2003-08-07 |
HK1067823A1 (en) | 2005-04-15 |
EP2790372A1 (en) | 2014-10-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10771484B2 (en) | Integrated network intrusion detection | |
KR101111433B1 (en) | Active network defense system and method | |
US7222366B2 (en) | Intrusion event filtering | |
US7076803B2 (en) | Integrated intrusion detection services | |
EP1817685B1 (en) | Intrusion detection in a data center environment | |
US9094372B2 (en) | Multi-method gateway-based network security systems and methods | |
US8565093B2 (en) | Packet classification in a network security device | |
US20030097557A1 (en) | Method, node and computer readable medium for performing multiple signature matching in an intrusion prevention system | |
US20030149887A1 (en) | Application-specific network intrusion detection | |
US11909768B2 (en) | Methods, systems, and devices related to managing in-home network security using artificial intelligence service to select among a plurality of security functions for processing | |
FIROJ | DESIGN & IMPLEMENTATION OF LAYERED SIGNATURE BASED INTRUSION DETECTION SYSTEM USING SNORT | |
Asarcıklı | Firewall monitoring using intrusion detection systems | |
Semerci | Analysis of intrusion prevention methods |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INTEL CORPORATION, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:YADAV, SATYENDRA;REEL/FRAME:019241/0788 Effective date: 20020128 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |