专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20090133125A1 METHOD AND APPARATUS FOR MALWARE DETECTION 审中-公开
标题翻译：用于恶意软件检测的方法和装置
公开(公告)号：US20090133125A1
公开(公告)日：2009-05-21
申请号：US12209249
申请日：2008-09-12
申请人： Yang Seo Choi , Ik Kyun Kim , Byoung Koo Kim , Seung Yong Yoon , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
发明人： Yang Seo Choi , Ik Kyun Kim , Byoung Koo Kim , Seung Yong Yoon , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
IPC分类号： G06F21/00
CPC分类号： G06F21/562 , G06F21/56
摘要： The present invention relates to an apparatus and method for detecting malware. The malware detection apparatus and method of the present invention determines whether a file is malware or not by analyzing the header of an executable file. Since the malware detection apparatus and method can quickly detect presence of malware, it can shorten detection time considerably. The malware detection apparatus and method can also detect even unknown malware as well as known malware to thereby estimate and determine presence of malware. Therefore, it is possible to cope with malware in advance, protect a system with a program, and increase security level remarkably.
摘要翻译：本发明涉及一种用于检测恶意软件的装置和方法。本发明的恶意软件检测装置和方法通过分析可执行文件的标题来确定文件是否是恶意软件。由于恶意软件检测装置和方法可以快速检测恶意软件的存在，因此可以大大缩短检测时间。恶意软件检测装置和方法还可以检测甚至未知的恶意软件以及已知的恶意软件，从而估计和确定恶意软件的存在。因此，可以提前应对恶意软件，用程序保护系统，显着提高安全等级。

2. 发明申请

US20100146621A1 METHOD OF EXTRACTING WINDOWS EXECUTABLE FILE USING HARDWARE BASED ON SESSION MATCHING AND PATTERN MATCHING AND APPRATUS USING THE SAME 有权
标题翻译：使用基于会话匹配和图案匹配的硬件提取WINDOWS可执行文件的方法和使用该方法的方法
公开(公告)号：US20100146621A1
公开(公告)日：2010-06-10
申请号：US12503288
申请日：2009-08-17
申请人： Byoung Koo Kim , Seung Yong Yoon , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang , Hyun Sook Cho
发明人： Byoung Koo Kim , Seung Yong Yoon , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang , Hyun Sook Cho
IPC分类号： G06F17/30 , G06F12/14 , G06F11/00 , G06F12/16 , G08B23/00
CPC分类号： H04L63/145 , G06F21/564
摘要： A method and apparatus for extracting a windows executable file that can search for a pattern related to windows executable files among a large quantity of network packets using a hardware-based session tracking and pattern matching technology and that can extract all packets included in the corresponding session are provided. The method of extracting a windows executable file includes: collecting incoming packets having a payload according to a session of a reference packet having an MZ pattern; performing a portable executable (PE) pattern matching for the collected incoming packets; and forming a PE file based on at least one incoming packet satisfying the PE pattern matching.
摘要翻译：一种用于提取Windows可执行文件的方法和装置，其可以使用基于硬件的会话跟踪和模式匹配技术在大量网络分组中搜索与Windows可执行文件相关的模式，并且可以提取包括在相应会话中的所有分组被提供。提取Windows可执行文件的方法包括：根据具有MZ模式的参考分组的会话收集具有有效载荷的传入分组; 对所收集的传入分组执行匹配的便携式可执行（PE）模式; 以及基于满足PE模式匹配的至少一个输入分组形成PE文件。

