Industrial Technology Research Institute

Pei-Hsuan Lu

Pang-Chieh Wang

Ming-Chih Kao

Yu-Hsuan Pan

Kai-Cheng Liu

Pin-Hui Lu

A network intrusion detecting system includes a network card configured to receive network traffic and a processor. The processor is configured to analyze the network traffic and extract traffic characteristics of the network traffic and confirm whether the network traffic is network traffic to be detected based on the traffic characteristics; input the network traffic to be detected into an automatic coding module to obtain a reconstructed sample and calculate a reconstruction error between the network traffic to be detected and the reconstructed sample; input the network traffic to be detected and the reconstructed sample respectively into at least one classification module and calculate a distribution similarity when the reconstruction error is less than a reconstruction error threshold; and input the network traffic to be detected into an intrusion anomaly classification model for network intrusion classification when the distribution similarity is less than a confidence distribution similarity threshold.

Network intrusion detecting system and network intrusion detecting method

A detection device and a detection method for a malicious HTTP request are provided. The detection method includes: receiving a HTTP request and capturing a parameter from the HTTP request; filtering the HTTP request in response to the parameter not matching a whitelist; encoding each character of the HTTP request to generate an encoded string in response to the HTTP request not being filtered; generating an estimated HTTP request according to the encoded string by using an autoencoder; and determining that the HTTP request is a malicious HTTP request in response to a similarity between the HTTP request and the estimated HTTP request being less than a similarity threshold, and outputting a determined result.

Detection device and detection method for malicious HTTP request

A data anonymity method and a data anonymity system are provided. The data anonymity method includes the following steps. A data set comprising a plurality of direct-identifiers, a plurality of quasi-identifiers and a plurality of event logs each of which includes an activity and a timestamp is obtained. A content of each of the direct-identifiers is replaced by a pseudonym. The quasi-identifiers are classified, via a group-by algorithm with k-anonymity, as a plurality of equivalence classes. The activities corresponding to each of the direct-identifiers are linked according to the timestamps to obtain a plurality of event sequences. A similarity hierarchy tree is obtained according to a plurality of edit distances among the event sequences. The event sequences are grouped according to the similarity hierarchy tree with k-anonymity to obtain at least one group. The event sequences which are in the group are generalized.

Growing community of inventors

Hsinchu, Taiwan

Pei-Hsuan Lu