中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

25 records (took 0.025 seconds)

    ANOMALOUS DEVICE DETECTION FROM COMMUNICATION DATA
    1.
    发明申请
    ANOMALOUS DEVICE DETECTION FROM COMMUNICATION DATA 审中-公开

    公开(公告)号：WO2020060814A1

    公开(公告)日：2020-03-26

    申请号：PCT/US2019/050549

    申请日：2019-09-11

    Applicant: NEC LABORATORIES AMERICA, INC.

    Inventor： CHEN, Haifeng ,  ZONG, Bo ,  CHENG, Wei ,  TANG, LuAn ,  NI, Jingchao

    IPC: H04L29/06 ,  G06F21/55 ,  G06N3/08

    Abstract: Systems and methods for implementing heterogeneous feature integration for device behavior analysis (HFIDBA) are provided. The method includes representing (620) each of multiple devices as a sequence of vectors for communications and as a separate vector for a device profile. The method also includes extracting (630) static features, temporal features, and deep embedded features from the sequence of vectors to represent behavior of each device. The method further includes determining (650), by a processor device, a status of a device based on vector representations of each of the multiple devices.

    INTER-APPLICATION DEPENDENCY ANALYSIS FOR IMPROVING COMPUTER SYSTEM THREAT DETECTION
    2.
    发明申请
    INTER-APPLICATION DEPENDENCY ANALYSIS FOR IMPROVING COMPUTER SYSTEM THREAT DETECTION 审中-公开

    公开(公告)号：WO2019032180A1

    公开(公告)日：2019-02-14

    申请号：PCT/US2018/037183

    申请日：2018-06-13

    Applicant: NEC LABORATORIES AMERICA, INC.

    Inventor： LI, Ding ,  JEE, Kangkook ,  CHEN, Zhengzhang ,  TANG, LuAn ,  LI, Zhichun

    IPC: G06F21/57 ,  G06F17/30

    Abstract: A method and system are provided for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system. The method includes receiving, by a processor operatively coupled to a memory, a Tracking Description Language (TDL) query including general constraints, a tracking declaration and an output specification, parsing, by the processor, the TDL query using a language parser, executing, by the processor, a tracking analysis based on the parsed TDL query, generating, by the processor, a tracking graph by cleaning a result of the tracking analysis, and outputting, by the processor and via an interface, query results based on the tracking graph.

    GRAPH-BASED ATTACK CHAIN DISCOVERY IN ENTERPRISE SECURITY SYSTEMS
    6.
    发明申请
    GRAPH-BASED ATTACK CHAIN DISCOVERY IN ENTERPRISE SECURITY SYSTEMS 审中-公开
    企业安全系统中基于图形的攻击链发现

    公开(公告)号：WO2018071356A1

    公开(公告)日：2018-04-19

    申请号：PCT/US2017/055826

    申请日：2017-10-10

    Applicant: NEC LABORATORIES AMERICA, INC.

    Inventor： TANG, LuAn ,  ZHANG, Hengtong ,  CHEN, Zhengzhang ,  ZONG, Bo ,  LI, Zhichun ,  JIANG, Guofei ,  YOSHIHIRA, Kenji

    IPC: G06F21/55 ,  G06F21/60

    CPC classification number: G06F21/554 ,  G06F21/55 ,  G06F21/60

    Abstract: Methods and systems for detecting anomalous events include detecting anomalous events (42, 43) in monitored system data. An event correlation graph is generated (302) based on the monitored system data that characterizes the tendency of processes to access system targets. Kill chains are generated (310) that connect malicious events over a span of time from the event correlation graph that characterize events in an attack path over time by sorting events according to a maliciousness value and determining at least one sub-graph within the event correlation graph with an above-threshold maliciousness rank. A security management action is performed (412) based on the kill chains.

    Abstract translation: 用于检测异常事件的方法和系统包括检测所监视的系统数据中的异常事件（42,43）。 基于监视的系统数据生成（302）事件关联图，表征过程访问系统目标的倾向。 通过根据恶意值对事件进行排序并确定事件相关内的至少一个子图，产生（310）从事件关联图中连接恶意事件的杀死链（310），所述事件关联图随时间表征攻击路径中的事件 图表具有高于阈值的恶意级别。 基于杀链来执行安全管理操作（412）。

    CONSTRUCTING GRAPH MODELS OF EVENT CORRELATION IN ENTERPRISE SECURITY SYSTEMS
    7.
    发明申请
    CONSTRUCTING GRAPH MODELS OF EVENT CORRELATION IN ENTERPRISE SECURITY SYSTEMS 审中-公开
    企业安全系统中事件相关性的图形模型构建

    公开(公告)号：WO2018071355A1

    公开(公告)日：2018-04-19

    申请号：PCT/US2017/055825

    申请日：2017-10-10

    Applicant: NEC LABORATORIES AMERICA, INC.