3. 发明授权

US08230503B2 Method of extracting windows executable file using hardware based on session matching and pattern matching and apparatus using the same 有权
标题翻译：基于会话匹配和模式匹配的硬件提取Windows可执行文件的方法及使用该可执行文件的方法
公开(公告)号：US08230503B2
公开(公告)日：2012-07-24
申请号：US12503288
申请日：2009-08-17
申请人： Byoung Koo Kim , Seung Yong Yoon , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang , Hyun Sook Cho
发明人： Byoung Koo Kim , Seung Yong Yoon , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang , Hyun Sook Cho
IPC分类号： H04L29/06
CPC分类号： H04L63/145 , G06F21/564
摘要： A method and apparatus for extracting a windows executable file that can search for a pattern related to windows executable files among a large quantity of network packets using a hardware-based session tracking and pattern matching technology and that can extract all packets included in the corresponding session are provided. The method of extracting a windows executable file includes: collecting incoming packets having a payload according to a session of a reference packet having an MZ pattern; performing a portable executable (PE) pattern matching for the collected incoming packets; and forming a PE file based on at least one incoming packet satisfying the PE pattern matching.
摘要翻译：一种用于提取Windows可执行文件的方法和装置，其可以使用基于硬件的会话跟踪和模式匹配技术在大量网络分组中搜索与Windows可执行文件相关的模式，并且可以提取包括在相应会话中的所有分组被提供。提取Windows可执行文件的方法包括：根据具有MZ模式的参考分组的会话收集具有有效载荷的传入分组; 对所收集的传入分组执行匹配的便携式可执行（PE）模式; 以及基于满足PE模式匹配的至少一个输入分组形成PE文件。

4. 发明授权

US08095973B2 Apparatus and method for detecting network attack 有权
标题翻译：网络攻击检测装置及方法
公开(公告)号：US08095973B2
公开(公告)日：2012-01-10
申请号：US11926132
申请日：2007-10-29
申请人： Ik Kyun Kim , Yang Seo Choi , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
发明人： Ik Kyun Kim , Yang Seo Choi , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
IPC分类号： G06F9/00 , G06F15/16 , G06F17/00 , G06F11/00 , G06F12/14 , G06F12/16 , G08B23/00
CPC分类号： H04L63/1408
摘要： There are provided a network attack detection apparatus and method capable of determining even unknown network attack, the apparatus connected between two networks or connected by port mirroring of an Ethernet switch to real-time monitor all packets flowing through the networks. The apparatus decodes a payload portion of an inputted network packet into a machine code instruction, determines whether an executable code is included in the decoded machine code by analyzing relationship between instructions, and determines whether the packet is harmful based on statistics with respect to a possibility that an executable code exists in a service and a certain transaction of the service when the executable code is included.
摘要翻译：提供了能够确定甚至未知网络攻击的网络攻击检测装置和方法，连接在两个网络之间的装置或通过以太网交换机的端口镜像连接的实时监视通过网络流动的所有分组的网络攻击检测装置和方法。该装置将输入的网络分组的有效载荷部分解码为机器码指令，通过分析指令之间的关系来确定解码的机器码中是否包括可执行代码，并且基于关于可能性的统计来确定分组是否有害当包括可执行代码时，可执行代码存在于服务和服务的某个事务中。

5. 发明申请

US20080134334A1 APPARATUS AND METHOD FOR DETECTING NETWORK ATTACK 有权
标题翻译：用于检测网络攻击的装置和方法
公开(公告)号：US20080134334A1
公开(公告)日：2008-06-05
申请号：US11926132
申请日：2007-10-29
申请人： Ik Kyun Kim , Yang Seo Choi , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
发明人： Ik Kyun Kim , Yang Seo Choi , Dae Won Kim , Jin Tae Oh , Jong Soo Jang
IPC分类号： G06F11/00
CPC分类号： H04L63/1408
摘要： There are provided a network attack detection apparatus and method capable of determining even unknown network attack, the apparatus connected between two networks or connected by port mirroring of an Ethernet switch to real-time monitor all packets flowing through the networks. The apparatus decodes a payload portion of an inputted network packet into a machine code instruction, determines whether an executable code is included in the decoded machine code by analyzing relationship between instructions, and determines whether the packet is harmful based on statistics with respect to a possibility that an executable code exists in a service and a certain transaction of the service when the executable code is included.
摘要翻译：提供了能够确定甚至未知网络攻击的网络攻击检测装置和方法，连接在两个网络之间的装置或通过以太网交换机的端口镜像连接的实时监视通过网络流动的所有分组的网络攻击检测装置和方法。该装置将输入的网络分组的有效载荷部分解码为机器码指令，通过分析指令之间的关系来确定解码的机器码中是否包括可执行代码，并且基于关于可能性的统计来确定分组是否有害当包括可执行代码时，可执行代码存在于服务和服务的某个事务中。

