IPFIX-based detection of amplification attacks on databases
US10404738B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Feb 27, 2017 |
| Grant date | Sep 3, 2019 |
| Priority date | — |
| Expiry date | Aug 19, 2037 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L61/4511
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
One embodiment illustrated herein includes a computer implemented method. The method includes acts for training an amplification attack detection system. The method includes obtaining a plurality of samples of IPFIX data. The method further includes using the IPFIX data to create a plurality of time-based, server samples on a per server basis such that each sample corresponds to a server and a period of time over which IPFIX data in the sample corresponds. The method further includes identifying a plurality of the server samples that are labeled positive for amplification attacks. The method further includes identifying a plurality of server samples that are labeled negative for amplification attacks. The method further includes automatically labeling at least some of the remaining server samples as positive or negative based on the previously identified labeled samples. The method further includes using the automatically labeled samples to train an amplification attack detection system.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.