专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20210185080A1 SOCIAL ENGINEERING ATTACK PREVENTION 有权
公开(公告)号：US20210185080A1
公开(公告)日：2021-06-17
申请号：US16710331
申请日：2019-12-11
申请人： AT&T Intellectual Property I, L.P.
发明人： Wei Wang , Mikhail Istomin , Chaim Spielman , Christina Monteleone , Kenneth Walsh , Carol Pincock
IPC分类号： H04L29/06 , G06N3/08 , G06N3/04
摘要： In one example, the present disclosure describes various methods, computer-readable media, and apparatuses for supporting social engineering attack prevention based on early detection and remediation of various types of social engineering attacks which may be initiated within various contexts. In one example, supporting social engineering attack prevention may include identifying a workflow to be protected, identifying, for the workflow, a set of valid resources of the workflow where the set of valid resources includes a set of artifacts and a set of templates, identifying, from a dataset associated with the workflow and based on the set of artifacts, a communication associated with the workflow, determining, based on an analysis of the communication based on the set of templates, that the communication is malicious, and initiating, based on the determination that the communication is malicious, a remediation action.

2. 发明申请

US20140007237A1 Modeling and Outlier Detection in Threat Management System Data 有权
标题翻译：威胁管理系统数据建模与异常检测
公开(公告)号：US20140007237A1
公开(公告)日：2014-01-02
申请号：US14016162
申请日：2013-09-02
申请人： AT&T Intellectual Property I, L.P.
发明人： Jeremy Wright , John Hogoboom , Chaim Spielman
IPC分类号： H04L29/06
CPC分类号： H04L63/1425 , G06F21/552 , H04L63/1416
摘要： Methods, systems, and computer-readable media for identifying potential threats on a network based on anomalous behavior in communication between endpoints are provided. Traffic data for a network is accumulated over some period of time. The traffic data is grouped by one or more keys, such as source IP address, and sets of metric values are calculated for the keys. A mixture distribution, such as a negative binomial mixture distribution, is fitted to each set of metric values, and outlying metric values are determined based on the mixture distribution(s). A list of outliers is then generated comprising key values having outlying metric values in one or more of the sets of metric values.
摘要翻译：提供了用于基于端点之间的通信中的异常行为来识别网络上的潜在威胁的方法，系统和计算机可读介质。网络的流量数据在一段时间内累积。交通数据由一个或多个键（例如源IP地址）分组，并且针对密钥计算度量值集合。混合分布，例如负二项式混合分布，适合于每组度量值，并且基于混合分布来确定偏离度量值。然后生成异常值列表，其包括在度量值集合中的一个或多个集合中具有超出度量值的密钥值。

3. 发明申请

US20190007296A1 MANAGING LARGE VOLUMES OF EVENT DATA RECORDS 审中-公开
公开(公告)号：US20190007296A1
公开(公告)日：2019-01-03
申请号：US16127338
申请日：2018-09-11
申请人： AT&T Intellectual Property I, L.P.
发明人： Daniel G. Sheleheda , Samuel Norman Alexander , John H. Hardenbergh , Joseph Harten , James Pace , Chaim Spielman
IPC分类号： H04L12/26 , H04L29/06 , H04L12/24
CPC分类号： H04L43/16 , H04L41/0613 , H04L41/0622 , H04L41/069 , H04L43/02 , H04L43/024 , H04L43/0876 , H04L63/1408 , H04L63/1458
摘要： A network device that operates as an analysis platform for analysis of event data records that can provide a flexible approach to event data record aggregation. For example, aggregation can be flexibly turned on or off and dynamically adjusted based on event record volume and other factors such as network capacity or throughput. Devices that are instructed to aggregate records can also be instructed to archive the raw records, e.g., to maintain a full fidelity log of events. Devices can further be instructed to utilize a mixed queue approach to determine an order to deliver those records that includes both older records and newer records.

