知搜-全球专利检索

  1. 登录
  2. 注册

搜索结果

101 条记录 (耗时 0.032 秒)

    Hierarchical attack detection in a network
    63.
    发明授权
    Hierarchical attack detection in a network 有权

    公开(公告)号：US09674207B2

    公开(公告)日：2017-06-06

    申请号：US14338794

    申请日：2014-07-23

    申请人： Cisco Technology, Inc.

    发明人： Andrea Di Pietro ,  Jean-Philippe Vasseur ,  Javier Cruz Mota

    IPC分类号： H04L29/06

    CPC分类号： H04L63/1416 ,  H04L63/1408 ,  H04L63/1441 ,  H04L63/1458

    摘要： In one embodiment, a device in a network identifies a set of traffic flow records that triggered an attack detector. The device selects a subset of the traffic flow records and calculates aggregated metrics for the subset. The device provides the aggregated metrics for the subset to the attack detector to generate an attack detection determination for the subset of traffic flow records. The device identifies one or more attack traffic flows from the set of traffic flow records based on the attack detection determination for the subset of traffic flow records.

    Dynamic tuning of attack detector performance
    64.
    发明授权
    Dynamic tuning of attack detector performance 有权

    公开(公告)号：US09641542B2

    公开(公告)日：2017-05-02

    申请号：US14336206

    申请日：2014-07-21

    申请人： Cisco Technology, Inc.

    发明人： Jean-Philippe Vasseur ,  Andrea Di Pietro ,  Javier Cruz Mota

    IPC分类号： G06F21/56 ,  H04L29/06 ,  G06F21/12

    CPC分类号： H04L63/1416 ,  H04L63/1458

    摘要： In one embodiment, a device in a network receives information regarding one or more attack detection service level agreements. The device identifies a set of attack detection classifiers as potential voters in a voting mechanism used to detect a network attack. The device determines one or more parameters for the voting mechanism based on the information regarding the one or more attack detection service level agreements. The device adjusts the voting mechanism used by the potential voters based on the one or more parameters for the voting mechanism.

    Stealth mitigation for simulating the success of an attack
    68.
    发明授权
    Stealth mitigation for simulating the success of an attack 有权
    隐形减轻模拟攻击的成功

    公开(公告)号：US09497215B2

    公开(公告)日：2016-11-15

    申请号：US14338653

    申请日：2014-07-23

    申请人： Cisco Technology, Inc.

    发明人： Jean-Philippe Vasseur ,  Andrea Di Pietro ,  Javier Cruz Mota

    IPC分类号： G06F11/00 ,  H04L29/06 ,  G06F12/14

    CPC分类号： H04L63/1458 ,  H04L63/1416 ,  H04L2463/141

    摘要： In one embodiment, attack traffic corresponding to a detected DoS attack from one or more attacker nodes is received at a denial of service (DoS) attack management node in a network. The DoS attack management node determines attack information relating to the attack traffic, including a type of the DoS attack and an intended target of the DoS attack. Then, the DoS attack management node triggers an attack mimicking action based on the attack information, where the attack mimicking action mimics a behavior of the intended target of the DoS attack that would be expected by the one or more attacker nodes if the DoS attack were successful.

    摘要翻译： 在一个实施例中，在网络中的拒绝服务（DoS）攻击管理节点处接收与来自一个或多个攻击者节点的检测到的DoS攻击相对应的攻击流量。 DoS攻击管理节点确定与攻击流量相关的攻击信息，包括DoS攻击的类型和DoS攻击的预期目标。 然后，DoS攻击管理节点基于攻击信息触发攻击模拟动作，其中攻击模拟动作模仿DoS攻击的预期目标的行为，如果DoS攻击是由一个或多个攻击者节点预期的 成功

    Applying a mitigation specific attack detector using machine learning
    69.
    发明授权
    Applying a mitigation specific attack detector using machine learning 有权
    使用机器学习应用缓解特定的攻击检测器

    公开(公告)号：US09407646B2

    公开(公告)日：2016-08-02

    申请号：US14338909

    申请日：2014-07-23

    申请人： Cisco Technology, Inc.

    发明人： Javier Cruz Mota ,  Andrea Di Pietro ,  Jean-Philippe Vasseur

    IPC分类号： H04L29/06

    CPC分类号： H04L63/1416 ,  H04L63/1425 ,  H04L63/1458

    摘要： In one embodiment, a device in a network detects a network attack using aggregated metrics for a set of traffic data. In response to detecting the network attack, the device causes the traffic data to be clustered into a set of traffic data clusters. The device causes one or more attack detectors to analyze the traffic data clusters. The device causes the traffic data clusters to be segregated into a set of one or more attack-related clusters and into a set of one or more clusters related to normal traffic based on an analysis of the clusters by the one or more attack detectors.

    摘要翻译： 在一个实施例中，网络中的设备使用用于一组业务数据的聚合度量来检测网络攻击。 响应于检测到网络攻击，该设备使业务数据被聚集成一组业务数据集群。 该设备使一个或多个攻击检测器分析流量数据集群。 基于对一个或多个攻击检测器的分析，该设备使得交通数据集群被分离成一组一个或多个与攻击有关的集群，并且分组成与一般业务相关的一个或多个集群的集合。

    EVENT CORRELATION IN A NETWORK MERGING LOCAL GRAPH MODELS FROM DISTRIBUTED NODES
    70.
    发明申请
    EVENT CORRELATION IN A NETWORK MERGING LOCAL GRAPH MODELS FROM DISTRIBUTED NODES 审中-公开
    网络中的事件关联与分布式节点的局部图形模型

    公开(公告)号：US20160219066A1

    公开(公告)日：2016-07-28

    申请号：US14605916

    申请日：2015-01-26

    申请人： Cisco Technology, Inc.

    发明人： Jean-Philippe Vasseur ,  Grégory Mermoud ,  Javier Cruz Mota

    IPC分类号： H04L29/06

    CPC分类号： H04L63/1425 ,  H04L63/1458

    摘要： In one embodiment, a device in a network receives an indication of a network anomaly detected by a first graph-based anomaly detection model hosted by a first node in the network. The device identifies one or more additional graph-based anomaly detection models based on the network anomaly detected by the first graph-based anomaly detection model. The device correlates one or more network events from the one or more additional graph-based anomaly detection models with the network anomaly detected by the first graph-based anomaly detection model. The device identifies a cause of the network anomaly using the one or more network events from the one or more additional graph-based anomaly detection models that are correlated with the network anomaly detected by the first graph-based anomaly detection model.

    摘要翻译： 在一个实施例中，网络中的设备接收由网络中的第一节点托管的第一基于图的异常检测模型检测到的网络异常的指示。 该设备基于第一个基于图形的异常检测模型检测到的网络异常识别一个或多个附加的基于图的异常检测模型。 该装置将来自一个或多个附加的基于图的异常检测模型的一个或多个网络事件与由第一基于图的异常检测模型检测到的网络异常相关联。 该设备使用来自与由第一基于图表的异常检测模型检测到的网络异常相关联的一个或多个附加的基于图的异常检测模型，使用一个或多个网络事件来识别网络异常的原因。