The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Oct. 29, 2024

Filed:

Jan. 07, 2022
Applicant:

Ciena Corporation, Hanover, MD (US);

Inventors:

Zhiyan Chen, Ottawa, CA;

Murat Simsek, Ottawa, CA;

Burak Kantarci, Ottawa, CA;

Petar Djukic, Ottawa, CA;

James P'ford't Carnes, III, Baltimore, MD (US);

Mehran Bagheri, Orleans, CA;

Jinxin Liu, Ottawa, CA;

Yu Shen, Ottawa, CA;

Assignee:

Ciena Corporation, Hanover, MD (US);

Attorneys:
Primary Examiner:
Int. Cl.
CPC ...
H04L 9/40 (2022.01); G06N 3/08 (2023.01); H04L 41/0631 (2022.01); H04L 43/04 (2022.01); H04L 61/5061 (2022.01);
U.S. Cl.
CPC ...
H04L 63/1416 (2013.01); G06N 3/08 (2013.01); H04L 41/0631 (2013.01); H04L 43/04 (2013.01); H04L 61/5061 (2022.05); H04L 63/0227 (2013.01); H04L 63/0236 (2013.01); H04L 63/1425 (2013.01); H04L 63/20 (2013.01);
Abstract

Systems and methods for detecting intrusions, attacks, and sub-attacks launched against a network under observations are provided. A method, according to one implementation, includes obtaining network traffic information regarding data traffic in a network under observation and obtaining system log information regarding operations of the network under observation. The method further includes the step of inserting the network traffic information and system log information into one or more analysis procedures, where each analysis procedure is configured to detect a respective sub-attack of a multi-stage attack to which the network under observation is susceptible. Also, the method includes the step of combining the outputs of the one or more analysis procedures to detect whether one or more sub-attacks have been launched against the network under observation. In response to detecting that one or more sub-attacks have been launched, the methods include the step of determining the type of the one or more sub-attacks.


Find Patent Forward Citations

Loading…