Abstract: A method for aiding detection of infection of a terminal by malware. The method includes: reception of a current request originating from the terminal asking for access to a resource of a network; detection that the resource requested is malevolent; when the current request includes a reference to an initial resource, verification that access to the initial resource has been requested from the terminal in at least one earlier request, the initial resource having been detected legitimate during processing of the earlier request; and wherein the current request being then considered to be an attempt to infect the terminal.

Abstract: A method for aiding detection of infection of a terminal by malware. The method includes: reception of a current request originating from the terminal asking for access to a resource of a network; detection that the resource requested is malevolent; when the current request includes a reference to an initial resource, verification that access to the initial resource has been requested from the terminal in at least one earlier request, the initial resource having been detected legitimate during processing of the earlier request; and wherein the current request being then considered to be an attempt to infect the terminal.

Abstract: The invention concerns a method for detecting anomalies in network traffic, said traffic being transmitted by a server (10) in response to requests from at least one client device (11), the method comprising: —a step (E10) of receiving a request, said request being of a given type, —a step (E11) of receiving a response to the request, —a step (E13) of constructing a current bit vector (VN), representative of the response, —a step (E17) of calculating a similarity index representative of a distance between the current bit vector and a model bit vector (Vmod) associated with the request type, —a step of checking (E18) that the similarity index (Isc) does not belong to a compliance interval (IC) calculated for the request type, an anomaly being detected when the similarity index does not belong to the compliance interval.

Abstract: A method for detecting intrusions on a set of virtual resources in a computer system including at least one physical machine hosting the set of virtual resources. The method includes: calculating an intrusion detection itinerary defined by a sequence of virtual resources from the set, the virtual resources being integrated and arranged in the sequence on the basis of respective vulnerability criticality levels assigned to the virtual resources of the set; and carrying out an intrusion detection operation, following the calculated itinerary.

Abstract: A method is provided for attack detection and protection of a set of virtual machines in a system, which includes at least one first host server hosting said set of virtual machines. The method includes: receiving an attack detection message regarding a virtual machine, triggering a first migration of the virtual machine from the first host server toward a security system, and receiving an attack treatment message regarding the migrated virtual machine.

Abstract: The invention concerns a method for detecting anomalies in network traffic, said traffic being transmitted by a server (10) in response to requests from at least one client device (11), the method comprising: a step (E10) of receiving a request, said request being of a given type, a step (E11) of receiving a response to the request, a step (E13) of constructing a current bit vector (VN), representative of the response, a step (E17) of calculating a similarity index representative of a distance between the current bit vector and a model bit vector (Vmod) associated with the request type, a step of checking (E18) that the similarity index (Isc) does not belong to a compliance interval (IC) calculated for the request type, an anomaly being detected when the similarity index does not belong to the compliance interval.

Abstract: A method is provided for attack detection and protection of a set of virtual machines in a system, which includes at least one first host server hosting said set of virtual machines. The method includes: receiving an attack detection message regarding a virtual machine, triggering a first migration of the virtual machine from the first host server toward a security system, and receiving an attack treatment message regarding the migrated virtual machine.

Abstract: A method for detecting intrusions on a set of virtual resources in a computer system including at least one physical machine hosting the set of virtual resources. The method includes: calculating an intrusion detection itinerary defined by a sequence of virtual resources from the set, the virtual resources being integrated and arranged in the sequence on the basis of respective vulnerability criticality levels assigned to the virtual resources of the set; and carrying out an intrusion detection operation, following the calculated itinerary.