[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

WO2000068811A1 - Procede et systeme pour saisir des donnees de reseau et identifier les actions du reseau a partir de ces donnees - Google Patents

Procede et systeme pour saisir des donnees de reseau et identifier les actions du reseau a partir de ces donnees Download PDF

Info

Publication number
WO2000068811A1
WO2000068811A1 PCT/US2000/011184 US0011184W WO0068811A1 WO 2000068811 A1 WO2000068811 A1 WO 2000068811A1 US 0011184 W US0011184 W US 0011184W WO 0068811 A1 WO0068811 A1 WO 0068811A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
network data
event
module
identify
Prior art date
Application number
PCT/US2000/011184
Other languages
English (en)
Inventor
John D. Abromavage
Mark Longworth
Todd A. Moore
Scott V. Totman
Vince Romano
Original Assignee
Network Forensics, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Network Forensics, Inc. filed Critical Network Forensics, Inc.
Priority to AU68883/00A priority Critical patent/AU6888300A/en
Publication of WO2000068811A1 publication Critical patent/WO2000068811A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/18—Protocol analysers

Definitions

  • the invention relates to the field of communications, and more particularly to advanced network security. 5 Background of the Invention
  • Risk avoidance techniques involve introducing a barrier to prevent inappropriate entry into a network. Such systems place reliance on keeping intruders out of the network entirely, rather than monitoring inappropriate network traffic after logging in. Risk avoidance systems include dedicated
  • intrusion detector systems often lend a false sense of security to systems administrators, while not really solving the underlying security problem. Intrusion detector systems produce a high rate of false positive identification, by inaccurately reporting legitimate network activity as suspicious. Intrusion detector systems also often overwhelm a
  • Auditing systems provide another type of tool used under the risk management approach.
  • Auditing systems are implemented as a host- based technique, in which a central server running the operating system logs the activity of client computers in a central storage area.
  • the host computer running the audit system itself may be susceptible to being attacked internally or externally, creating a point of vulnerability in the overall surveillance.
  • Some other auditing products such as Session Wall-3TM from AbirNet, employ so-called sniffer technology to monitor network traffic. Data streams collected by such products look for specific types of network traffic, for example, detecting electronic mail uploads by monitoring port 25 for simple mail transfer protocol (SMTP) events.
  • SMTP simple mail transfer protocol
  • the invention overcoming these and other problems in the art relates to a system and method for network security capable of comprehensive network surveillance.
  • the invention incorporates both network monitoring ports and analysis tools which enable a systems administrator to unobtrusively, but thoroughly, profile the entire range of network activity.
  • the invention is incorporated into computer and other installations at the network level, and generally includes a dedicated observation port which passes the entire range of network traffic into a system interpreter.
  • the collected information is subjected to a series of reductions to network sessions, metadata and eventually to statistical or other summary presentations.
  • the invention thus subjects network traffic to a hierarchical series of real-time or forensic treatments, in which no type of data or network activity is excluded. Because the invention is only reading data at the network level and does not rely upon a central server running other tasks, the security protection offered is difficult or impossible to circumvent or corrupt. Because the entire data stream of the network is captured and profiled and profiling is not dependent on one subset of port assignments or boundary conditions, forensic inspection of past network activity is enhanced.
  • Fig. 1 illustrates a network architecture for security according to the invention.
  • Fig. 2 is a flow chart illustrating surveillance and auditing processing according to the invention.
  • Fig. 3 illustrates a presentation interface for viewing and analyzing data collected by the invention.
  • Fig. 4 illustrates the operation of an inte ⁇ reter module according to the invention.
  • Fig. 5 illustrates the operation of an assembler module and parser module according to the invention.
  • Network 142 may be or include as a segment any one or more of, for instance, the Internet, an intranet, a PAN (Personal Area Network), a LAN (Local Area Network), a WAN (Wide Area Network) or a MAN (Metropolitan Area Network), a frame relay connection, an Advanced Intelligent Network (AIN) connection, a synchronous optical network (SONET) connection, a digital Tl, T3 or El line, Digital Data Service (DDS) connection, DSL (Digital Subscriber Line) connection, an Ethernet connection, an ISDN (Integrated Services Digital Network) line, a dial- up port such as a V.90, N.34 or N.34bis analog modem connection, a cable modem, an ATM (Asynchronous Transfer Mode) connection, or FDDI (Fiber Distributed Data Networks)
  • Network 142 may furthermore be or include as a segment any one or more of a WAP (Wireless Application Protocol) link, a GPRS (General Packet Radio Service) link, a GSM (Global System for Mobile Communication) link, a CDMA (Code Division Multiple Access) or TDMA (Time Division Multiple Access) link such as a cellular phone channel, a GPS (Global Positioning System) link, a Bluetooth radio link, or an IEEE 802.1 1 -based radio frequency link.
  • WAP Wireless Application Protocol
  • GPRS General Packet Radio Service
  • GSM Global System for Mobile Communication
  • CDMA Code Division Multiple Access
  • TDMA Time Division Multiple Access
  • a cellular phone channel such as a cellular phone channel
  • GPS Global Positioning System
  • Bluetooth radio link such as a cellular phone channel
  • IEEE 802.1 1 -based radio frequency link such as a cellular phone channel.
  • Network 142 may yet further be or include as a segment any one or more of an RS-232 serial connection, IEEE-1394 (Firewire) connections, an IrDA (infrared) port, a SCSI (Small Computer Serial Interface) connection, a USB (Universal Serial Bus) connection or other wired or wireless, digital or analog interfaces or connections.
  • IEEE-1394 Firewire
  • IrDA infrared
  • SCSI Serial Computer Serial Interface
  • USB Universal Serial Bus
  • the network data stream 144 traversing the network 142 in the illustrative embodiment is a sequence of digital bits, which network observation port 104 senses and collects.
  • Network observation port 104 may be implemented in a computer workstation configured with a network interface card (NIC), with that device configured to promiscuous mode so that all data is communicated transparently through the network observation port 104.
  • NIC network interface card
