专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US11194910B2 Intelligent system for detecting multistage attacks 有权
公开(公告)号：US11194910B2
公开(公告)日：2021-12-07
申请号：US16179573
申请日：2018-11-02
申请人： Microsoft Technology Licensing, LLC
发明人： Anisha Mazumder , Craig Henry Wittenberg , Daniel L. Mace , Haijun Zhai , Seetharaman Harikrishnan , Ram Shankar Siva Kumar , Yogesh K. Roy
IPC分类号： H04L29/06 , G06F21/56 , G06N5/04 , G06N7/08 , G06N7/00
摘要： Provided herein are methods, systems, and computer program products for intelligent detection of multistage attacks which may arise in computer environments. Embodiments herein leverage adaptive graph-based machine-learning solutions that can incorporate rules as well as supervised learning for detecting multistage attacks. Multistage attacks and attack chains may be detected or identified by collecting data representing events, detections, and behaviors, determining relationships among various data, and analyzing the data and associated relationships. A graph of events, detections, and behaviors which are connected by edges representing relationships between nodes of the graph may be constructed and then subgraphs of the possibly enormous initial graph may be identified which represent likely attacks.

2. 发明授权

US09819689B2 Large scale malicious process detection 有权
公开(公告)号：US09819689B2
公开(公告)日：2017-11-14
申请号：US14657215
申请日：2015-03-13
申请人： Microsoft Technology Licensing, LLC
发明人： Himanshu Chandola , Jack Wilson Stokes, III , Gil Lapid Shafriri , Craig Henry Wittenberg , Timothy W. Burrell , Christian Seifert
IPC分类号： G06F21/00 , H04L29/06 , G06F17/30 , G06F21/55
CPC分类号： H04L63/1416 , G06F17/30477 , G06F17/3053 , G06F21/552
摘要： Identify a set or session of processes as having certain characteristics. A method obtains a known set or session of processes, wherein the known set or session of processes has the certain characteristics. A set or session of processes to be evaluated is obtained. A weighted similarity measure is performed between the known set or session of processes and the set or session of processes to be evaluated. The weighted similarity measure is performed element wise, where a comparison is performed for each defined element in the set or session of processes to be evaluated against elements in the known set or session of processes.

3. 发明申请

US20160269424A1 Large Scale Malicious Process Detection 有权
标题翻译：大规模恶意流程检测
公开(公告)号：US20160269424A1
公开(公告)日：2016-09-15
申请号：US14657215
申请日：2015-03-13
申请人： Microsoft Technology Licensing, LLC
发明人： Himanshu Chandola , Jack Wilson Stokes, III , Gil Lapid Shafriri , Craig Henry Wittenberg , Timothy W. Burrell , Christian Seifert
IPC分类号： H04L29/06 , G06F17/30
CPC分类号： H04L63/1416 , G06F17/30477 , G06F17/3053 , G06F21/552
摘要： Identify a set or session of processes as having certain characteristics. A method obtains a known set or session of processes, wherein the known set or session of processes has the certain characteristics. A set or session of processes to be evaluated is obtained. A weighted similarity measure is performed between the known set or session of processes and the set or session of processes to be evaluated. The weighted similarity measure is performed element wise, where a comparison is performed for each defined element in the set or session of processes to be evaluated against elements in the known set or session of processes.
摘要翻译：将一组或多个进程识别为具有某些特征。一种方法获得已知的一组或多个进程会话，其中已知的一组或多个进程具有一定的特征。获得要评估的过程的集合或会话。在已知的一组或多个进程与待评估的进程的集合或会话之间执行加权相似性度量。加权相似性度量是以元素方式执行的，其中针对要被评估的过程的集合或会话中的每个定义的元素进行比较，所述过程的对象或者会话被处理已知的过程集合或会话中的元素。

4. 发明授权

US11223552B1 Aggregation-based determination of cloud computing service resiliency to chaos events 有权
公开(公告)号：US11223552B1
公开(公告)日：2022-01-11
申请号：US17145200
申请日：2021-01-08
申请人： Microsoft Technology Licensing, LLC
发明人： David Dominic Anderson , Piyush Gupta , Jeremy Michael Bares , Weili Zhong McClenahan , Craig Henry Wittenberg , Christopher Grant Ashton , Ritchie Nicholas Hughes
IPC分类号： H04L12/26 , G06F16/28
摘要： Techniques are described herein that are capable of performing an aggregation-based determination of resiliency of a cloud computing service to chaos events. Chaos events are executed against a cloud computing service during a time frame that includes multiple time periods. For each chaos event, service health indexes (SHIs) that correspond to the time periods are calculated. Each SHI indicates an extent to which indicators, which represent respective measurements of performance of the cloud computing service during the respective time period, satisfy respective criteria. The SHIs for each chaos event are analyzed to provide a respective resiliency score. At least some of the resiliency scores of the respective chaos events are aggregated to provide an aggregated resiliency score, which represents resiliency of the cloud computing service to the chaos events.

5. 发明申请

US20160203316A1 ACTIVITY MODEL FOR DETECTING SUSPICIOUS USER ACTIVITY 审中-公开
标题翻译：用于检测可疑用户活动的活动模型
公开(公告)号：US20160203316A1
公开(公告)日：2016-07-14
申请号：US14597015
申请日：2015-01-14
申请人： Microsoft Technology Licensing, LLC
发明人： Daniel Lee Mace , Gil Lapid Shafriri , Craig Henry Wittenberg
IPC分类号： G06F21/55 , G06N7/02
CPC分类号： G06F21/55 , G06F21/316 , G06F21/554 , G06N7/02
摘要： Embodiments are directed to generating an account process profile based on meta-events and to detecting account behavior anomalies based on account process profiles. In one scenario, a computer system accesses an indication of which processes were initiated by an account over a specified period of time. The computer system analyzes at least some of the processes identified in the indication to extract features associated with the processes. The computer system assigns the processes to meta-events based on the extracted features, where each meta-event is a representation of how the processes are executed within the computer system. The computer system then generates an account process profile for the account based on the meta-events, where the account process profile provides a comprehensive view of the account's behavior over the specified period of time. This account process profile can be used to identify anomalies in process execution.
摘要翻译：实施例涉及基于元事件来生成帐户流程简档，并且基于帐户流程简档来检测帐户行为异常。在一种情况下，计算机系统访问在特定时间段内帐户启动哪些进程的指示。计算机系统分析指示中识别的至少一些进程以提取与进程相关联的特征。计算机系统基于提取的特征将进程分配给元事件，其中每个元事件是如何在计算机系统内执行进程的表示。计算机系统然后基于元事件生成帐户的帐户流程简档，其中帐户流程简档提供了在指定时间段内账户行为的综合视图。此帐户流程配置文件可用于识别流程执行中的异常。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式