Source: http://www.google.com/patents/US7805762?dq=6322901
Timestamp: 2014-09-21 18:31:55
Document Index: 117272793

Matched Legal Cases: ['application No. 2008229835', 'application No. 2', 'application No. 03807319', 'Application No. 03807319', 'Application No. 03807319', 'art 1', 'art 2']

Patent US7805762 - Method and system for reducing the false alarm rate of network intrusion ... - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign in<nobr>Advanced Patent Search</nobr>PatentsAccording to one embodiment of the invention, a computerized method for reducing the false alarm rate of network intrusion detection systems includes receiving, from a network intrusion detection sensor, one or more data packets associated with an alarm indicative of a potential attack on a target host...http://www.google.com/patents/US7805762?utm_source=gb-gplus-sharePatent US7805762 - Method and system for reducing the false alarm rate of network intrusion detection systemsAdvanced Patent SearchPublication numberUS7805762 B2Publication typeGrantApplication numberUS 10/685,726Publication dateSep 28, 2010Filing dateOct 15, 2003Priority dateOct 15, 2003Fee statusPaidAlso published asCA2541926A1, CN1864182A, CN100451984C, EP1673749A2, US20050086522, WO2005041141A2, WO2005041141A3Publication number10685726, 685726, US 7805762 B2, US 7805762B2, US-B2-7805762, US7805762 B2, US7805762B2InventorsCraig H. RowlandOriginal AssigneeCisco Technology, Inc.Export CitationBiBTeX, EndNote, RefManPatent Citations (48), Non-Patent Citations (29), Referenced by (5), Classifications (15), Legal Events (2) External Links: USPTO, USPTO Assignment, EspacenetMethod and system for reducing the false alarm rate of network intrusion detection systemsUS 7805762 B2Abstract According to one embodiment of the invention, a computerized method for reducing the false alarm rate of network intrusion detection systems includes receiving, from a network intrusion detection sensor, one or more data packets associated with an alarm indicative of a potential attack on a target host and identifying characteristics of the alarm from the data packets. The characteristics include at least an attack type and an operating system fingerprint of the target host. The method further includes identifying the operating system type from the operating system fingerprint, comparing the attack type to the operating system type, and indicating whether the target host is vulnerable to the attack based on the comparison.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS5727152May 7, 1996Mar 10, 1998Koninklijke Ptt Nederland N.V.Interface arrangement, and telecommunication system, and methodUS5919257Aug 8, 1997Jul 6, 1999Novell, Inc.Networked workstation intrusion detection systemUS5961644Sep 19, 1997Oct 5, 1999International Business Machines CorporationMethod and apparatus for testing the integrity of computer security alarm systemsUS5991881Nov 8, 1996Nov 23, 1999Harris CorporationNetwork surveillance systemUS6070244Nov 10, 1997May 30, 2000The Chase Manhattan BankComputer network security management systemUS6134664Jul 6, 1998Oct 17, 2000Prc Inc.Method and system for reducing the volume of audit data and normalizing the audit data received from heterogeneous sourcesUS6148407Sep 30, 1997Nov 14, 2000Intel CorporationMethod and apparatus for producing computer platform fingerprintsUS6182223Jun 10, 1998Jan 30, 2001International Business Machines CorporationMethod and apparatus for preventing unauthorized access to computer-stored informationUS6275942May 20, 1998Aug 14, 2001Network Associates, Inc.System, method and computer program product for automatic response to computer system misuse using active response modulesUS6279113Jun 4, 1998Aug 21, 2001Internet Tools, Inc.Dynamic signature inspection-based network intrusion detectionUS6282546Jun 30, 1998Aug 28, 2001Cisco Technology, Inc.System and method for real-time insertion of data into a multi-dimensional database for network intrusion detection and vulnerability assessmentUS6301668Dec 29, 1998Oct 9, 2001Cisco Technology, Inc.Method and system for adaptive network security using network vulnerability assessmentUS6405318Mar 12, 1999Jun 11, 2002Psionic Software, Inc.Intrusion detection systemUS6408391May 6, 1998Jun 18, 2002Prc Inc.Dynamic system defense for information warfareUS6415321Dec 29, 1998Jul 2, 2002Cisco Technology, Inc.Domain mapping method and systemUS6460141Oct 28, 1998Oct 1, 2002Rsa Security Inc.Security and access management system for web-enabled and non-web-enabled applications and content on a computer networkUS6477651Jan 8, 1999Nov 5, 2002Cisco Technology, Inc.Intrusion detection system and method having dynamically loaded signaturesUS6513122Jun 29, 2001Jan 28, 2003Networks Associates Technology, Inc.Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilitiesUS6647400Aug 30, 2000Nov 11, 2003Symantec CorporationSystem and method for analyzing filesystems to detect intrusionsUS6714513Dec 21, 2001Mar 30, 2004Networks Associates Technology, Inc.Enterprise network analyzer agent system and methodUS6725377Mar 12, 1999Apr 20, 2004Networks Associates Technology, Inc.Method and system for updating anti-intrusion softwareUS6785821Nov 4, 2002Aug 31, 2004Cisco Technology, Inc.Intrusion detection system and method having dynamically loaded signaturesUS6839850Mar 4, 1999Jan 4, 2005Prc, Inc.Method and system for detecting intrusion into and misuse of a data processing systemUS6941467Mar 8, 2002Sep 6, 2005Ciphertrust, Inc.Systems and methods for adaptive message interrogation through multiple queuesUS6950845Oct 23, 2001Sep 27, 2005Amdocs (Israel) Ltd.Data collection system and method for reducing latencyUS6957348Jan 10, 2001Oct 18, 2005Ncircle Network Security, Inc.Interoperability of vulnerability and intrusion detection systemsUS6990591Dec 22, 1999Jan 24, 2006Secureworks, Inc.Method and system for remotely configuring and monitoring a communication deviceUS7058968Jan 10, 2002Jun 6, 2006Cisco Technology, Inc.Computer security and management systemUS7073198 *Aug 25, 2000Jul 4, 2006Ncircle Network Security, Inc.Method and system for detecting a vulnerability in a networkUS7152105 *Jan 15, 2002Dec 19, 2006Mcafee, Inc.System and method for network vulnerability detection and reportingUS7162649Jun 30, 2000Jan 9, 2007Internet Security Systems, Inc.Method and apparatus for network assessment and authenticationUS7197762Oct 31, 2001Mar 27, 2007Hewlett-Packard Development Company, L.P.Method, computer readable medium, and node for a three-layered intrusion prevention system for detecting network exploitsUS7200866Aug 14, 2003Apr 3, 2007Electronics And Telecommunications Research InstituteSystem and method for defending against distributed denial-of-service attack on active networkUS7237264Jun 4, 2001Jun 26, 2007Internet Security Systems, Inc.System and method for preventing network misuseUS7444679Oct 31, 2001Oct 28, 2008Hewlett-Packard Development Company, L.P.Network, method and computer readable medium for distributing security updates to select nodes on a networkUS20020052876Oct 29, 1998May 2, 2002Glenn WatersServer managerUS20020087882Jan 19, 2001Jul 4, 2002Bruce SchneierMehtod and system for dynamic network intrusion monitoring detection and responseUS20030056116May 16, 2002Mar 20, 2003Bunker Nelson WaldoReporterEP0985995A1Sep 9, 1998Mar 15, 2000International Business Machines CorporationMethod and apparatus for intrusion detection in computers and computer networksWO1999057625A1Apr 29, 1999Nov 11, 1999Julie Lynn HuffDynamic system defence for information warfareWO2000054458A1Mar 10, 2000Sep 14, 2000Psionic Software IncIntrusion detection systemWO2000070464A1May 9, 2000Nov 23, 2000L 3 Comm CorpObject oriented security analysis toolWO2001084270A2Apr 25, 2001Nov 8, 2001Internet Security Systems IncMethod and system for intrusion detection in a computer networkWO2002019077A2Aug 31, 2001Mar 7, 2002Sri International IncProbabilistic alert correlationWO2003084181A1Mar 28, 2003Oct 9, 2003Cisco Tech IndMethod and system for reducing the false alarm rate of network intrusion detection systemsWO2005109824A1Apr 5, 2005Nov 17, 2005Cisco Tech IndSource/destination operating system type-based ids virtualizationWO2006082380A1Jan 30, 2006Aug 10, 2006Uni I OsloIntrusion detection for computer programsWO2007122495A2Apr 23, 2007Nov 1, 2007Axalto SaA framework for protecting resource-constrained network devices from denial-of-service attacks* Cited by examinerNon-Patent CitationsReference1"Building a True Anomaly Detector for Intrusion Detection", Susan C. Lee and David V. Heinbuch; The Johns Hopkins University Applied Physics Laboratory, Laurel, MD 20723, 2000.2"Enhancing Operating System Resistance to Information Warfare", Dennis Hollingworth and Timothy Redmond; NAI Labs at Network Associates, Los Angeles, California, 2000.3"Intrusion Detection in Sensor Networks: A Non-cooperative Game Approach", Agah et al.; Department of Computer Science and Engineering; University of Texas at Arlington, Arlington, TX 76019-0015, 2004.4"Keep Attackers at Bay", Andrew Conry-Murry; Information Week; 1046; ABI/INFORM Global; p. 45, Jul. 4, 2005.5"Know your Enemy: Passive Fingerprinting-Identifying remote hosts, without them knowing", Honeynet Project, http://project.honeynet.org (4 pages), Mar. 4, 2002.6"Know your Enemy: Passive Fingerprinting�Identifying remote hosts, without them