    Inventor： TANG, LuAn ,  ZHANG, Hengtong ,  CHEN, Zhengzhang ,  ZONG, Bo ,  LI, Zhichun ,  JIANG, Guofei ,  YOSHIHIRA, Kenji

    IPC: G06F21/55 ,  G06F21/60

    CPC classification number: G06F21/552 ,  G06F21/554

    Abstract: Methods and systems for detecting anomalous events include detecting anomalous events (42,43) in monitored system data. An event correlation graph is generated (302) by determining a tendency for a first process to access a system target, include an innate tendency of the first process to access the system target, an influence of previous events from the first process, and an influence of processes other than the first process. Kill chains are generated (310) from the event correlation graph that characterize events in an attack path over time. A security management action is performed (412) based on the kill chains.

    Abstract translation: 用于检测异常事件的方法和系统包括检测监测到的系统数据中的异常事件（42,43）。 通过确定第一过程访问系统目标的趋势，包括第一过程访问系统目标的先天趋势，来自第一过程的先前事件的影响以及影响第一过程的影响来生成事件相关图（302） 除第一个过程以外的过程。 从事件关联图生成（310）杀死链，表征攻击路径随时间的事件。 基于杀链来执行安全管理操作（412）。

    KNOWLEDGE TRANSFER SYSTEM FOR ACCELERATING INVARIANT NETWORK LEARNING
    8.
    发明申请
    KNOWLEDGE TRANSFER SYSTEM FOR ACCELERATING INVARIANT NETWORK LEARNING 审中-公开

    公开(公告)号：WO2019032502A1

    公开(公告)日：2019-02-14

    申请号：PCT/US2018/045493

    申请日：2018-08-07

    Applicant: NEC LABORATORIES AMERICA, INC.

    Inventor： CHEN, Zhengzhang ,  TANG, LuAn ,  LI, Zhichun ,  LUO, Chen

    IPC: H04L29/06 ,  H04L12/26

    CPC classification number: H04L63/1425 ,  G06N5/003 ,  G06N5/022 ,  G06N20/00

    Abstract: A computer-implemented method for implementing a knowledge transfer based model for accelerating invariant network learning is presented. The computer-implemented method includes generating an invariant network from data streams, the invariant network representing an enterprise information network including a plurality of nodes representing entities, employing a multi-relational based entity estimation model for transferring the entities from a source domain graph to a target domain graph by filtering irrelevant entities from the source domain graph, employing a reference construction model for determining differences between the source and target domain graphs, and constructing unbiased dependencies between the entities to generate a target invariant network, and outputting the generated target invariant network on a user interface of a computing device.

    DISCOVERING CRITICAL ALERTS THROUGH LEARNING OVER HETEROGENEOUS TEMPORAL GRAPHS
    10.
    发明申请
    DISCOVERING CRITICAL ALERTS THROUGH LEARNING OVER HETEROGENEOUS TEMPORAL GRAPHS 审中-公开

    公开(公告)号：WO2018093807A1

    公开(公告)日：2018-05-24

    申请号：PCT/US2017/061664

    申请日：2017-11-15

    Applicant: NEC LABORATORIES AMERICA, INC

    Inventor： ZONG, Bo ,  TANG, LuAn ,  SONG, Qi ,  DEBNATH, Biplob ,  ZHANG, Hui ,  JIANG, Guofei

    IPC: G06N3/08 ,  G06F11/34

    Abstract: A method is provided that includes transforming training data into a neural network based learning model using a set of temporal graphs derived from the training data. The method includes performing model learning on the learning model by automatically adjusting learning model parameters based on the set of the temporal graphs to minimize differences between a predetermined ground-truth ranking list and a learning model output ranking list. The method includes transforming testing data into a neural network based inference model using another set of temporal graphs derived from the testing data. The method includes performing model inference by applying the inference and learning models to test data to extract context features for alerts in the test data and calculate a ranking list for the alerts based on the extracted context features. Top-ranked alerts are identified as critical alerts. Each alert represents an anomaly in the test data.

Patent Agency Ranking