Acer Cyber Security Incorporated

Acer Inc.

Other

Institute for Information Industry

Chiung-Ying Huang

Ming-Kung Sun

Zong-Cyuan Jhang

Yi-Chung Tseng

Tsung-Hsien Tsai

Chien-Hung Li

Chun-Hsien Li

Yin-Hsong Hsu

Pin-Cyuan Lin

Sung-Ming Yen

Tung-Lin Tsai

Yu-Chun Wu

Jun-Mein Wu

Chien-Chung Yuan

Tsung-Yu Ho

Jack Lee

Jong-Ming Lee

Gu-Hsin Lai

Chia-Mei Chen

Tzu-Ching Chang

Huei-Tang Li

Wei-An Chen

An information leakage detection method and a device using the same are disclosed. The method includes the following steps. Network connection data of an electronic device is obtained. Log data related to a (domain name system) DNS is extracted from the network connection data. A DNS request in the log data is analyzed to obtain multiple character distribution feature values according to an analysis result. The character distribution feature values reflect a character distribution status of a domain name in the DNS request under different classification rules. A machine learning model determines whether the DNS request is a malicious DNS request according to the character distribution feature values, and the malicious DNS request is used to carry leaked data to a remote host.

Information leakage detection method and device using the same

A detection method for a malicious domain name in a domain name system (DNS) and a detection device are provided. The method includes: obtaining network connection data of an electronic device; capturing log data related to at least one domain name from the network connection data; analyzing the log data to generate at least one numerical feature related to the at least one domain name; inputting the at least one numerical feature into a multi-type prediction model, which includes a first data model and a second data model; and predicting whether a malicious domain name related to a malware or a phishing website exists in the at least one domain name by the multi-type prediction model according to the at least one numerical feature.

Detection method for malicious domain name in domain name system and detection device

An abnormal traffic detection method is provided according to an embodiment of the disclosure. The method includes: obtaining network traffic data of a target device; sampling the network traffic data by a sampling window with a time length to obtain sampling data; generating, according to the sampling data, an image which presents a traffic feature of the network traffic data corresponding to the time length; and analyzing the image to generate evaluation information corresponding to an abnormal traffic. In addition, an abnormal traffic detection device is also provided according to an embodiment of the disclosure to improve a detection ability and/or an analysis ability for the abnormal traffic and/or a malware.

Abnormal traffic detection method and abnormal traffic detection device

A system of training behavior labeling model is provided. Specifically, a processing unit inputs each data of a training data set into a plurality of learning modules to establish a plurality of labeling models. The processing unit obtains a plurality of second labeling information corresponding to each data of a verification data set and generates a behavior labeling result according to the second labeling information corresponding to each data of the verification data set. The processing unit obtains a labeling change value according to the behavior labeling result and first labeling information corresponding to each data of the verification data set. The processing unit, if determining that the labeling change value is greater than a change threshold, updates the first labeling information according to the behavior labeling results, exchanges the training data set and the verification data set and reestablishes the labeling models.

System and method of training behavior labeling model

A method for detecting abnormality adapted to detect abnormal operations of an operating system is provided. The method includes: calculating a safe range of usage of the operating system during one or more time periods according to a historical data stream; calculating abnormal ratios corresponding to the one or more time periods according to a current data stream and the safe range of usage; selecting one or more abnormal time periods from the one or more time periods according to a threshold and the abnormal ratios; calculating an abnormal indicator for each of the one or more abnormal time periods according to the historical data stream and the current data stream; and ranking the one or more abnormal time periods according to the abnormal indicator(s).

Method and device for detecting abnormal operation of operating system

The disclosure provides a method for evaluating domain name and a server using the same method. The method includes: retrieving a raw domain name and dividing the raw domain name into a plurality of parts; retrieving a specific part of the parts, wherein the specific part include characters; encoding the characters into encoded data; padding the encoded data to a specific length; projecting the encoded data being padded as embedded vectors; sequentially inputting the embedded vectors to a plurality cells of a long short term memory model to generate a result vector; and converting the result vector to a prediction probability via a fully-connected layer and a specific function.

Method for evaluating domain name and server using the same

The disclosure provides a domain name recognition method and a domain name recognition device. The domain name recognition method includes the following steps. A first string of a first domain name and a second string of a second domain name are obtained. Multiple characters of the first string and the second string are classified into multiple clusters. Multiple vectors corresponding to the clusters are generated, wherein each of the characters corresponds to one of the vectors. A first vector set corresponding to the first string and a second vector set corresponding to the second string are generated. A similarity of the first vector set and the second vector set is calculated.

Domain name recognition method and domain name recognition device

An electronic device and a method for detecting a malicious file are provided. The method includes the following steps: An executable file is searched, and an import table is extracted from the executable file. The import table includes at least a name of a first DDL and a name of a second DDL. A distance between the first DLL and the second DLL is calculated. Whether the distance exceeds a threshold is determined. If the distance exceeds the threshold, then whether a duplicate content of the import table exists in the executable file is checked. The executable file is regarded as a malicious file if the duplicate content of the import table exists in the executable file.

Electronic device and method for detecting malicious file

A botnet detection system and method are provided. The method includes the steps of: retrieving a network log file of a computer device; refining the network log file according to a device alive-time record of the computer device and a network white list to obtain a plurality of individual network log files, wherein each individual network log file records time information, a source IP address of the computer device, and an individual destination IP address; and analyzing a plurality of connection intervals of the source IP address connecting to the individual destination IP address in each individual network log file to determine whether the computer device exhibits connection behavior that indicates infection by a botnet malware.

Botnet detection system and method

A system for preventing malicious communication includes a safe module set with a specific Internet Protocol address and a Time to Live threshold value of the specific IP address to determine whether a malicious communication exists. If the malicious communication exists, the safe module can re-direct the malicious communication to a recording module of the system for recording the content of the malicious communication.

Method and system for preventing malicious communication

Disclosed is an electronic payment device and its method using an balanced binary tree for calculating a first data X of current consumption or a plurality of root values R from an initial value X of the amount of money that user purchases. The first data X is correspondent to a position value j with a respective relation of j&equals;n&minus;k&plus;1. The first data X is generated according to the value of the binary code d d . . . d d of the position value j being a 0 or 1, by formula X &equals;h (. . . (h (h (X )))). If the binary code d &equals;0, i&equals;m&minus;1, m&minus;2, . . . , 1, 0, then the first one-way function h is used as an operating function. Otherwise, the second one-way function h is operated when the binary code d &equals;1. Moreover, a function operating device for an electronic payment using an balanced binary tree is also disclosed. The present invention requires less calculation than that in the prior art, and thus is more effective.

Electronic payment device using balanced binary tree and the method of the same

An electronic payment device and its method using an unbalanced binary tree are disclosed. The total unit n of the amount of money that user purchases is decomposed first into a Matrix of p rows&times;q columns. Then, a first one-way function h and a second one-way function h serve to define the one-way function operation of the first row and each column, respectively. When two numbers of operation times a and b are calculated by their formulas respectively, they are substituted into formula X &equals;h (h (X )). Namely, by the first one-way function h , a times of operation is performed, and then by the second one-way function h , b times of operation is performed, thus, a first data X of current consumption can be derived rapidly. The present invention has only a few times of operation, thus the calculating efficiency is improved greatly.

Growing community of inventors

Taipei, Taiwan

Chiung-Ying Huang