Institute for Information Industry

Hsiao-Hsien Chang

Te-En Wei

Chieh Lee

Meng-Hsuan Chung

Kun-Wei Lee

Chi-Kuan Chiu

Chin-Wei Chen

An attack path detection method, attack path detection system and non-transitory computer-readable medium are provided in this disclosure. The attack path detection method includes the following operations: establishing a connecting relationship among a plurality of hosts according to a host log set to generate a host association graph; labeling at least one host with an abnormal condition on the host association graph; calculating a risk value corresponding to each of the plurality of hosts; in a host without the abnormal condition, determining whether the risk value corresponding to the host without the abnormal condition is greater than a first threshold, and utilizing a host with the risk value greater than the first threshold as a high-risk host; and searching at least one host attach path from the high-risk host and the at least one host with the abnormal condition according to the connecting relationship of the host association graph.

Attack path detection method, attack path detection system and non-transitory computer-readable medium

A suspicious packet detection device and a suspicious packet detection method thereof are provided. The suspicious packet detection device captures an HTTP packet transmitted from an internal network to an external network, and based on an HTTP header of the HTTP packet, determines that the HTTP packet belongs to one of a browser category and an application category and identifies the HTTP packet as one of a normal packet and a suspicious packet. When the HTTP packet is identified as the normal packet, the suspicious packet detection device further verifies whether the HTTP packet is the suspicious packet or not by comparing the HTTP header with relevance information or by using a URL classification model.

Suspicious packet detection device and suspicious packet detection method thereof

An abnormal flow detection device and an abnormal flow detection method thereof are provided. The abnormal flow detection device analyses a plurality of packets captured during a time interval to obtain a plurality of flow features of each packet and selects at least one key flow feature from the flow features based on a dimensionality reduction algorithm. The abnormal flow detection device trains a bidirectional generative adversarial network (BiGAN) by taking the at least one key flow feature of each packet as an input of the BiGAN to build a flow recognition model for detecting abnormal flows.

Growing community of inventors

Taipei, Taiwan

Hsiao-Hsien Chang