Acer Cyber Security Incorporated

Acer Inc.

Ming-Kung Sun

Chiung-Ying Huang

Zong-Cyuan Jhang

Yi-Chung Tseng

Tsung-Hsien Tsai

Chien-Hung Li

Chun-Hsien Li

Yin-Hsong Hsu

Pin-Cyuan Lin

Tung-Lin Tsai

Yu-Chun Wu

Jun-Mein Wu

Tsung-Yu Ho

Gu-Hsin Lai

Chia-Mei Chen

Tzu-Ching Chang

A detection method for a malicious domain name in a domain name system (DNS) and a detection device are provided. The method includes: obtaining network connection data of an electronic device; capturing log data related to at least one domain name from the network connection data; analyzing the log data to generate at least one numerical feature related to the at least one domain name; inputting the at least one numerical feature into a multi-type prediction model, which includes a first data model and a second data model; and predicting whether a malicious domain name related to a malware or a phishing website exists in the at least one domain name by the multi-type prediction model according to the at least one numerical feature.

Detection method for malicious domain name in domain name system and detection device

An abnormal traffic detection method is provided according to an embodiment of the disclosure. The method includes: obtaining network traffic data of a target device; sampling the network traffic data by a sampling window with a time length to obtain sampling data; generating, according to the sampling data, an image which presents a traffic feature of the network traffic data corresponding to the time length; and analyzing the image to generate evaluation information corresponding to an abnormal traffic. In addition, an abnormal traffic detection device is also provided according to an embodiment of the disclosure to improve a detection ability and/or an analysis ability for the abnormal traffic and/or a malware.

Abnormal traffic detection method and abnormal traffic detection device

A system of training behavior labeling model is provided. Specifically, a processing unit inputs each data of a training data set into a plurality of learning modules to establish a plurality of labeling models. The processing unit obtains a plurality of second labeling information corresponding to each data of a verification data set and generates a behavior labeling result according to the second labeling information corresponding to each data of the verification data set. The processing unit obtains a labeling change value according to the behavior labeling result and first labeling information corresponding to each data of the verification data set. The processing unit, if determining that the labeling change value is greater than a change threshold, updates the first labeling information according to the behavior labeling results, exchanges the training data set and the verification data set and reestablishes the labeling models.

System and method of training behavior labeling model

A method for detecting abnormality adapted to detect abnormal operations of an operating system is provided. The method includes: calculating a safe range of usage of the operating system during one or more time periods according to a historical data stream; calculating abnormal ratios corresponding to the one or more time periods according to a current data stream and the safe range of usage; selecting one or more abnormal time periods from the one or more time periods according to a threshold and the abnormal ratios; calculating an abnormal indicator for each of the one or more abnormal time periods according to the historical data stream and the current data stream; and ranking the one or more abnormal time periods according to the abnormal indicator(s).

Method and device for detecting abnormal operation of operating system

The disclosure provides a method for evaluating domain name and a server using the same method. The method includes: retrieving a raw domain name and dividing the raw domain name into a plurality of parts; retrieving a specific part of the parts, wherein the specific part include characters; encoding the characters into encoded data; padding the encoded data to a specific length; projecting the encoded data being padded as embedded vectors; sequentially inputting the embedded vectors to a plurality cells of a long short term memory model to generate a result vector; and converting the result vector to a prediction probability via a fully-connected layer and a specific function.

Method for evaluating domain name and server using the same

The disclosure provides a domain name recognition method and a domain name recognition device. The domain name recognition method includes the following steps. A first string of a first domain name and a second string of a second domain name are obtained. Multiple characters of the first string and the second string are classified into multiple clusters. Multiple vectors corresponding to the clusters are generated, wherein each of the characters corresponds to one of the vectors. A first vector set corresponding to the first string and a second vector set corresponding to the second string are generated. A similarity of the first vector set and the second vector set is calculated.

Domain name recognition method and domain name recognition device

An electronic device and a method for detecting a malicious file are provided. The method includes the following steps: An executable file is searched, and an import table is extracted from the executable file. The import table includes at least a name of a first DDL and a name of a second DDL. A distance between the first DLL and the second DLL is calculated. Whether the distance exceeds a threshold is determined. If the distance exceeds the threshold, then whether a duplicate content of the import table exists in the executable file is checked. The executable file is regarded as a malicious file if the duplicate content of the import table exists in the executable file.

Electronic device and method for detecting malicious file

A botnet detection system and method are provided. The method includes the steps of: retrieving a network log file of a computer device; refining the network log file according to a device alive-time record of the computer device and a network white list to obtain a plurality of individual network log files, wherein each individual network log file records time information, a source IP address of the computer device, and an individual destination IP address; and analyzing a plurality of connection intervals of the source IP address connecting to the individual destination IP address in each individual network log file to determine whether the computer device exhibits connection behavior that indicates infection by a botnet malware.

Growing community of inventors

Taipei, Taiwan

Ming-Kung Sun