  • network observation port 104 is preferably embedded in the network without a separate network address, so that its presence on the network is not discernible to network users.
  • Network observation port 104 is likewise preferably installed on a network node, such as a computer workstation or server, which is not responsible for and does not run the network operating system for the network 142.
  • the computer workstation or server which hosts network observation port 104 may be, for instance, a workstation running the Microsoft Windows NT , Unix, Linux, Xenix, SolarisTM, OS/2TM, BeOSTM, Mach, OpenStepTM or other operating system or platform software.
  • the network observation port 104 transmits a copy of the network data stream 144 in the form of collected data stream 106 to interpreter module 108 over connection 146.
  • Interpreter module 108 accepts the collected data stream 106 and interprets the collected data stream 106 into logical groupings, as illustrated in Fig. 4. This process is sometimes called fragment reassembly.
  • interpreter module 108 may interpret collected data stream 106 into Ethernet packets in an Ethernet implementation, and strip information off from those packets that will be extraneous to the further treatment of the collected data stream 106.
  • address information in the header reflects a media access control (MAC) hardware address, which is an absolute value and not readily mapped to a user or host, which have a logical rather than physical address.
  • the interpreter module 108 thus removes the portions of the collected data stream 106 which contain the hardware-bound Ethernet header and processes the IP packet content.
  • Inte ⁇ reter module 108 transmits the resulting data packets 110 over communications link 148 to an assembler module 112.
  • the assembler module 112 accepts the incoming data packets 110 to perform a next level of data analysis. More particularly, the assembler module 112 consolidates the arriving data packets 110 into complete session files 118 representing discrete network events, such as data access and downloads by individual users. Individual session files 118 may be, for instance, transfer control protocol (TCP) sessions reflecting Internet activity. As another variety of detectable transmissions, streaming video connections may be transmitted using the user datagram protocol (UDP) standard which is a connectionless protocol, since individual packets do not relate to or depend on preceding or following packets. Given that a UDP packet arrives in data packets 110 and is unique, that packet is added to a reassembly queue 180 (illustrated in Fig. 1) by assembler module 112.
  • TCP transfer control protocol
  • UDP user datagram protocol
  • UDP User Datagram Protocol
  • the criteria for a session to be marked complete in the case of UDP is that the user defined timeout period (preferably with a default such as 30 seconds) is reached, and that the assembler module 112 activates an iterator module 178 on the session.
  • the iterator module 178 only acts when the assembler module 112 enters an idle state, and flushes completed sessions.
  • Assembler module 112. may deduce that a series of data packets 1 10 containing the same source and destination addresses and traversing the network 142 at the same time are part of a single UDP session, and output a UDP object into session file 118 accordingly.
  • Other protocols may be deduced from the data packets presented to assembler module 112.
  • the assembler module 112 of the invention for instance, is not limited to recognizing, and does not presume that, all of data packets 110 are arriving under the TCP/IP protocol.
  • Assembler module 112 may also contain external application port 114 for accepting network packet information collected from separate external applications 116, such as conventional sniffer packages or others.
  • the assembler module 112 After storing the sessions into session file 118, the assembler module 112 transmits the sessions 140 to parser module 120 via connection 158.
  • the parser module 120 stores an overall log of the sessions 140 into session database 122. Parser module 120 contains application sensor module
  • Application sensor 126 that is invoked for each session 140 to determine the type of application that generated the session.
  • Application sensor 126 uses port assignments, lexical information and other data related to sessions 140 to determine what type of extractor 128 to invoke to process given session 140
  • Application sensor 126 includes a library of classes of extractors 128 to call up to process sessions 140.
  • Application sensor 126 characterizes the application type of sessions 140 by analyzing a variety of information contained in and characterizing the session 140. That information may include source and destination addresses, sequence numbers, source and destination ports, and other parameters as illustrated in Fig.
  • Ses 140 of TCP and other protocols are characterized based in part upon a keyword lexicon analysis.
  • parser module 120 contains a lexicon module 174 which analyzes sessions 140 to flag the presence of keyword phrases consistent with different types of TCP sessions. Accumulated information concerning these flags, such as the presence of discreet keywords or totals for keyword occurrences, are used to identify enumerated network objects. For some types of network information, the occurrence of a single keyword may indicate the presence of an associated data object. For others, the total number of keyword occurrences, a weighted metric or other information may be compared to a threshold or other criteria to establish that category of event.
  • the presence of the phrase “/r/nfrom:” is illustratively flagged for candidacy as both an email and news article object.
  • the keyword "/r/nNewsGroup:” correlates only to a news object.
  • the logical trigger for news articles may be the presence of a flag for "/r/nnewsgroup:” being present and flagged.
  • the logical trigger for the presence of email may be positive flags for the terms "/r/nFrom:” in addition to the phrase “/r/nTo:”.
  • An example of a procedure call, invoked by the sensor module 126, to identify an SMTP event follows.
  • the code in the following table (illustratively in C++, although it will be understood that other languages may be used) may be employed according to the invention to isolate those types of mail transmissions.
  • Flaglt (APP_STATE, APP_SMTP, SMTPDATA); ⁇ A data ⁇ r ⁇ Flaglt (APP STATE, APP_SMTP, SMTPDATA);
  • HELO preceded by a line feed (' ⁇ " ) is flagged as a SMTPHELO.
  • Minimum Match Criteria if a 'SMTPHELO', 'SMTPDATA', and 'SMTPRCPTTO' is found, the match is made and an SMTP parser is called.
  • the following procedure call may be employed.
  • Flaglt (APP_STATE, APP_HTTP, HTTP ACCEPT); ⁇ "User- Agent: " ⁇ Flaglt (APP_STATE, APP HTTP, HTTPUSERAGENT);
  • Flaglt CONTENT_STATE, CNT_HTML, HTMLHREF
  • ⁇ " ⁇ H1 ⁇ Flaglt (CONTENT_STATE, CNT_HTML, HTMLH 1 );
  • the original network data stream 144 may be sampled during a streaming video, voice-over-network or other virtual connections which are not encapsulated in a textual or TCP format.