6. 发明授权

US08166545B2 Method and apparatus for detecting executable code 失效
标题翻译：用于检测可执行代码的方法和装置
公开(公告)号：US08166545B2
公开(公告)日：2012-04-24
申请号：US12044393
申请日：2008-03-07
申请人： Dae Won Kim , Yang Seo Choi , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang
发明人： Dae Won Kim , Yang Seo Choi , Ik Kyun Kim , Jin Tae Oh , Jong Soo Jang
IPC分类号： G06F11/00
CPC分类号： H04L43/18 , H04L63/1408 , H04L63/145
摘要： There are provided an apparatus and method for detecting an executable code, capable of verifying reliability of an extracted signature by determining whether there is present an executable code in network data by using instruction pattern information related calling mechanism of function for distinguishing the executable code from a non-executable code, the method including: forming instructions by reverse assembling network data suspicious as an attack; comparing the respective formed instructions with instruction patterns according to calling mechanism of function; and determining whether there is present an executable code in the network data according to a result of the comparing.
摘要翻译：提供了一种用于检测可执行代码的装置和方法，其能够通过使用指令模式信息相关的调用机制来确定是否存在网络数据中的可执行代码来验证提取的签名的可靠性，以便将可执行代码与不可执行代码，该方法包括：通过将可疑的网络数据反向组合为攻击来形成指令; 根据功能的调用机制将各形成的指令与指令模式进行比较; 以及根据所述比较的结果确定是否存在所述网络数据中的可执行代码。

7. 发明申请

US20120324573A1 METHOD FOR DETERMINING WHETHER OR NOT SPECIFIC NETWORK SESSION IS UNDER DENIAL-OF-SERVICE ATTACK AND METHOD FOR THE SAME 审中-公开
标题翻译：用于确定无论是否具体网络会话是否属于服务质量攻击的方法及其相关方法
公开(公告)号：US20120324573A1
公开(公告)日：2012-12-20
申请号：US13453968
申请日：2012-04-23
申请人： Dae Won KIM , Yang Seo Choi , Ik Kyun Kim
发明人： Dae Won KIM , Yang Seo Choi , Ik Kyun Kim
IPC分类号： G06F21/00 , G06F11/00
CPC分类号： H04L63/1458
摘要： Provided is an apparatus and method for determining whether or not a specific network session is under a denial-of-service (DoS) attack. The method includes detecting a packet transmitted in the session, initializing the number of attack-suspicion continuation packets, increasing the number of attack-suspicion continuation packets by a predetermined number, and determining that the session is under the DoS attack.
摘要翻译：提供了一种用于确定特定网络会话是否处于拒绝服务（DoS）攻击的装置和方法。该方法包括检测在会话中发送的分组，初始化攻击怀疑继续分组的数量，将攻击怀疑继续分组的数量增加预定数量，并确定该会话处于DoS攻击状态。

