Systems and methods for targeted attack detection. A protection system intercepts traffic destined for a protected system and only traffic identified as non-malicious is allowed to pass thereto. Data collection agents (DCAs) instantiated at protected systems report information concerning protected system resources to the protection system, which creates from that information a set of threat attack detection metrics (TADMs) by which it evaluates payloads of the intercepted traffic. In particular, the intercepted traffic is assessed using conventional threat detection approaches to identify suspect payloads. The suspect payloads are additionally evaluated against the TADMs to determine if they contain any references to specific resources of the protected system. For those of the suspect payloads for which the TADM evaluation reveals positive results, the protection system provides an alert that a targeted attack has been recognized.


    Zugriff

    Download


    Exportieren, teilen und zitieren



    Titel :

    Targeted attack detection system


    Beteiligte:
    NOVIKOV IVAN (Autor:in) / GOLOVKO ALEXANDER (Autor:in)

    Erscheinungsdatum :

    22.02.2022


    Medientyp :

    Patent


    Format :

    Elektronische Ressource


    Sprache :

    Englisch



    ATTACK DETECTION SYSTEM AND ATTACK DETECTION METHOD

    TOYAMA TAKESHI / OGUMA HISASHI / MATSUMOTO TSUTOMU et al. | Europäisches Patentamt | 2017

    Freier Zugriff

    ATTACK DETECTION DEVICE

    SAEKI MINORU / SUGAWARA TAKESHI | Europäisches Patentamt | 2016

    Freier Zugriff

    ATTACK DETECTION APPARATUS

    SAEKI MINORU / SUGAWARA TAKESHI | Europäisches Patentamt | 2018

    Freier Zugriff

    RELAY ATTACK DETECTOR AND RELAY ATTACK DETECTION METHOD

    IINAMI HISATARO | Europäisches Patentamt | 2019

    Freier Zugriff