公开(公告)号：WO2017142692A1

公开(公告)日：2017-08-24

申请号：PCT/US2017/015267

申请日：2017-01-27

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： WU, Zhenyu ,  LI, Zhichun ,  RHEE, Junghwan ,  XU, Fengyuan ,  JIANG, Guofei ,  JEE, Kangkook ,  XIAO, Xusheng ,  XU, Zhang

IPC: G06F11/30 ,  G06F21/56

CPC classification number: G06F11/30 ,  G06F21/552

Abstract: Methods and systems for dependency tracking include identifying a hot process that generates bursts of events with interleaved dependencies. Events related to the hot process are aggregated according to a process-centric dependency approximation that ignores dependencies between the events related to the hot process. Causality in a reduced event stream that comprises the aggregated events is tracked.

Abstract translation: 用于依赖关系跟踪的方法和系统包括识别产生具有交织相依性的事件突发的热进程。 与热进程相关的事件根据以进程为中心的依赖近似进行聚合，忽略与热进程相关的事件之间的依赖关系。 跟踪包含汇总事件的简化事件流中的因果关系。

公开(公告)号：WO2017131899A1

公开(公告)日：2017-08-03

申请号：PCT/US2016/067737

申请日：2016-12-20

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： XIAO, Xusheng ,  LI, Zhichun ,  XU, Fengyuan ,  GAO, Peng ,  JIANG, Guofei

IPC: G06F17/30

CPC classification number: G06F17/30469 ,  G06F11/30 ,  G06F17/30389 ,  G06F17/30421 ,  G06F17/30424 ,  G06F17/30486 ,  G06F17/30551 ,  G06F21/00 ,  G06F21/554

Abstract: Systems and a method are provided. A system includes a Temporal Behavior Query Language (TBQL) server having a processor and a memory operably coupled to the processor. The TBQL server configured to construct a TBQL query using a grammar inference technique based on syntactic sugar to expedite query construction. The TBQL server is further configured to execute the TBQL, query to generate TBQL query results.

Abstract translation:

提供了系统和方法。 一种系统包括具有处理器和可操作地耦合到处理器的存储器的时间行为查询语言（TBQL）服务器。 TBQL服务器配置为使用基于语法糖的语法推理技术来构建TBQL查询以加速查询构建。 TBQL服务器进一步配置为执行TBQL，查询以生成TBQL查询结果。

公开(公告)号：WO2016168531A1

公开(公告)日：2016-10-20

申请号：PCT/US2016/027659

申请日：2016-04-15

Applicant: NEC LABORATORIES AMERICA, INC.

Inventor： TANG, Lu-An ,  CHEN, Zhengzhang ,  CHEN, Ting ,  JIANG, Guofei ,  XU, Fengyuan ,  CHEN, Haifeng

IPC: H04L29/06 ,  H04L12/22

CPC classification number: H04L41/12 ,  H04L41/142 ,  H04L41/145 ,  H04L63/0421 ,  H04L63/1425

Abstract: Methods and systems for detecting anomalous communications include simulating a network graph based on community and role labels of each node in the network graph based on one or more linking rules. The community and role labels of each node are adjusted based on differences between the simulated network graph and a true network graph. The simulation and adjustment are repeated until the simulated network graph converges to the true network graph to determine a final set of community and role labels. It is determined whether a network communication is anomalous based on the final set of community and role labels.

Abstract translation: 用于检测异常通信的方法和系统包括基于一个或多个链接规则来模拟网络图中基于社区和每个节点的角色标签的网络图。 基于模拟网络图和真实网络图之间的差异来调整每个节点的社区和角色标签。 重复模拟和调整，直到模拟网络图收敛到真实的网络图，以确定最终的一组社区和角色标签。 基于社区和角色标签的最终集确定网络通信是否是异常的。