  • application sensor 126 may be applied recursively to identify protocols within other protocols to extract nested or underlying objects encapsulated in one or more different protocols.
  • the protocols the invention may detect include, but are not limited to, TCP, IP, UDP, SMTP, HTTP, NNTP, FTP, TELNET, DNS, RIP, BGP, MAIL, NEWS, HTML, XML, PGP, S/MIME, POP, IMAP, V-CARD, ICMP, NetBUI, IPX and SPX objects, understood by persons skilled in the art.
  • the universe of protocols that sensor module 128 can detect and identify is extensible, and can be added to or subtracted from to accommodate future protocols and for other network needs.
  • parser module 120 may, depending upon configuration information and type of session, store part or all of a complete session to content database 182 after assignation of a unique storage address.
  • the parser module 120 also contains extractor module 128, which processes the determined protocol for a given session 140 and generates the minimum subset of information needed to identify the nature of session 140 for recording on session database 122, removing unnecessary information before storage. Information may be reduced using text compression and other techniques. Because network protocols are designed to nest, extractor 128 is applied recursively to process protocols within other protocols, as identified by sensor 126. Depending on the category of session 140, the data reduction from the original network sessions to the metadata image of the session (each stored on session database 122) may be on the order of 100 to 1 or greater.
  • the storage requirements of session database 122 may be substantial. However, the storage requirement of the invention is commensurate with the comprehensive nature of the surveillance performed and affords system administrators the opportunity to perform more fully featured post hoc traffic analysis.
  • a presentation interface 138 (illustrated in more detail in Fig. 3) communicates via communication line 168 to a presentation server 136.
  • the presentation server 136 may be a workstation or other device, such as a personal computer running
  • TM TM TM the Microsoft Windows 95, 98, NT , Unix, Linux, Solaris , OS/2 ,
  • the presentation interface 138 may be accessed by a systems administrator wishing to perform network investigation or maintenance, and may be connected to presentation server 136 for example via a common gateway interface (CGI) bin or other Web service interfaces.
  • CGI common gateway interface
  • the presentation server 136 is in turn connected via communications link 166 to a summary database 132, which is in turn connected via connection 164 to session database 122.
  • the session database 122 and summary database 132 may in one regard be serviced by the same database engine, such as an online analytic processing (OLAP) interface.
  • OLAP online analytic processing
  • Execution of scripts through an OLAP or other engine such as a relational database engine accessed by Standard Query Language (SQL) generates the summary database 132 from searches on the session database 122.
  • SQL Standard Query Language
  • Presentation interface 138 allows a systems administrator to invoke a graphical or other menu of different inquiries into the past behavior of network 142. Those inquiries may include an investigation of Websites most frequently visited by users of the network, individual users exhibiting the highest rate of e- mail traffic including images of the e-mail messages themselves, nodal analyses of different network addresses and their most frequent communicants, and other information recorded in the resulting databases.
  • characterization module 134 may store high-level, digested data indicating the overall behavior of network 142, such as peak traffic times, distribution of utilized bandwidths across the network over time, general degree of user activity and other categories of characteristic data.
  • Presentation interface 138 may overlay the graphical or other depiction of the network behavior with system policy constraints or goals, such as limits on Web access or e-mail traffic, to visually show how different facets of the network are complying or behaving. Presentation interface 138 may, if desired, be connected to a printer or other output device (not shown) to produce hard copy of the different varieties of reports prepared according to the invention.
  • summary database 132 may include ports to other external applications to receive further collateral information concerning network behavior, such as employee lists, accounting records and other packages.
  • step 202 processing begins.
  • step 204 bits from the network data stream 144 are collected by network observation port 104 into collected data stream 106.
  • step 206 the collected data stream 106 is transmitted to inte ⁇ reter module 108.
  • step 208 the inte ⁇ reter module 108 resolves the collected data stream 106 into data packets 110.
  • step 210 the assembler module 112 accepts additional packets from any external application ports, if any are present.
  • step 212 assembler module 112 assembles data packets 110 into individual sessions 140, storing new sessions in session file 118.
  • step 214 assembler module 112 transmits copies of the sessions 140 to parser module
  • step 216 the parser module 120 invokes the sensor module 126 to assign a session type to individual sessions 140.
  • step 218 the extractor module 128 is invoked to extract the minimum essential session data to be reflected in summary database 132.
  • parsed session information is stored in session database 122.
  • the summary database 132 is generated by executing OLAP scripts or other search or query mechanisms against session database 122.
  • step 224 the presentation interface 138 is presented to a systems administrator or other user.
  • a user inquiry is accepted, such as an interrogation from a systems administrator.
  • the user inquiry is input to the presentation server 136.
  • the presentation server 136 analyzes the query parameters and communicates with the summary database 132.
  • the characterization module 134 is executed.
  • the resulting graphical or other data are presented to the user via the presentation interface 138.
  • processing ends.
  • inte ⁇ reter module 108 has been illustrated as accepting input form a single network observation port 104, inte ⁇ reter module 108 could accept samples of the network data stream 144 from multiple ports.
  • presentation interface 138 has been illustrated as an interactive module accepting analytic requests from a user, predetermined sets of reports can be executed by presentation server 136, summary database 132 and associated components in batch fashion. While certain functions have been described as being stored on and executed by individual modules, servers and other network elements, it will be appreciated that different aspects of the control and analysis of the invention maybe executed by different computers or other devices, in distributed fashion. The scope of the invention is accordingly intended only to be limited by the following claims.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

