Orange

Sylvie Laniepce

Kahina Lazri

Karel Mittig

Fabien Bignon

Yacine Hebbal

Benjamin Tourolle

A technique for collecting information relating to a flow routed in a communication network. This network includes, in a data plane, packet-processing devices that are configured so as to process packets on the basis of flow-processing rules and, in a control plane, at least one control device that is configured so as to control packet-processing devices and to manage the flow-processing rules. An analysis device identifies at least one flow-processing rule configured so as to process a flow including a first characteristic associated with a first endpoint device of a flow to be sought in the communication network and applied by a processing device. Based on the identified processing rule, the control device determines a second characteristic associated with a second endpoint device.

Technique for collecting information relating to a flow routed in a network

A method for identifying a function of an operating system kernel of a virtual machine. The method includes: identifying an initial instruction included in the code of the operating system kernel of the virtual machine, and locating at least one following block of instructions belonging to a function of the operating system kernel of the virtual machine, the following block being situated in a memory area following the initial instruction; locating at least one preceding block of instructions belonging to a function of the operating system kernel, the proceeding block situated in a memory area preceding the initial instruction; identifying a first block and a last block of instructions of the function of the operating system kernel from among the at least one following and preceding blocks, and recording start and end function addresses in association with the function of the operating system kernel.

Method for identifying at least one function of an operating system kernel

A method and a detection entity for detecting attacks in a system including at least two host servers. Each host server hosts a set of virtual machines. The detection entity performs acts of: detecting that a number of migrations of virtual machines from one server to another during a current time period is greater than a threshold value; partitioning the virtual machines of the system into a first subset having a stable profile of consumption of at least one resource, and into a second subset having a fluctuating profile; calculating, for the pairs of virtual machines of the second subset, a value of temporal correlation between the two profiles of the pair; and identifying in the second subset the virtual machines for which the correlation value is greater than or equal to a threshold correlation value, the machines being identified as constituting the origin of the attack.

Method of detecting attacks in a cloud computing architecture

A method for detecting intrusions on a set of virtual resources in a computer system including at least one physical machine hosting the set of virtual resources. The method includes: calculating an intrusion detection itinerary defined by a sequence of virtual resources from the set, the virtual resources being integrated and arranged in the sequence on the basis of respective vulnerability criticality levels assigned to the virtual resources of the set; and carrying out an intrusion detection operation, following the calculated itinerary.

Method for detecting intrusions on a set of virtual resources

The invention relates to a method for detecting attacks on at least one virtual machine in a system including at least one host server () hosting a set of virtual machines (VM, VM, VM, etc.), the method including the steps of: receiving (E) an alert indicating a breakdown in performance in a virtual machine; verifying (E) that a mechanism for managing resource contention has been implemented for the virtual machine; detecting (E), over a given time interval, at least one time correlation between the breakdown in performance that occurred in the virtual machine and a variation in the use of at least one resource of the host server by at least one other virtual machine, data representing the use of resources being collected at regular intervals.

Method for detecting attacks on virtual machines

A method is provided for attack detection and protection of a set of virtual machines in a system, which includes at least one first host server hosting said set of virtual machines. The method includes: receiving an attack detection message regarding a virtual machine, triggering a first migration of the virtual machine from the first host server toward a security system, and receiving an attack treatment message regarding the migrated virtual machine.

Method for detecting attacks and for protection

The invention relates to a method of evaluating the reliability of a route in a cooperative network for transmitting packets of data between a source node and a destination node of the network. It includes, on reception by the destination node of a message indicating a route between the two nodes:

Growing community of inventors

Caen, France

Sylvie Laniepce