8. 发明授权

US06421343B1 Asynchronous transfer mode host adapter apparatus with ability of shared media access 有权
标题翻译：具有共享媒体访问能力的异步传输模式主机适配器设备
公开(公告)号：US06421343B1
公开(公告)日：2002-07-16
申请号：US09137535
申请日：1998-08-21
申请人： Jong Arm Jun , Chan Kim , Yeong Ho Park , Ik Kyun Kim , Young Wook Cha , Kyou Ho Lee , Hyup Jong Kim , Jae Geun Kim
发明人： Jong Arm Jun , Chan Kim , Yeong Ho Park , Ik Kyun Kim , Young Wook Cha , Kyou Ho Lee , Hyup Jong Kim , Jae Geun Kim
IPC分类号： H04L1228
CPC分类号： H04L12/5601 , H04L2012/5612 , H04L2012/5616 , H04L2012/5653
摘要： An asynchronous transfer mode (ATM) host adapting apparatus comprising: a storage block for storing packet information, received cells, and parameters; an ATM network interface handling block for performing direct memory access of ATM cells and parameter stored therein, segmenting transmit packet information, reassembling received cells, transmitting and receiving the ATM cells to physical media cell received, and arbitrating in the direct memory access; and a secondary interface block for connecting the storage block to the ATM network interface handling block.
摘要翻译：一种异步传输模式（ATM）主机适配装置，包括：存储分组信息，接收的小区和参数的存储块; 用于执行ATM信元的直接存储器访问和存储在其中的参数的ATM网络接口处理块，分组发送分组信息，重新组合接收到的小区，向所接收的物理介质小区发送和接收ATM信元，并在直接存储器访问中进行仲裁; 以及用于将存储块连接到ATM网络接口处理块的辅助接口块。

9. 发明授权

US08965823B2 Insider threat detection device and method 有权
标题翻译：内部威胁检测装置及方法
公开(公告)号：US08965823B2
公开(公告)日：2015-02-24
申请号：US13475880
申请日：2012-05-18
申请人： Seon Gyoung Sohn , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
发明人： Seon Gyoung Sohn , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
IPC分类号： G06F17/00 , G06N5/02 , G08B31/00
CPC分类号： G08B31/00
摘要： The present invention relates to an insider threat detection device and method which collects and analyzes a variety of information generated by insiders working for an organization, such as behaviors, events, and states of the insider, and detects an abnormal insider who may become a potential threat. According to the present invention, the insider threat detection method and apparatus analyzes information related to insiders using the correlation analysis method, and previously detects an abnormal sign of an insider who may become a potential threat to an organization, which makes it possible to protect the organization from attacks on systems inside the organization or seizure of important information inside the organization.
摘要翻译：本发明涉及一种内部威胁检测装置和方法，其收集和分析由内部人员为内部人员行为，事件和状态等内部人员所产生的各种信息，并检测可能成为潜在的异常内部人员威胁。根据本发明，内部威胁检测方法和装置使用相关分析方法分析与内部人相关的信息，并且先前检测到可能成为对组织的潜在威胁的内部人员的异常标志，这使得可以保护组织对组织内的系统的攻击或组织内重要信息的检取。

10. 发明申请

US20130091085A1 INSIDER THREAT DETECTION DEVICE AND METHOD 有权
标题翻译：内部检测装置及方法
公开(公告)号：US20130091085A1
公开(公告)日：2013-04-11
申请号：US13475880
申请日：2012-05-18
申请人： Seon Gyoung SOHN , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
发明人： Seon Gyoung SOHN , Chi Yoon Jeong , Dong Ho Kang , Jung Chan Na , Ik Kyun Kim , Hyun Sook Cho
IPC分类号： G06N5/02
CPC分类号： G08B31/00
摘要： The present invention relates to an insider threat detection device and method which collects and analyzes a variety of information generated by insiders working for an organization, such as behaviors, events, and states of the insider, and detects an abnormal insider who may become a potential threat. According to the present invention, the insider threat detection method and apparatus analyzes information related to insiders using the correlation analysis method, and previously detects an abnormal sign of an insider who may become a potential threat to an organization, which makes it possible to protect the organization from attacks on systems inside the organization or seizure of important information inside the organization.
摘要翻译：本发明涉及一种内部威胁检测装置和方法，其收集和分析由内部人员为内部人员行为，事件和状态等内部人员所产生的各种信息，并检测可能成为潜在的异常内部人员威胁。根据本发明，内部威胁检测方法和装置使用相关分析方法分析与内部人相关的信息，并且先前检测到可能成为对组织的潜在威胁的内部人员的异常标志，这使得可以保护组织对组织内的系统的攻击或组织内重要信息的检取。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式