L'invention concerne un système (Figure 1) conçu pour assurer la sécurité d'un réseau (142) qui occupe de manière transparente un port d'observation (104) sur le flot de données (144), transférant l'intégralité de la gamme d'informations de réseau à un interprète spécialisé (108). Cet interprète divise le flot de données en paquets de données individuels (110) qui sont ensuite regroupés en sessions de réseau reconstruites (140) en fonction de paramètres tels que, le type de protocole, les adresses source et destination, les ports source et destination, les numéros de séquence ainsi que d'autres variables. Les différents types de sessions peuvent comprendre le trafic d'un grand nombre de différents types d'utilisateurs, tels que le e-mail, la vidéo en continu, la téléphonie via Internet et d'autres. Le système détecte et stocke les sessions dans une base de données (122). Un module de programme d'analyse (120) peut extraire seulement les informations minimales requises pour reconstruire les sessions individuelles (118). Une interface du système principal permet à un administrateur de systèmes d'interroger le dossier de traitement différé du réseau pour des raisons de sécurité, de maintenance ou autres. L'invention ne concerne pas uniquement la détection de certains types de données mais elle permet également de saisir et d'enregistrer un dossier complet sur le comportement du réseau.
PCT/US2000/011184 1999-04-30 2000-04-27 Procede et systeme pour saisir des donnees de reseau et identifier les actions du reseau a partir de ces donnees WO2000068811A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
AU68883/00A AU6888300A (en) 1999-04-30 2000-04-27 System and method for capturing network data and identifying network events therefrom

