Patents by Inventor Calvin Ko

Calvin Ko has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Sequence-based anomaly detection using a distance matrix
    Patent number: 6742124
    Abstract: A real-time sequence-based anomaly detection system is disclosed. In a preferred embodiment, the intrusion detection system is incorporated as part of a software wrapper. Event abstraction in the software wrapper enables the intrusion detection system to apply generically across various computing platforms. Real-time anomaly detection is enabled through the definition of a distance matrix that defines allowable separation distances between pairs of system calls. The distance matrix indirectly specifies known sequences of system calls and can be used to determine whether a sequence of system calls in an event window represents an anomaly. Anomalies that are detected are further analyzed through levenshtein distance calculations that also rely on the contents of the distance matrix.
    Type: Grant
    Filed: May 8, 2000
    Date of Patent: May 25, 2004
    Assignee: Networks Associates Technology, Inc.
    Inventors: Douglas Kilpatrick, Calvin Ko, Stephen J. Kiernan
  • Multi-platform sequence-based anomaly detection wrapper
    Patent number: 6735703
    Abstract: A real-time sequence-based anomaly detection system is disclosed. In a preferred embodiment, the intrusion detection system is incorporated as part of a software wrapper. Event abstraction in the software wrapper enables the intrusion detection system to apply generically across various computing platforms. Real-time anomaly detection is enabled through the definition of a distance matrix that defines allowable separation distances between pairs of system calls. The distance matrix indirectly specifies known sequences of system calls and can be used to determine whether a sequence of system calls in an event window represents an anomaly. Anomalies that are detected are further analyzed through levenshtein distance calculations that also rely on the contents of the distance matrix.
    Type: Grant
    Filed: May 8, 2000
    Date of Patent: May 11, 2004
    Assignee: Networks Associates Technology, Inc.
    Inventors: Douglas Kilpatrick, Mark Lee Badger, Calvin Ko