Systems and methods for targeted attack detection. A protection system intercepts traffic destined for a protected system and only traffic identified as non-malicious is allowed to pass thereto. Data collection agents (DCAs) instantiated at protected systems report information concerning protected system resources to the protection system, which creates from that information a set of threat attack detection metrics (TADMs) by which it evaluates payloads of the intercepted traffic. In particular, the intercepted traffic is assessed using conventional threat detection approaches to identify suspect payloads. The suspect payloads are additionally evaluated against the TADMs to determine if they contain any references to specific resources of the protected system. For those of the suspect payloads for which the TADM evaluation reveals positive results, the protection system provides an alert that a targeted attack has been recognized.


    Access

    Download


    Export, share and cite



    Title :

    Targeted attack detection system


    Contributors:

    Publication date :

    2022-02-22


    Type of media :

    Patent


    Type of material :

    Electronic Resource


    Language :

    English



    ATTACK DETECTION SYSTEM AND ATTACK DETECTION METHOD

    TOYAMA TAKESHI / OGUMA HISASHI / MATSUMOTO TSUTOMU et al. | European Patent Office | 2017

    Free access

    ATTACK DETECTION DEVICE

    SAEKI MINORU / SUGAWARA TAKESHI | European Patent Office | 2016

    Free access

    ATTACK DETECTION APPARATUS

    SAEKI MINORU / SUGAWARA TAKESHI | European Patent Office | 2018

    Free access

    RELAY ATTACK DETECTOR AND RELAY ATTACK DETECTION METHOD

    IINAMI HISATARO | European Patent Office | 2019

    Free access