知搜-全球专利检索

  1. Login
  2. Sign Up

Search Results

326 records (took 0.037 seconds)

    METHOD AND APPARATUS FOR GROUPING FEATURES INTO BINS WITH SELECTED BIN BOUNDARIES FOR USE IN ANOMALY DETECTION
    172.
    发明申请
    METHOD AND APPARATUS FOR GROUPING FEATURES INTO BINS WITH SELECTED BIN BOUNDARIES FOR USE IN ANOMALY DETECTION 审中-公开
    将特征分组到具有选定的BIN边界以用于异常检测的方法和装置

    公开(公告)号：US20160359886A1

    公开(公告)日：2016-12-08

    申请号：US15090992

    申请日：2016-04-05

    Applicant: CISCO TECHNOLOGY, INC.

    Inventor： Navindra Yadav ,  Ellen Scheib ,  Rachita Agasthy

    IPC: H04L29/06

    CPC classification number: H04L63/1425 ,  H04L41/142 ,  H04L41/16 ,  H04L43/062 ,  H04L63/20

    Abstract: In one embodiment, a method includes receiving network data at an analytics device, identifying features for the network data at the analytics device, grouping each of the features into bins of varying width at the analytics device, the bins comprising bin boundaries selected based on a probability that data within each of the bins follows a discrete uniform distribution, and utilizing the binned features for anomaly detection. An apparatus and logic are also disclosed herein.

    Abstract translation: 在一个实施例中，一种方法包括在分析设备处接收网络数据，识别分析设备处的网络数据的特征，将每个特征分组成分析设备的不同宽度的分组，所述分组包括基于 每个仓内的数据遵循离散均匀分布的概率，并利用装箱特征进行异常检测。 本文还公开了一种装置和逻辑。

    SYNTHETIC DATA FOR DETERMINING HEALTH OF A NETWORK SECURITY SYSTEM
    173.
    发明申请
    SYNTHETIC DATA FOR DETERMINING HEALTH OF A NETWORK SECURITY SYSTEM 审中-公开
    用于确定网络安全系统健康的合成数据

    公开(公告)号：US20160359878A1

    公开(公告)日：2016-12-08

    申请号：US15157300

    申请日：2016-05-17

    Applicant: Cisco Technology, Inc.

    Inventor： Rohit Chandra Prasad ,  Bharathwaj Sankara Viswanathan ,  Hoang Viet Nguyen ,  Vimalkumar Jeyakumar ,  Roberto Fernando Spadaro ,  Varun Sagar Malhotra ,  Navindra Yadav

    IPC: H04L29/06 ,  H04L12/26 ,  H04L29/08

    Abstract: An example method can include choosing a pattern or patterns of network traffic. This pattern can be representative of a certain type of traffic such as an attack. The pattern can be associated with various components of a network and can describe expected behavior of these various components. A system performing this method can then choose a nodes or nodes to generate traffic according to the pattern and send an instruction accordingly. After this synthetic traffic is generated, the system can compare the behavior of the components with the expected behavior. An alert can then be created to notify an administrator or otherwise remedy any problems.

    Abstract translation: 示例性方法可以包括选择网络流量的模式或模式。 这种模式可以代表某种类型的流量，如攻击。 该模式可以与网络的各种组件相关联，并且可以描述这些各种组件的预期行为。 执行该方法的系统然后可以根据模式选择节点或节点来生成流量，并相应地发送指令。 生成此合成流量后，系统可以将组件的行为与预期行为进行比较。 然后可以创建警报以通知管理员或以其他方式补救任何问题。

    INTRA-DATACENTER ATTACK DETECTION
    174.
    发明申请
    INTRA-DATACENTER ATTACK DETECTION 审中-公开
    入侵者攻击检测

    公开(公告)号：US20160359877A1

    公开(公告)日：2016-12-08

    申请号：US15145630

    申请日：2016-05-03

    Applicant: Cisco Technology, Inc.

    Inventor： Ashutosh Kulshreshtha ,  Supreeth Hosur Nagesh Rao ,  Navindra Yadav ,  Anubhav Gupta ,  Sunil Kumar Gupta ,  Varun Sagar Malhotra ,  Shashidhar Gandham

    IPC: H04L29/06 ,  H04L12/26

    Abstract: An example method can include receiving a traffic report from a sensor and using the traffic report to detect intra-datacenter flows. These intra-datacenter flows can then be compared with a description of historical flows. The description of historical flows can identify characteristics of normal and malicious flows. Based on the comparison, the flows can be classified and tagged as normal, malicious, or anomalous. If the flows are tagged as malicious or anomalous, corrective action can be taken with respect to the flows. A description of the flows can then be added to the description of historical flows.