knowing", Honeynet Project, http://project.honeynet.org (4 pages), Mar. 4, 2002.7 *Agah et al, Intrusion Detection in Sensor Networks: A Non-cooperative Game Approach, 2004, IEEE, pp. 1-4.8Australian Government Examiner's First Report on patent application No. 2008229835, Apr. 2, 2009.9Canadian Examiner's Requisition on patent application No. 2,484,461, Oct. 15, 2009.10Chinese Examiner's Office Action on patent application No. 03807319.6, Nov. 20, 2009.11 *Conry-Murray, Andrew, Keep Attackers at Bay, 2005, Information Week, pp. 45-47.12Dennis Hollingworth, et al., "Enhancing Operating System Resistance to Information Warfare," IEEE, pp. 1037-1041, 2000.13Ellen Messmer, "Network Intruders," Network World, p. 67-68, Oct. 4, 1999.14Guy G. Helmer, et al.; "Intelligent Agents for Intrusion Detection;" IEEE; pp. 121-124, 1998.15 *Hollingworth et al., Enhancing Operating System Resistance of Information Warfare, 2000, IEEE, pp. 1037-1041.16 *Lee et al, Building a Tree Anomaly Detector for Intrusion Detection, 2000, IEEE, pp. 1171-1175.17Office Action from the Canadian Intellectual Property Office; U.S. Appl. No. 2,484,461, Jan. 7, 2009.18Office Action from the State Intellectual Property Office of the People's Republic of China; Application No. 03807319.6, Dec. 30, 2008.19Office Action issued by the Canadian Intellectual Property Office; U.S. Appl. No. 2,479,504; Title: Method and System for Reducing the False Alarm Rate of Network Intrusion Detection Systems, Nov. 24, 2008.20PCT Notification of Transmittal of The International Search Report and the Written Opinion of the International Searching authority, or the Declaration; Int'l Application No. PCT/US04/32976; Int'l filing date: Oct. 6, 2004; Applicant: Cisco Technology, Inc.; 12 pages, Nov. 21, 2005.21PCT Notification of Transmittal of the International Search Report or the Declaration, mailed Jul. 21, 2003, including International Search Report re PCT/US 03/09665 (6 pgs).22PCT Notification of Transmittal of the International Search Report or the Declaration, mailed Sep. 16, 2003, including International Search Report re PCT/US 03/15546 (7 pgs).23Rowland, et al., U.S. Appl. No. 60/319,159 filed Mar. 29, 2002, Method and System for Reducing the False Alarm Rate of Network Intrusion Detection Systems, Mar. 29, 2002.24Rowland, et al., U.S. Appl. No. 60/319,242 filed May 14, 2002, A System and Method for Actively Reducing the False Alarm Rate of Network Intrusion Detection Systems, May 14, 2002.25Second Office Action issued by the Patent Office of the People's Republic of China; Applicant: Cisco Technology, Inc.; Application No. 03807319.6, Jul. 10, 2009.26Toby Miller,"Passive OS Fingerprinting: Details and Techniques", The SANS Institute, http://www.incidents.org/papers/OSfingerprinting.php (19 pages), 2001-2002 (part 1) 2003 (part 2).27U.S. Appl. No. 10/402,649, filed Mar. 28, 2003 by inventor Craig H. Rowland, "Method and System for Reducing the False Alarm Rate of Network Intrusion Detection Systems".28U.S. Appl. No. 10/402,649, filed Mar. 28, 2003, entitled Method and System for Reducing The False Alarm Rate of Network Intrusion Detection System, by inventors Craig Rowland and Aaron Rhodes.29U.S. Appl. No. 10/439,030, filed May 14, 2003, entitled Method and System for Analyzing and Addressing Alarms From Network Intrusion Detection Systems, by inventors Rowland, et al.* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS7895659 *Apr 18, 2008Feb 22, 2011The United States Of America As Represented By The Director, National Security AgencyMethod of assessing security of an information access systemUS8272055Oct 8, 2009Sep 18, 2012Sourcefire, Inc.Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention systemUS8289882Jan 15, 2010Oct 16, 2012Sourcefire, Inc.Systems and methods for modifying network map attributesUS8671182 *Jun 22, 2010Mar 11, 2014Sourcefire, Inc.System and method for resolving operating system or service identity conflictsUS20110314143 *Jun 22, 2010Dec 22, 2011Sourcefire, Inc.System and method for resolving operating system or service identity conflicts* Cited by examinerClassifications U.S. Classification726/25, 713/153International ClassificationH04L29/12, H04L29/06, G08B, H04L9/00, G06F11/30, G06F15/16, G08B23/00Cooperative ClassificationH04L63/1408, H04L29/12226, H04L63/1433, H04L61/2015European ClassificationH04L63/14A, H04L63/14CLegal EventsDateCodeEventDescriptionMar 28, 2014FPAYFee paymentYear of fee payment: 4Oct 15, 2003ASAssignmentOwner name: CISCO TECHNOLOGY, INC., CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ROWLAND, CRAIG H.;REEL/FRAME:014628/0166Effective date: 20031009RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google