Method and system for protection against network-based cyber threats
AssigneeSlashnext, Inc.
InventorAtif Mushtaq
Life of this patent
Estimating the term…
Abstract
An Active Cyber Defense method and system is provided for detecting and stopping malicious cyber activity including for example Drive-By Exploits, Malicious Binaries, Data Exfiltration, Social Engineering and Credential Stealing Attacks. The system disclosed herein can be configured to detect and block multi protocol network-based cyber attacks targeting different platforms or operating systems. The system can also be configured to be scalable. The system as disclosed herein can conduct real time inspection of network traffic and can self-learn and adapt as needed to a changing cyber threat landscape.
Claims17
A cyber defense system for detecting and blocking malicious cyber activity of a network, the cyber defense system comprising:
- at least one processor, a memory, and a computer program including instructions executable by the processor to create an application, wherein the application comprises:
- (a) a first module configured to monitor and capture network session activity between one or more client devices and one or more internet servers and to extract a network flow from the network session activity;
- (b) a second module configured to evaluate the network flow to identify a type of protocol associated with the network flow;
- and
- (c) a third module configured to:
- i. extract and evaluate a first set of features from the network flow,
- ii. classify the network flow as a potentially malicious flow or as a benign flow by processing the first set of features using a first set of classifiers, and
- iii. evaluate only the potentially malicious flow and to determine whether the potentially malicious flow is malicious or benign by:
- collecting active features in real-time and processing the active features using a second set of classifiers different from the first set of classifiers.
Dependencies are inferred from the claim text.