4. 发明申请

US20170366440A1 MANAGING LARGE VOLUMES OF EVENT DATA RECORDS 审中-公开
公开(公告)号：US20170366440A1
公开(公告)日：2017-12-21
申请号：US15185152
申请日：2016-06-17
申请人： AT&T INTELLECTUAL PROPERTY I, L.P.
发明人： Daniel G. Sheleheda , Samuel Norman Alexander , John H. Hardenbergh , Joseph Harten , James Pace , Chaim Spielman
IPC分类号： H04L12/26 , H04L12/24
CPC分类号： H04L43/16 , H04L41/069 , H04L43/02 , H04L43/0876 , H04L63/1408 , H04L63/1458
摘要： A network device that operates as an analysis platform for analysis of event data records that can provide a flexible approach to event data record aggregation. For example, aggregation can be flexibly turned on or off and dynamically adjusted based on event record volume and other factors such as network capacity or throughput. Devices that are instructed to aggregate records can also be instructed to archive the raw records, e.g., to maintain a full fidelity log of events. Devices can further be instructed to utilize a mixed queue approach to determine an order to deliver those records that includes both older records and newer records.

5. 发明申请

US20160182552A1 Modeling and Outlier Detection in Threat Management System Data 有权
标题翻译：威胁管理系统数据建模与异常检测
公开(公告)号：US20160182552A1
公开(公告)日：2016-06-23
申请号：US15056670
申请日：2016-02-29
申请人： AT&T Intellectual Property I, L.P.
发明人： Jeremy Wright , John Hogoboom , Chaim Spielman
IPC分类号： H04L29/06
CPC分类号： H04L63/1425 , G06F21/552 , H04L63/1416
摘要： Methods, systems, and computer-readable media for identifying potential threats on a network based on anomalous behavior in communication between endpoints are provided. Traffic data for a network is accumulated over some period of time. The traffic data is grouped by one or more keys, such as source IP address, and sets of metric values are calculated for the keys. A mixture distribution, such as a negative binomial mixture distribution, is fitted to each set of metric values, and outlying metric values are determined based on the mixture distribution(s). A list of outliers is then generated comprising key values having outlying metric values in one or more of the sets of metric values.
摘要翻译：提供了用于基于端点之间的通信中的异常行为来识别网络上的潜在威胁的方法，系统和计算机可读介质。网络的流量数据在一段时间内累积。交通数据由一个或多个键（例如源IP地址）分组，并且针对密钥计算度量值集合。混合分布，例如负二项式混合分布，适合于每组度量值，并且基于混合分布来确定偏离度量值。然后生成异常值列表，其包括在度量值集合中的一个或多个集合中具有超出度量值的密钥值。

6. 发明申请

US20190312796A1 ENTERPRISE SERVER BEHAVIOR PROFILING 审中-公开
公开(公告)号：US20190312796A1
公开(公告)日：2019-10-10
申请号：US16442638
申请日：2019-06-17
申请人： AT&T Intellectual Property I, L.P.
发明人： Paul Giura , Stanislav Nurilov , Makonnen Sankore , Chaim Spielman
IPC分类号： H04L12/26 , H04L29/06
摘要： Generation of behavior profiling reports is provided for enterprise server devices in a network of enterprise server devices, as well as generation and association of severity scores for behavior profiling reports generated for enterprise server devices included in the network of enterprise server devices. A method can comprise receiving historical security event data representing historical security events of a first device and owner data representing an owner of the first device, and, as a function of the historical security event data and the owner data, an anomalous contact established between the first device and the second device can be identified. Further, in response to identifying the existence of the anomalous contact, the second device can be depicted on a connected graph of anomalous contacts established by the first device.

7. 发明授权

US10367704B2 Enterprise server behavior profiling 有权
公开(公告)号：US10367704B2
公开(公告)日：2019-07-30
申请号：US15207670
申请日：2016-07-12
申请人： AT&T Intellectual Property I, L.P.
发明人： Paul Giura , Stanislav Nurilov , Makonnen Sankore , Chaim Spielman
IPC分类号： H04L12/26
摘要： Generation of behavior profiling reports is provided for enterprise server devices in a network of enterprise server devices, as well as generation and association of severity scores for behavior profiling reports generated for enterprise server devices included in the network of enterprise server devices. A method can comprise receiving historical security event data representing historical security events of a first device and owner data representing an owner of the first device, and, as a function of the historical security event data and the owner data, an anomalous contact established between the first device and the second device can be identified. Further, in response to identifying the existence of the anomalous contact, the second device can be depicted on a connected graph of anomalous contacts established by the first device.

