Institute for Information Industry

Te-En Wei

Chih-Hung Hsieh

Ching-Hao Mao

Chia-Min Lai

Hsiao-Hsien Chang

Chi-Ping Lai

Hsiang-Tsung Kung

Kun-Wei Lee

Chin-Wei Chen

Chi-Kuan Chiu

Ching-hao Mao

Chia-min Lai

A suspicious packet detection device and a suspicious packet detection method thereof are provided. The suspicious packet detection device captures an HTTP packet transmitted from an internal network to an external network, and based on an HTTP header of the HTTP packet, determines that the HTTP packet belongs to one of a browser category and an application category and identifies the HTTP packet as one of a normal packet and a suspicious packet. When the HTTP packet is identified as the normal packet, the suspicious packet detection device further verifies whether the HTTP packet is the suspicious packet or not by comparing the HTTP header with relevance information or by using a URL classification model.

Suspicious packet detection device and suspicious packet detection method thereof

An abnormal flow detection device and an abnormal flow detection method thereof are provided. The abnormal flow detection device analyses a plurality of packets captured during a time interval to obtain a plurality of flow features of each packet and selects at least one key flow feature from the flow features based on a dimensionality reduction algorithm. The abnormal flow detection device trains a bidirectional generative adversarial network (BiGAN) by taking the at least one key flow feature of each packet as an input of the BiGAN to build a flow recognition model for detecting abnormal flows.

Abnormal flow detection device and abnormal flow detection method thereof

A network attack pattern determination apparatus, method, and non-transitory computer readable storage medium thereof are provided. The apparatus is stored with several attack patterns and access records. Each access record includes a network address, time stamp, and access content. Each attack pattern corresponds to at least one attack access relation. Each attack access relation is defined by a network address and access content. The apparatus retrieves several attack records according to at least one attack address. The network address of each attack record is one of the attack address(s). The apparatus divides the attack records into several groups according to the time stamps and performs the following operations for each group: (a) creating at least one access relation for each attack address included in the group and (b) determining that the group corresponds to one of the attack patterns according to the at least one access relation of the group.

Network attack pattern determination apparatus, determination method, and non-transitory computer readable storage medium thereof

An abnormal behavior detection model building apparatus and an abnormal behavior detection model building method thereof are provided. The abnormal behavior detection model building apparatus analyzes the parts of speech of a plurality of program operation sequences in a plurality of program operation sequence data associated with abnormal behaviors to generate a plurality of word vectors and cluster the word vectors. Based on the result of the clustering, the abnormal behavior detection model building apparatus obtains a feature vector of each of the program operation sequence data, and perform a supervised learning for a classification algorithm by using the feature vectors so as to build an abnormal behavior detection model.

Abnormal behavior detection model building apparatus and abnormal behavior detection model building method thereof

An attacking node detection apparatus, method, and computer program product thereof are provided. The attacking node detection apparatus stores a plurality of access records of an application, wherein each access record includes a network address of a host and an access content. The attacking node detection apparatus filters the access records into a plurality of filtered access records according to a predetermined rule so that the access content of each filtered access record conforms to the predetermined rule. The attacking node detection apparatus creates at least one access relation of each of the network addresses according to the filtered access records, wherein each access relation is defined by one of the network addresses and one of the access contents. The attacking node detection apparatus identifies a specific network address as an attacking node according to the access relations.

Growing community of inventors

Taipei, Taiwan

Te-En Wei