专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20130139263A1 SYSTEMS AND METHODS FOR FINGERPRINTING PHYSICAL DEVICES AND DEVICE TYPES BASED ON NETWORK TRAFFIC 有权
标题翻译：基于网络交通指示物理设备和设备类型的系统和方法
公开(公告)号：US20130139263A1
公开(公告)日：2013-05-30
申请号：US13689748
申请日：2012-11-29
申请人： Georgia Tech Research Corporation
发明人： Abdul Raheem Beyah , Cherita La'Quale Corbett
IPC分类号： H04L29/06
CPC分类号： H04L63/1408
摘要： Systems and methods for providing device and/or device type fingerprinting based on properties of network traffic originating from a device to be identified. In one implementation, the method includes capturing packets routed through a network at an intermediate node between the originating device to be identified and destination, measuring properties of the captured traffic, including packet inter-arrival time, and generating a signature based on the measured properties that includes identifying information about the hardware and/or software architecture of the device. Various implementations do not require deep packet inspection, do not require a managed device-side client, are protocol and packet payload agnostic, and effective for MAC or IP-level encrypted streams. Also, various implementations can provide wired-side detection of wireless devices and device types and can detect both previously detected and unknown devices.
摘要翻译：基于来自要识别的设备的网络流量的属性来提供设备和/或设备类型指纹的系统和方法。在一个实施方式中，该方法包括捕获通过网络在待识别的发起设备之间的中间节点路由的分组，测量所捕获的业务的属性，包括分组到达之间的时间，以及基于所测量的属性生成签名其包括识别关于设备的硬件和/或软件架构的信息。各种实现不需要深度分组检测，不需要受管理的设备端客户端，协议和分组负载不可知，并且对于MAC或IP级加密流有效。此外，各种实现方式可以提供无线设备和设备类型的有线侧检测，并且可以检测先前检测到的和未知的设备。

2. 发明申请

US20190297095A1 Systems and Methods For Detecting Anomalous Software on a Programmable Logic Controller 审中-公开
公开(公告)号：US20190297095A1
公开(公告)日：2019-09-26
申请号：US16302727
申请日：2017-05-22
申请人： Georgia Tech Research Corporation
发明人： David Formby , Abdul Raheem Beyah
IPC分类号： H04L29/06 , G05B19/05 , G06F17/11
摘要： There is provided a method including: during a training period, collecting a plurality of scan cycle times of a programmable logic controller (PLC) program executing on a PLC; calculating one or more baseline parameters based on the plurality of scan cycle times; determining a baseline PLC program signature based on the one or more baseline statistical parameters; and storing the baseline PLC program signature.

3. 发明授权

US09225732B2 Systems and methods for fingerprinting physical devices and device types based on network traffic 有权
标题翻译：基于网络流量的物理设备和设备类型的指纹识别系统和方法
公开(公告)号：US09225732B2
公开(公告)日：2015-12-29
申请号：US13689748
申请日：2012-11-29
申请人： Georgia Tech Research Corporation
发明人： Abdul Raheem Beyah , Cherita La'Quale Corbett
IPC分类号： G06F11/00 , H04L29/06
CPC分类号： H04L63/1408
摘要： Systems and methods for providing device and/or device type fingerprinting based on properties of network traffic originating from a device to be identified. In one implementation, the method includes capturing packets routed through a network at an intermediate node between the originating device to be identified and destination, measuring properties of the captured traffic, including packet inter-arrival time, and generating a signature based on the measured properties that includes identifying information about the hardware and/or software architecture of the device. Various implementations do not require deep packet inspection, do not require a managed device-side client, are protocol and packet payload agnostic, and effective for MAC or IP-level encrypted streams. Also, various implementations can provide wired-side detection of wireless devices and device types and can detect both previously detected and unknown devices.
摘要翻译：基于来自要识别的设备的网络流量的属性来提供设备和/或设备类型指纹的系统和方法。在一个实施方式中，该方法包括捕获通过网络在待识别的发起设备之间的中间节点路由的分组，测量所捕获的业务的属性，包括分组到达之间的时间，以及基于所测量的属性生成签名其包括识别关于设备的硬件和/或软件架构的信息。各种实现不需要深度分组检测，不需要受管理的设备端客户端，协议和分组负载不可知，并且对于MAC或IP级加密流有效。此外，各种实现方式可以提供无线设备和设备类型的有线侧检测，并且可以检测先前检测到的和未知的设备。

4. 发明申请

US20230050691A1 System for detecting malicious programmable logic controller code 有权
公开(公告)号：US20230050691A1
公开(公告)日：2023-02-16
申请号：US17789439
申请日：2021-01-16
申请人： Georgia Tech Research Corporation
发明人： Qinchen Gu , Abdul Raheem Beyah
IPC分类号： G06F21/55
摘要： A system (100) and method for detecting a malicious programmable logic controller (PLC) code segment (110) in a PLC program corresponding to a specific type of PLC includes a binary parser (112) that parses the code segment (110) into a plurality of functional elements. A variable and function block mapper (114) maps the functional elements into a high-level data structure. A fuzzer (116) generates a behavioral model of the high-level data structure into an automaton (118). A classifier (120) predicts to which processes the automaton (118) corresponds. A detector (122) detects unsafe states in the automaton (118) and that generates an indication of a detected unsafe state.

5. 发明授权

US10986107B2 Systems and methods for detecting anomalous software on a programmable logic controller 有权
公开(公告)号：US10986107B2
公开(公告)日：2021-04-20
申请号：US16302727
申请日：2017-05-22
申请人： Georgia Tech Research Corporation
发明人： David Formby , Abdul Raheem Beyah
IPC分类号： H04L29/06 , G05B19/05 , G06F17/11 , G05B11/01 , G06F21/55 , G06F9/4401
摘要： There is provided a method including: during a training period, collecting a plurality of scan cycle times of a programmable logic controller (PLC) program executing on a PLC; calculating one or more baseline parameters based on the plurality of scan cycle times; determining a baseline PLC program signature based on the one or more baseline statistical parameters; and storing the baseline PLC program signature.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式