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US13190499P 1999-04-30 1999-04-30
US60/131,904 1999-04-30

Publications (1)

Publication Number Publication Date
WO2000068811A1 true WO2000068811A1 (fr) 2000-11-16

Family

ID=22451529

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2000/011184 WO2000068811A1 (fr) 1999-04-30 2000-04-27 Procede et systeme pour saisir des donnees de reseau et identifier les actions du reseau a partir de ces donnees

Country Status (2)

Country Link
AU (1) AU6888300A (fr)
WO (1) WO2000068811A1 (fr)

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003009532A1 (fr) * 2001-07-19 2003-01-30 Intrusion, Inc. Systeme et procede de detection d'evenements reseau
WO2005071890A1 (fr) * 2004-01-27 2005-08-04 Actix Limited Systeme de controle pour un reseau de communications mobiles pour l'analyse du trafic par approche hierarchique
US6957255B1 (en) 1999-06-28 2005-10-18 Amdocs (Israel) Ltd. Method and apparatus for session reconstruction and accounting involving VoIP calls
US6963912B1 (en) 1999-06-28 2005-11-08 Xacct Technologies, Ltd. Method and apparatus for session reconstruction
US7218633B2 (en) 2000-03-27 2007-05-15 Bbn Technologies Corporation Personal area network with automatic attachment and detachment
US7333956B2 (en) 2000-11-08 2008-02-19 Orchestria Limited Information management system
EP2164232A1 (fr) 2008-09-10 2010-03-17 Axis AB Dispositif connecteur de réseau
US9049212B2 (en) 2004-09-30 2015-06-02 International Business Machines Corporation Method, system, and computer program product for prefetching sync data and for edge caching sync data on a cellular device
US9674858B2 (en) 2001-11-30 2017-06-06 Iii Holdings 1, Llc Receiver scheduling in wireless networks
CN109117142A (zh) * 2018-07-19 2019-01-01 北京理工大学 一种基于变量关联树的基本类型重构方法

