知搜-全球专利检索

  1. Login
  2. Sign Up

Search Results

118 records (took 0.03 seconds)

    SYSTEM AND METHOD OF DETECTING WHETHER A SOURCE OF A PACKET FLOW TRANSMITS PACKETS WHICH BYPASS AN OPERATING SYSTEM STACK
    113.
    发明申请
    SYSTEM AND METHOD OF DETECTING WHETHER A SOURCE OF A PACKET FLOW TRANSMITS PACKETS WHICH BYPASS AN OPERATING SYSTEM STACK 审中-公开
    检测分组流量传输的源的系统和方法除了操作系统堆栈之外的包

    公开(公告)号：US20160359890A1

    公开(公告)日：2016-12-08

    申请号：US15171879

    申请日：2016-06-02

    Applicant: Cisco Technology, Inc.

    Inventor： Khawar Deen ,  Navindra Yadav ,  Anubhav Gupta ,  Shashidhar Gandham ,  Rohit Chandra Prasad ,  Abhishek Ranjan Singh ,  Shih-Chun Chang

    IPC: H04L29/06

    Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

    Abstract translation: 一种方法包括使用部署在第一主机处的第一捕获代理捕获与来自第一主机的第一分组流相关联的第一数据，以产生第一流数据，从第二主捕获与第一主机起源的第二分组流相关联的第二数据 部署在第二主机上的捕获代理产生第二流数据并比较第一流数据和第二流数据以产生差异。 当所述差异高于阈值时，所述方法包括确定所述第二分组流由绕过所述设备的所述第一主机或分组捕获代理的操作堆栈的组件发送以产生确定，检测所述隐藏网络流量 存在并且基于该确定来预测与第一主机的恶意软件问题。

    INTRA-DATACENTER ATTACK DETECTION
    115.
    发明申请
    INTRA-DATACENTER ATTACK DETECTION 审中-公开
    入侵者攻击检测

    公开(公告)号：US20160359877A1

    公开(公告)日：2016-12-08

    申请号：US15145630

    申请日：2016-05-03

    Applicant: Cisco Technology, Inc.

    Inventor： Ashutosh Kulshreshtha ,  Supreeth Hosur Nagesh Rao ,  Navindra Yadav ,  Anubhav Gupta ,  Sunil Kumar Gupta ,  Varun Sagar Malhotra ,  Shashidhar Gandham

    IPC: H04L29/06 ,  H04L12/26

    Abstract: An example method can include receiving a traffic report from a sensor and using the traffic report to detect intra-datacenter flows. These intra-datacenter flows can then be compared with a description of historical flows. The description of historical flows can identify characteristics of normal and malicious flows. Based on the comparison, the flows can be classified and tagged as normal, malicious, or anomalous. If the flows are tagged as malicious or anomalous, corrective action can be taken with respect to the flows. A description of the flows can then be added to the description of historical flows.

    Abstract translation: 示例性方法可以包括从传感器接收流量报告并使用流量报告来检测数据库内中间流。 然后将这些数据中心内流与历史流的描述进行比较。 历史流程的描述可以识别正常和恶意流的特征。 根据比较，流量可以分类和标记为正常，恶意或异常。 如果流被标记为恶意或异常，则可以针对流量采取纠正措施。 然后可以将流量的描述添加到历史流程的描述中。

Patent Agency Ranking