会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 3. 发明授权
    • Log-based traceback system and method using centroid decomposition technique
    • 基于Log的追溯系统和使用重心分解技术的方法
    • US08307441B2
    • 2012-11-06
    • US12669633
    • 2007-11-21
    • Jong Hyun KimGeon Lyang KimSeon Gyoung SohnBeom Hwan ChangChi Yoon JeongJong Ho RyuJung Chan NaJong Soo JangSung Won Sohn
    • Jong Hyun KimGeon Lyang KimSeon Gyoung SohnBeom Hwan ChangChi Yoon JeongJong Ho RyuJung Chan NaJong Soo JangSung Won Sohn
    • G06F11/34
    • H04L45/00H04L45/12H04L63/1416H04L63/1425H04L63/1441H04L2463/146
    • There are provided a system and method for tracing back an attacker by using centroid decomposition technique, the system including: a log data input module collecting log data of an intrusion alarm from an intrusion detection system; a centroid node detection module generating a shortest path tree by applying a shortest path algorithm to network router connection information collected by a network administration server, detecting a centroid node by applying centroid decomposition technique removing a leaf-node to the shortest path tree, and generating a centroid tree whose node of each level is the detected centroid node; and a traceback processing module requesting log data of a router matched with the node of each level of the centroid tree, and tracing back a router identical to the log data of the collected intrusion alarm as a router connected to a source of an attacker by comparing the log data of the router with the log data of the collected intrusion alarm. According to the system and method, an attacker causing a security intrusion event may be quickly detected, a load on the system is reduced, and a passage host exposed to a danger or having weaknesses may be easily recognized, thereby easily coping with an attack.
    • 提供了一种通过使用质心分解技术跟踪攻击者的系统和方法,该系统包括:日志数据输入模块,从入侵检测系统收集入侵警报的日志数据; 质心节点检测模块,通过对网络管理服务器收集的网络路由器连接信息应用最短路径算法,生成最短路径树,通过应用质心分解技术检测质心节点,去除叶节点到最短路径树,并生成 每个级别的节点是检测到的质心节点的质心树; 以及回溯处理模块,请求与质心树的每个级别的节点匹配的路由器的日志数据,并且通过比较来跟踪与收集的入侵警报器的日志数据相同的路由器作为连接到攻击者的源的路由器 路由器的日志数据与收集的入侵报警的日志数据。 根据系统和方法,可以快速地检测到导致安全入侵事件的攻击者,系统上的负载减少,并且易于识别暴露于危险或具有弱点的通道主机,从而容易地应对攻击。
    • 5. 发明申请
    • LOG-BASED TRACEBACK SYSTEM AND METHOD USING CENTROID DECOMPOSITION TECHNIQUE
    • 基于LOG的跟踪系统和使用中心分解技术的方法
    • US20100212013A1
    • 2010-08-19
    • US12669633
    • 2007-11-21
    • Jong Hyun KimGeon Lyang KimSeon Gyoung SohnBeom Hwan ChangChi Yoon JeongJong Ho RyuJung Chan NaJong Soo JangSung Won Sohn
    • Jong Hyun KimGeon Lyang KimSeon Gyoung SohnBeom Hwan ChangChi Yoon JeongJong Ho RyuJung Chan NaJong Soo JangSung Won Sohn
    • G06F11/34
    • H04L45/00H04L45/12H04L63/1416H04L63/1425H04L63/1441H04L2463/146
    • There are provided a system and method for tracing back an attacker by using centroid decomposition technique, the system including: a log data input module collecting log data of an intrusion alarm from an intrusion detection system; a centroid node detection module generating a shortest path tree by applying a shortest path algorithm to network router connection information collected by a network administration server, detecting a centroid node by applying centroid decomposition technique removing a leaf-node to the shortest path tree, and generating a centroid tree whose node of each level is the detected centroid node; and a traceback processing module requesting log data of a router matched with the node of each level of the centroid tree, and tracing back a router identical to the log data of the collected intrusion alarm as a router connected to a source of an attacker by comparing the log data of the router with the log data of the collected intrusion alarm. According to the system and method, an attacker causing a security intrusion event may be quickly detected, a load on the system is reduced, and a passage host exposed to a danger or having weaknesses may be easily recognized, thereby easily coping with an attack.