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5191525A (en) * 1990-01-16 1993-03-02 Digital Image Systems, Corporation System and method for extraction of data from documents for subsequent processing
US5319453A (en) * 1989-06-22 1994-06-07 Airtrax Method and apparatus for video signal encoding, decoding and monitoring
US5475838A (en) * 1988-09-14 1995-12-12 Digital Equipment Corporation Extensible entity management system including rule-based alarms
US5495607A (en) * 1993-11-15 1996-02-27 Conner Peripherals, Inc. Network management system having virtual catalog overview of files distributively stored across network domain
US5673252A (en) * 1990-02-15 1997-09-30 Itron, Inc. Communications protocol for remote data generating stations
US5819034A (en) * 1994-04-28 1998-10-06 Thomson Consumer Electronics, Inc. Apparatus for transmitting and receiving executable applications as for a multimedia system
US5892900A (en) * 1996-08-30 1999-04-06 Intertrust Technologies Corp. Systems and methods for secure transaction management and electronic rights protection
US5982994A (en) * 1993-11-16 1999-11-09 Fujitsu Limited Network printer apparatus and LAN network system
US6021437A (en) * 1996-07-17 2000-02-01 Bull S.A. Process and system for real-time monitoring of a data processing system for its administration and maintenance support in the operating phase

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5475838A (en) * 1988-09-14 1995-12-12 Digital Equipment Corporation Extensible entity management system including rule-based alarms
US5319453A (en) * 1989-06-22 1994-06-07 Airtrax Method and apparatus for video signal encoding, decoding and monitoring
US5191525A (en) * 1990-01-16 1993-03-02 Digital Image Systems, Corporation System and method for extraction of data from documents for subsequent processing
US5673252A (en) * 1990-02-15 1997-09-30 Itron, Inc. Communications protocol for remote data generating stations
US5495607A (en) * 1993-11-15 1996-02-27 Conner Peripherals, Inc. Network management system having virtual catalog overview of files distributively stored across network domain
US5982994A (en) * 1993-11-16 1999-11-09 Fujitsu Limited Network printer apparatus and LAN network system
US5819034A (en) * 1994-04-28 1998-10-06 Thomson Consumer Electronics, Inc. Apparatus for transmitting and receiving executable applications as for a multimedia system
US6021437A (en) * 1996-07-17 2000-02-01 Bull S.A. Process and system for real-time monitoring of a data processing system for its administration and maintenance support in the operating phase
US5892900A (en) * 1996-08-30 1999-04-06 Intertrust Technologies Corp. Systems and methods for secure transaction management and electronic rights protection

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ALMEROTH K.C., AMMAR M.H.: "Multicast group behavior in the internet's multicast backbone (MBone)", IEEE COMMUNICATIONS MAGAZINE,, vol. 35, no. 6, June 1997 (1997-06-01), pages 124 - 129, XP002932000 *
HATONEN K., KLEMETTINEN M., MANNILA H., RONKAINEN P., TOIVONEN H.: "Knowledge discovery from telecommunication network alarm databases", DATA ENGINEERING, 1996, PROCEEDINGS OF THE TWELFTH INTERNATIONAL CONFERENCE ON,, 1996, pages 115 - 122, XP002931999 *