    Abstract translation: 示例性方法可以包括从传感器接收流量报告并使用流量报告来检测数据库内中间流。 然后将这些数据中心内流与历史流的描述进行比较。 历史流程的描述可以识别正常和恶意流的特征。 根据比较，流量可以分类和标记为正常，恶意或异常。 如果流被标记为恶意或异常，则可以针对流量采取纠正措施。 然后可以将流量的描述添加到历史流程的描述中。

    NETWORK BEHAVIOR DATA COLLECTION AND ANALYTICS FOR ANOMALY DETECTION
    178.
    发明申请
    NETWORK BEHAVIOR DATA COLLECTION AND ANALYTICS FOR ANOMALY DETECTION 审中-公开
    网络行为数据收集和异常检测分析

    公开(公告)号：US20160359695A1

    公开(公告)日：2016-12-08

    申请号：US15090930

    申请日：2016-04-05

    Applicant: CISCO TECHNOLOGY, INC.

    Inventor： Navindra Yadav ,  Ellen Scheib ,  Rachita Agasthy

    IPC: H04L12/26 ,  G06N99/00

    CPC classification number: H04L43/04 ,  G06N20/00 ,  H04L41/142 ,  H04L41/16 ,  H04L43/12 ,  H04L63/1425

    Abstract: In one embodiment, a method includes receiving at an analytics module operating at a network device, network traffic data collected from a plurality of sensors distributed throughout a network and installed in network components to obtain the network traffic data from packets transmitted to and from the network components and monitor network flows within the network from multiple perspectives in the network, processing the network traffic data at the analytics module, the network traffic data comprising process information, user information, and host information, and identifying at the analytics module, anomalies within the network traffic data based on dynamic modeling of network behavior. An apparatus and logic are also disclosed herein.

    Abstract translation: 在一个实施例中，一种方法包括在网络设备上操作的分析模块处接收从分布在整个网络上的多个传感器收集并安装在网络组件中的网络业务数据，以从网络和从网络发送的分组获得网络业务数据 组件，并从网络中的多个角度监控网络内的网络流量，处理分析模块上的网络流量数据，包括进程信息，用户信息和主机信息的网络流量数据，以及在分析模块识别内的异常 基于网络行为动态建模的网络流量数据。 本文还公开了一种装置和逻辑。

    CLUSTER DISCOVERY VIA MULTI-DOMAIN FUSION FOR APPLICATION DEPENDENCY MAPPING
    179.
    发明申请
    CLUSTER DISCOVERY VIA MULTI-DOMAIN FUSION FOR APPLICATION DEPENDENCY MAPPING 审中-公开
    通过多域融合的集群发现应用依赖映射

    公开(公告)号：US20160359680A1

    公开(公告)日：2016-12-08

    申请号：US15145493

    申请日：2016-05-03

    Applicant: Cisco Technology, Inc.

    Inventor： Ali Parandehgheibi ,  Omid Madani ,  Vimalkumar Jeyakumar ,  Ellen Christine Scheib ,  Navindra Yadav ,  Mohammadreza Alizadeh Attar

    IPC: H04L12/24 ,  H04L12/725 ,  H04L12/715

    Abstract: Application dependency mapping (ADM) can be automated in a network. The network can determine whether certain nodes form a cluster of a tier of an application. The network can monitor network data and process data for traffic passing through the network using a sensor network that provides multiple perspectives for the traffic. The network can analyze the network data and process data to determine respective feature vectors for nodes. A feature vector may represent a combination of the features corresponding to the network data and the features corresponding to the process data of a node. The network can compare the similarity of the respective feature vectors and determine each node's cluster based on similarity measures between nodes.

    Abstract translation: 应用程序依赖关系映射（ADM）可以在网络中自动化。 网络可以确定某些节点是否形成应用层的集群。 该网络可以监视网络数据并处理通过网络传输的流量的数据，该传感器网络为流量提供多个视角。 网络可以分析网络数据和处理数据，以确定节点的相应特征向量。 特征向量可以表示对应于网络数据的特征和与节点的过程数据相对应的特征的组合。 网络可以比较各个特征向量的相似度，并根据节点之间的相似性度量来确定每个节点的簇。

Patent Agency Ranking