    • 提供了一种通过使用质心分解技术跟踪攻击者的系统和方法,该系统包括:日志数据输入模块,从入侵检测系统收集入侵警报的日志数据; 质心节点检测模块,通过对网络管理服务器收集的网络路由器连接信息应用最短路径算法,生成最短路径树,通过应用质心分解技术检测质心节点,去除叶节点到最短路径树,并生成 每个级别的节点是检测到的质心节点的质心树; 以及回溯处理模块,请求与质心树的每个级别的节点匹配的路由器的日志数据,并且通过比较来跟踪与收集的入侵警报器的日志数据相同的路由器作为连接到攻击者的源的路由器 路由器的日志数据与收集的入侵报警的日志数据。 根据系统和方法,可以快速地检测到导致安全入侵事件的攻击者,系统上的负载减少,并且易于识别暴露于危险或具有弱点的通道主机,从而容易地应对攻击。
    • 7. 发明授权
    • Web-based traceback system and method using reverse caching proxy
    • 基于Web的追溯系统和使用反向缓存代理的方法
    • US08341721B2
    • 2012-12-25
    • US12467462
    • 2009-05-18
    • Jong Hyun KimGeon Lyang KimJong Ho RyuChi Yoon JeongSeon Gyoung SohnBeom Hwan ChangJung-Chan NaHyun Sook Cho
    • Jong Hyun KimGeon Lyang KimJong Ho RyuChi Yoon JeongSeon Gyoung SohnBeom Hwan ChangJung-Chan NaHyun Sook Cho
    • G06F15/16G06F15/173
    • H04L67/22H04L63/0281H04L63/1441H04L67/2857
    • Provided are a web-based traceback system and method using reverse caching proxy, which can effectively protect a web server against various attacks launched by illegitimate user by acquiring network information and location information of users who attempt to access the web server through an anonymous server, without a requirement of installing any agent program in the users' clients. The web-based traceback system may include a reverse caching proxy server receiving a hypertext transfer protocol (HTTP) packet transmitted to a web server by a client, analyzing the header of the HTTP packet and determining whether the client has attempted to access the web server through an anonymous server based on the results of the analysis; and a web tracking server generating a response page for the HTTP packet upon receiving the results of the determination performed by the reverse caching proxy server, inserting a tracking code in the response page, and providing the response page to the client through the reverse caching proxy server, wherein the tracking code is automatically executed in a web browser of the client and thus provides network information of the client to the web tracking server.
    • 提供了一种使用反向缓存代理的基于web的追溯系统和方法,可以通过获取尝试通过匿名服务器访问Web服务器的用户的网络信息和位置信息,有效地保护Web服务器免受非法用户发起的各种攻击, 而不需要在用户的客户端中安装任何代理程序。 基于web的追溯系统可以包括反向高速缓存代理服务器,其接收由客户端发送到web服务器的超文本传输​​协议(HTTP)分组,分析HTTP分组的报头并确定客户端是否尝试访问web服务器 通过匿名服务器根据分析结果; 以及网页跟踪服务器,在接收到反向高速缓存代理服务器执行的确定结果时,为HTTP分组生成响应页面,在响应页面中插入跟踪代码,并通过反向缓存代理向客户端提供响应页面 服务器,其中跟踪代码在客户端的web浏览器中自动执行,从而将该客户端的网络信息提供给web跟踪服务器。
    • 10. 发明申请
    • WEB-BASED TRACEBACK SYSTEM AND METHOD USING REVERSE CACHING PROXY
    • 基于WEB的跟踪系统和使用反向缓存代理的方法
    • US20100030891A1
    • 2010-02-04
    • US12467462
    • 2009-05-18
    • Jong Hyun KIMGeon Lyang KIMJong Ho RYUChi Yoon JEONGSeon Gyoung SOHNBeom Hwan CHANGJung-Chan NAHyun Sook CHO
    • Jong Hyun KIMGeon Lyang KIMJong Ho RYUChi Yoon JEONGSeon Gyoung SOHNBeom Hwan CHANGJung-Chan NAHyun Sook CHO
    • G06F15/173G06F15/16
    • H04L67/22H04L63/0281H04L63/1441H04L67/2857
    • Provided are a web-based traceback system and method using reverse caching proxy, which can effectively protect a web server against various attacks launched by illegitimate user by acquiring network information and location information of users who attempt to access the web server through an anonymous server, without a requirement of installing any agent program in the users' clients. The web-based traceback system may include a reverse caching proxy server receiving a hypertext transfer protocol (HTTP) packet transmitted to a web server by a client, analyzing the header of the HTTP packet and determining whether the client has attempted to access the web server through an anonymous server based on the results of the analysis; and a web tracking server generating a response page for the HTTP packet upon receiving the results of the determination performed by the reverse caching proxy server, inserting a tracking code in the response page, and providing the response page to the client through the reverse caching proxy server, wherein the tracking code is automatically executed in a web browser of the client and thus provides network information of the client to the web tracking server.
    • 提供了一种使用反向缓存代理的基于web的追溯系统和方法,可以通过获取尝试通过匿名服务器访问Web服务器的用户的网络信息和位置信息,有效地保护Web服务器免受非法用户发起的各种攻击, 而不需要在用户的客户端中安装任何代理程序。 基于web的追溯系统可以包括反向高速缓存代理服务器,其接收由客户端发送到web服务器的超文本传输​​协议(HTTP)分组,分析HTTP分组的报头并确定客户端是否尝试访问web服务器 通过匿名服务器根据分析结果; 以及网页跟踪服务器,在接收到反向高速缓存代理服务器执行的确定结果时,为HTTP分组生成响应页面,在响应页面中插入跟踪代码,并通过反向缓存代理向客户端提供响应页面 服务器,其中跟踪代码在客户端的web浏览器中自动执行,从而将该客户端的网络信息提供给web跟踪服务器。