Cited By (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6957255B1 (en) 1999-06-28 2005-10-18 Amdocs (Israel) Ltd. Method and apparatus for session reconstruction and accounting involving VoIP calls
US6963912B1 (en) 1999-06-28 2005-11-08 Xacct Technologies, Ltd. Method and apparatus for session reconstruction
US7756129B2 (en) 2000-03-27 2010-07-13 Azure Networks, Llc Personal area network with automatic attachment and detachment
US8149829B2 (en) 2000-03-27 2012-04-03 Tri-County Excelsior Foundation Personal area network with automatic attachment and detachment
US7218633B2 (en) 2000-03-27 2007-05-15 Bbn Technologies Corporation Personal area network with automatic attachment and detachment
US8068489B2 (en) 2000-03-27 2011-11-29 Tri-County Excelsior Foundation Personal area network with automatic attachment and detachment
US7669227B2 (en) 2000-11-08 2010-02-23 Computer Associates Think, Inc. Information management system
US7908224B2 (en) 2000-11-08 2011-03-15 Computer Associates Think, Inc. Information management system
US7685626B2 (en) 2000-11-08 2010-03-23 Computer Associates Think, Inc. Information management system
US9225553B2 (en) 2000-11-08 2015-12-29 Ca, Inc. Information management system
US9203650B2 (en) 2000-11-08 2015-12-01 Ca, Inc. Information management system
US7797240B2 (en) 2000-11-08 2010-09-14 Computer Associates Think, Inc. Information management system
US8219815B2 (en) 2000-11-08 2012-07-10 Ca, Inc. Information management system
US7836482B2 (en) 2000-11-08 2010-11-16 Computer Associates Think, Inc. Information management system
US7333956B2 (en) 2000-11-08 2008-02-19 Orchestria Limited Information management system
US7945519B2 (en) 2000-11-08 2011-05-17 Computer Associates Think, Inc. Information management system
WO2003009532A1 (fr) * 2001-07-19 2003-01-30 Intrusion, Inc. Systeme et procede de detection d'evenements reseau
US10588139B2 (en) 2001-11-30 2020-03-10 Iii Holdings 1, Llc Scheduling communications in a wireless network
US9674858B2 (en) 2001-11-30 2017-06-06 Iii Holdings 1, Llc Receiver scheduling in wireless networks
US10863528B2 (en) 2001-11-30 2020-12-08 Iii Holdings 1, Llc Scheduling communications in a wireless network
US11445523B2 (en) 2002-12-23 2022-09-13 Iii Holdings 1, Llc Scheduling communications in a wireless network
US7904080B2 (en) 2004-01-27 2011-03-08 Actix Limited Mobile communications network monitoring systems
WO2005071890A1 (fr) * 2004-01-27 2005-08-04 Actix Limited Systeme de controle pour un reseau de communications mobiles pour l'analyse du trafic par approche hierarchique
US7830812B2 (en) 2004-01-27 2010-11-09 Actix Limited Monitoring system for a mobile communication network for traffic analysis using a hierarchial approach
US9049212B2 (en) 2004-09-30 2015-06-02 International Business Machines Corporation Method, system, and computer program product for prefetching sync data and for edge caching sync data on a cellular device
US8706843B2 (en) 2008-09-10 2014-04-22 Axis Ab Network connector device
JP2010114882A (ja) * 2008-09-10 2010-05-20 Axis Ab ネットワークコネクタデバイス
EP2164232A1 (fr) 2008-09-10 2010-03-17 Axis AB Dispositif connecteur de réseau
CN109117142A (zh) * 2018-07-19 2019-01-01 北京理工大学 一种基于变量关联树的基本类型重构方法
CN109117142B (zh) * 2018-07-19 2020-11-24 北京理工大学 一种基于变量关联树的基本类型重构方法

Also Published As

Publication number Publication date
AU6888300A (en) 2000-11-21

Similar Documents

Publication Publication Date Title
US7016951B1 (en) System and method for network security
CN107733851B (zh) 基于通信行为分析的dns隧道木马检测方法
US7694115B1 (en) Network-based alert management system
US6968377B1 (en) Method and system for mapping a network for system security
US8224989B2 (en) Effective policies and policy enforcement using characterization of flow content and content-independent flow information
US20030084318A1 (en) System and method of graphically correlating data for an intrusion protection system
US8326881B2 (en) Detection of network security breaches based on analysis of network record logs
TW476204B (en) Information security analysis system
US8065722B2 (en) Semantically-aware network intrusion signature generator
US5787253A (en) Apparatus and method of analyzing internet activity
KR100424724B1 (ko) 네트워크 흐름 분석에 의한 침입 탐지 장치
US20110289583A1 (en) Correlation engine for detecting network attacks and detection method
US20030083847A1 (en) User interface for presenting data for an intrusion protection system
US20070214504A1 (en) Method And System For Network Intrusion Detection, Related Network And Computer Program Product
US20030140140A1 (en) Monitoring the flow of a data stream
KR20000057209A (ko) 자동화된 광역 네트워크 감시 및 보안 침해 개입 방법 및 장치
US20030084340A1 (en) System and method of graphically displaying data for an intrusion protection system
US8065729B2 (en) Method and apparatus for generating network attack signature
WO2000068811A1 (fr) Procede et systeme pour saisir des donnees de reseau et identifier les actions du reseau a partir de ces donnees
KR100832088B1 (ko) 시그니처 그래프를 이용한 하이브리드 기반 침입탐지시스템
US7587759B1 (en) Intrusion prevention for active networked applications
Nie et al. Intrusion detection using a graphical fingerprint model
WO2006008307A1 (fr) Procede, systeme et programme informatique pour detecter un balayage non autorise sur un reseau
Walsh et al. Effective flow filtering for botnet search space reduction
AU2002311381B2 (en) Information security analysis system

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BG BR BY CA CH CN CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

122 Ep: pct application non-entry in european phase
NENP Non-entry into the national phase

Ref country code: JP