Processing

Please wait...

Settings

Settings

Goto Application

1. WO2016148676 - DETERMINE ANOMALOUS BEHAVIOR BASED ON DYNAMIC DEVICE CONFIGURATION ADDRESS RANGE

Publication Number WO/2016/148676
Publication Date 22.09.2016
International Application No. PCT/US2015/020434
International Filing Date 13.03.2015
IPC
H04L 29/06 2006.01
HELECTRICITY
04ELECTRIC COMMUNICATION TECHNIQUE
LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
29Arrangements, apparatus, circuits or systems, not covered by a single one of groups H04L1/-H04L27/136
02Communication control; Communication processing
06characterised by a protocol
H04L 12/26 2006.01
HELECTRICITY
04ELECTRIC COMMUNICATION TECHNIQUE
LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
12Data switching networks
02Details
26Monitoring arrangements; Testing arrangements
CPC
H04L 29/06102
HELECTRICITY
04ELECTRIC COMMUNICATION TECHNIQUE
LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
29Arrangements, apparatus, circuits or systems, not covered by a single one of groups H04L1/00 - H04L27/00
02Communication control
06characterised by a protocol
06095Special adaptations or provisions of the transmission control protocol/internet protocol [TCP/IP] or the user datagram protocol [UDP]
06102Implementation details of TCP/IP or UDP/IP stack architecture; specification of modified or new header fields
H04L 29/12028
HELECTRICITY
04ELECTRIC COMMUNICATION TECHNIQUE
LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
29Arrangements, apparatus, circuits or systems, not covered by a single one of groups H04L1/00 - H04L27/00
12characterised by the data terminal
12009Arrangements for addressing and naming in data networks
12018Mapping of addresses of different types; address resolution
12028across network layers, e.g. resolution of network layer into physical layer addresses, Address Resolution Protocol [ARP]
H04L 61/103
HELECTRICITY
04ELECTRIC COMMUNICATION TECHNIQUE
LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
61Network arrangements or network protocols for addressing or naming
10Mapping of addresses of different types; Address resolution
103across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
H04L 61/2015
HELECTRICITY
04ELECTRIC COMMUNICATION TECHNIQUE
LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
61Network arrangements or network protocols for addressing or naming
20Address allocation
2007internet protocol [IP] addresses
2015using the dynamic host configuration protocol [DHCP] or variants
H04L 63/126
HELECTRICITY
04ELECTRIC COMMUNICATION TECHNIQUE
LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
63Network architectures or network communication protocols for network security
12Applying verification of the received information
126the source of the received data
H04L 63/1408
HELECTRICITY
04ELECTRIC COMMUNICATION TECHNIQUE
LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
63Network architectures or network communication protocols for network security
14for detecting or protecting against malicious traffic
1408by monitoring network traffic
Applicants
  • HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP [US]/[US]
Inventors
  • WACKERLY, Shaun
  • WAKUMOTO, Shaun
  • MENTZE, Duane
Agents
  • PATEL, Milin, N.
Priority Data
Publication Language English (EN)
Filing Language English (EN)
Designated States
Title
(EN) DETERMINE ANOMALOUS BEHAVIOR BASED ON DYNAMIC DEVICE CONFIGURATION ADDRESS RANGE
(FR) DÉTERMINATION D'UN COMPORTEMENT ANORMAL SUR LA BASE DE L'ESPACE DES ADRESSES DE CONFIGURATION DYNAMIQUES DE DISPOSITIF
Abstract
(EN)
Example embodiments disclosed herein relate to determining whether a device exhibits anomalous behavior based on a set of rules, address usage information, and address range information. Address usage information for a device communicating on a data plane of a network implemented using switches is received via a control plane. Address range information for the network is maintained. Whether the device exhibits anomalous behavior is determined based on the set of rules, address usage information, and address range information.
(FR)
Des modes de réalisation donnés à titre d'exemple consistent à déterminer si un dispositif présente un comportement anormal sur la base d'un ensemble de règles, d'informations d'utilisation d'adresses et d'informations d'espace des adresses. Des informations d'utilisation d'adresses pour un dispositif communiquant sur un plan de données d'un réseau mis en œuvre au moyen de commutateurs sont reçues par l'intermédiaire d'un plan de commande. Des informations d'espace des adresses, destinées au réseau, sont maintenues. Il est déterminé si le dispositif présente un comportement anormal sur la base de l'ensemble des règles, des informations d'utilisation d'adresses et des informations d'espace des adresses.
Also published as
Latest bibliographic data on file with the International Bureau