8. 发明申请

US20130227045A1 Bot-Network Detection Based on Simple Mail Transfer Protocol (SMTP) Characteristics of E-Mail Senders Within IP Address Aggregates 有权
标题翻译：基于IP地址聚合中电子邮件发件人的简单邮件传输协议（SMTP）特征的Bot网络检测
公开(公告)号：US20130227045A1
公开(公告)日：2013-08-29
申请号：US13857269
申请日：2013-04-05
申请人： AT&T Intellectual Property I, L.P.
发明人： Willa Kay Ehrlich , David A. Hoeflin , Danielle Liu , Chaim Spielman , Stephen Wood
IPC分类号： H04L12/58
CPC分类号： H04L51/00 , H04L63/1441
摘要： A method and system for determining whether an IP address is part of a bot-network are provided. The IP-address-aggregate associated with the IP address of an e-mail sender is determined. The IP-address-aggregate is associated with an IP-address-aggregate-category based on the current SMTP traffic characteristics of the IP-address-aggregate and the known SMTP traffic characteristics of an IP-address-aggregate-category. A bot-likelihood score of the IP-address-aggregate-category is then associated with IP-address-aggregate. IP-address-aggregate-categories can be established based on historical SMTP traffic characteristics of the IP-address-aggregates. The IP-address-aggregates are grouped based on SMTP characteristics, and the IP-address-aggregate-categories are defined based on a selection of IP-address-aggregates with similar SMTP traffic characteristics that are diagnostic of spam bots vs. non-botnet-controllers spammers. Bot likelihood scores are determined for the resulting IP-address-aggregate-categories based on historically known bot IP addresses.
摘要翻译：提供一种用于确定IP地址是机器人网络的一部分的方法和系统。确定与电子邮件发件人的IP地址相关联的IP地址聚合。基于IP地址聚合的当前SMTP流量特性和IP地址聚合类别的已知SMTP流量特性，IP地址聚合与IP地址聚合类别相关联。然后将IP地址聚合类别的机率分数与IP地址聚合相关联。可以基于IP地址聚合的历史SMTP流量特性来建立IP地址聚合类别。基于SMTP特性对IP地址聚合进行分组，IP地址聚合类别是根据具有类似SMTP流量特性的IP地址聚合的选择来定义的，这些特征是对垃圾邮件机器人与非僵尸网络的诊断控制垃圾邮件发送者。基于历史上已知的机器人IP地址，为生成的IP地址聚合类别确定Bot似然分数。

9. 发明申请

US20180019932A1 ENTERPRISE SERVER BEHAVIOR PROFILING 审中-公开
公开(公告)号：US20180019932A1
公开(公告)日：2018-01-18
申请号：US15207670
申请日：2016-07-12
申请人： AT&T Intellectual Property I, L.P.
发明人： Paul Giura , Stanislav Nurilov , Makonnen Sankore , Chaim Spielman
IPC分类号： H04L12/26
CPC分类号： H04L43/062 , H04L43/045 , H04L43/0876 , H04L63/1425
摘要： Generation of behavior profiling reports is provided for enterprise server devices in a network of enterprise server devices, as well as generation and association of severity scores for behavior profiling reports generated for enterprise server devices included in the network of enterprise server devices. A method can comprise receiving historical security event data representing historical security events of a first device and owner data representing an owner of the first device, and, as a function of the historical security event data and the owner data, an anomalous contact established between the first device and the second device can be identified. Further, in response to identifying the existence of the anomalous contact, the second device can be depicted on a connected graph of anomalous contacts established by the first device.

10. 发明授权

US09276949B2 Modeling and outlier detection in threat management system data 有权
公开(公告)号：US09276949B2
公开(公告)日：2016-03-01
申请号：US14016162
申请日：2013-09-02
申请人： AT&T Intellectual Property I, L.P.
发明人： Jeremy Wright , John Hogoboom , Chaim Spielman
IPC分类号： H04L29/06 , G06F21/55
CPC分类号： H04L63/1425 , G06F21/552 , H04L63/1416
摘要： Methods, systems, and computer-readable media for identifying potential threats on a network based on anomalous behavior in communication between endpoints are provided. Traffic data for a network is accumulated over some period of time. The traffic data is grouped by one or more keys, such as source IP address, and sets of metric values are calculated for the keys. A mixture distribution, such as a negative binomial mixture distribution, is fitted to each set of metric values, and outlying metric values are determined based on the mixture distribution(s). A list of outliers is then generated comprising key values having outlying metric values in one or more of the sets of metric values.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式