The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Nov. 06, 2012
Filed:
Mar. 17, 2010
Hahn-ming Lee, Taipei, TW;
Ching-hao Mao, Taipei, TW;
Yu-jie Chen, Taipei, TW;
Yi-hsun Wang, Taipei, TW;
Jerome Yeh, Taipei, TW;
Tsu-han Chen, Taipei, TW;
Hahn-Ming Lee, Taipei, TW;
Ching-Hao Mao, Taipei, TW;
Yu-Jie Chen, Taipei, TW;
Yi-Hsun Wang, Taipei, TW;
Jerome Yeh, Taipei, TW;
Tsu-Han Chen, Taipei, TW;
National Taiwan University of Science and Technology, Taipei, TW;
Abstract
A botnet detection system is provided. A bursty feature extractor receives an Internet Relay Chat (IRC) packet value from a detection object network, and determines a bursty feature accordingly. A Hybrid Hidden Markov Model (HHMM) parameter estimator determines probability parameters for a Hybrid Hidden Markov Model according to the bursty feature. A traffic profile generator establishes a probability sequential model for the Hybrid Hidden Markov Model according to the probability parameters and pre-defined network traffic categories. A dubious state detector determines a traffic state corresponding to a network relaying the IRC packet in response to reception of a new IRC packet, determines whether the IRC packet flow of the object network is dubious by applying the bursty feature to the probability sequential model for the Hybrid Hidden Markov Model, and generates a warning signal when the IRC packet flow is regarded as having a dubious traffic state.