Loading patent…
AssigneeJapan Aerospace Exploration Agency
InventorsNaoyuki Fujita, Tsuyoshi Ishii
Estimating the term…
It is an object of the present invention to provide a device for generating analysis object data that allows the simple setting of an intrusion detection policy, and more specifically, to allow policy setting that performs pattern matching with a plurality of signatures summarized as a single intrusion detection policy, and to allow policy setting that performs pattern matching of the context of an attack and response to this attack. The communications state transition monitoring method of the present invention is a method in which packets transmitted on a network are taken in, state transitions are estimated by tracing the communications contents of a hierarchical protocol, and the communications state in an arbitrary information communications station is monitored, wherein a function for acquiring analysis data from a plurality of streams and a stream pairing function are provided in order to realize the simple association setting of a plurality of signatures and the context setting using the pairing of attacks and responses.
A method for monitoring communications state transitions in a network which is constructed so that communications are performed according to a hierarchical protocol among information communications stations, comprising the steps of:
A communications state transition monitoring method in a system for estimating communications state transitions in which a functional unit AA that analyzes the hierarchical content of communications and a communications processing functional unit CAPS corresponding to analysis results are completely separated, the communications state transition monitoring method comprising a step of sending requests for necessary data regarding the strata and number of the objects of analysis to said CAPS from said AA, to simultaneously monitor a plurality of communications paths from a single viewpoint.
A device for monitoring communications state transitions in a network which is constructed so that communications are performed according to a hierarchical protocol among information communications stations, said device comprising means for taking in packets that are transmitted on said network, and means for estimating transition states by tracking the communications content of the hierarchical protocol, wherein the communications state in an arbitrary information communications station is monitored.
A communications state transition monitoring device constituting a system for estimating communications state transitions in which a functional unit AA that analyzes the hierarchical content of communications and a communications processing functional unit CAPS corresponding to analysis results are completely separated, the communications state transition monitoring device comprising means for sending requests for necessary data regarding the strata and number of the objects of analysis to said CAPS from said AA, wherein a plurality of communications paths are simultaneously monitored from a single viewpoint.
The communications state transition monitoring device according to clam 8, comprising means for writing initial and final connection information of the respective data portions in the packet information into packet structures, and means for adding said packet structures to the respective packets with header parts attached, whereby said device has a function of simultaneously evaluating both the reconstructed data and the packet headers.
A computer-readable recording medium on which a program is recorded, which is used in a system that monitors communications state transitions in a network which is constructed so that communications are performed in accordance with a hierarchical protocol among information communications stations, wherein packets that are transmitted on said network are taken in, state transitions are estimated by tracking the communications content of the hierarchical protocol, and the communications state transition in an arbitrary information communications station is monitored.
A computer-readable recording medium on which a program is recorded, which is used in a system for monitoring state transitions of communications in a format in which a functional unit AA that analyzes the hierarchical content of communications and a communications processing functional unit CAPS corresponding to analysis results are completely separated, wherein requests for necessary data regarding the strata and number of the objects of analysis are sent to said CAPS from said AA, and a plurality of communications paths are simultaneously monitored from a single viewpoint.
Dependencies are inferred from the claim text.