Extract from the Register of European Patents

About this file: EP1682990

EP1682990 - APPARATUS METHOD AND MEDIUM FOR DETECTING PAYLOAD ANOMALY USING N-GRAM DISTRIBUTION OF NORMAL DATA [Right-click to bookmark this link]
StatusNo opposition filed within time limit
Status updated on  04.04.2014
Database last updated on 25.01.2020
Most recent event   Tooltip17.07.2015Lapse of the patent in a contracting state
New state(s): HU, LU
published on 19.08.2015  [2015/34]
Applicant(s)For all designated states
The Trustees of Columbia University in the City of New York
535 West 116th Street
New York, NY 10027 / US
[2006/30]
Inventor(s)01 / STOLFO, Salvatore J.
80 Kenilworth Road
Ridgewood, NJ 07450 / US
02 / WANG, Ke
435 W 119 St. Apt 2E
New York, NY 10027 / US
 [2006/37]
Former [2006/30]01 / STOLFO, Salvatore J.
80 Kenilworth Road
Ridgewood, NJ 07450 / US
02 / WANG, Ke
434 W. 199th Street, Apartment 2E
New York, NY 10027 / US
Representative(s)Lawrence, John
Barker Brettell LLP
100 Hagley Road
Edgbaston
Birmingham B16 8QQ / GB
[N/P]
Former [2013/22]Lawrence, John
Barker Brettell LLP
100 Hagley Road
Edgbaston
Birmingham
B16 8QQ / GB
Former [2008/23]Lawrence, John
Barker Brettell LLP 138 Hagley Road Edgbaston Birmingham
B16 9PW / GB
Former [2006/30]Lawrence, John
Barker, Brettell 138 Hagley Road Edgbaston
Birmingham B16 9PW / GB
Application number, filing date04810752.812.11.2004
[2006/30]
WO2004US37653
Priority number, dateUS20030518742P12.11.2003         Original published format: US 518742 P
US20040613637P28.09.2004         Original published format: US 613637 P
[2006/30]
Filing languageEN
Procedural languageEN
PublicationType: A2  Application without search report
No.:WO2005050369
Date:02.06.2005
Language:EN
[2005/22]
Type: A2 Application without search report 
No.:EP1682990
Date:26.07.2006
Language:EN
The application has been published by WIPO in one of the EPO official languages on 02.06.2005
[2006/30]
Type: B1 Patent specification 
No.:EP1682990
Date:29.05.2013
Language:EN
[2013/22]
Search report(s)International search report - published on:US15.06.2006
(Supplementary) European search report - dispatched on:EP05.11.2010
ClassificationInternational:H04L29/06, G06F21/00
[2010/48]
Former International [2006/41]H04J3/16, H04J3/24
Former International [2006/30]G06F1/00
Designated contracting statesAT,   BE,   BG,   CH,   CY,   CZ,   DE,   DK,   EE,   ES,   FI,   FR,   GB,   GR,   HU,   IE,   IS,   IT,   LI,   LU,   MC,   NL,   PL,   PT,   RO,   SE,   SI,   SK,   TR [2006/30]
TitleGerman:VORRICHTUNG, VERFAHREN UND MEDIUM ZUR ERKENNUNG EINER NUTZSIGNAL-ANOMALIE DURCH VERWENDUNG EINER N-GRAMM-VERTEILUNG NORMALER DATEN[2006/30]
English:APPARATUS METHOD AND MEDIUM FOR DETECTING PAYLOAD ANOMALY USING N-GRAM DISTRIBUTION OF NORMAL DATA[2006/30]
French:DISPOSITIF, PROCEDE ET SUPPORT DE DETECTION D'ANOMALIES DE LA CHARGE UTILE A L'AIDE DE LA DISTRIBUTION N-GRAMME DE DONNEES NORMALES[2006/30]
Entry into regional phase03.06.2006National basic fee paid 
03.06.2006Search fee paid 
03.06.2006Designation fee(s) paid 
03.06.2006Examination fee paid 
Examination procedure03.06.2006Examination requested  [2006/30]
28.03.2011Despatch of a communication from the examining division (Time limit: M04)
03.08.2011Reply to a communication from the examining division
28.03.2012Despatch of a communication from the examining division (Time limit: M06)
16.08.2012Reply to a communication from the examining division
12.12.2012Communication of intention to grant the patent
17.04.2013Fee for grant paid
17.04.2013Fee for publishing/printing paid
Divisional application(s)EP13161455.4  / EP2618538
The date of the Examining Division's first communication in respect of the earliest application for which a communication has been issued is  28.03.2011
Opposition(s)03.03.2014No opposition filed within time limit [2014/19]
Fees paidRenewal fee
27.11.2006Renewal fee patent year 03
27.11.2007Renewal fee patent year 04
25.11.2008Renewal fee patent year 05
25.11.2009Renewal fee patent year 06
25.11.2010Renewal fee patent year 07
25.01.2012Renewal fee patent year 08
23.11.2012Renewal fee patent year 09
Penalty fee
Additional fee for renewal fee
30.11.201108   M06   Fee paid on   25.01.2012
Lapses during opposition  TooltipHU12.11.2004
AT29.05.2013
BE29.05.2013
CY29.05.2013
DK29.05.2013
EE29.05.2013
MC29.05.2013
PL29.05.2013
RO29.05.2013
SI29.05.2013
SK29.05.2013
TR29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
IE12.11.2013
LU12.11.2013
CH30.11.2013
LI30.11.2013
[2015/34]
Former [2015/32]AT29.05.2013
BE29.05.2013
CY29.05.2013
DK29.05.2013
EE29.05.2013
MC29.05.2013
PL29.05.2013
RO29.05.2013
SI29.05.2013
SK29.05.2013
TR29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
IE12.11.2013
CH30.11.2013
LI30.11.2013
Former [2015/30]AT29.05.2013
BE29.05.2013
CY29.05.2013
DK29.05.2013
EE29.05.2013
MC29.05.2013
PL29.05.2013
RO29.05.2013
SI29.05.2013
SK29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
IE12.11.2013
CH30.11.2013
LI30.11.2013
Former [2014/48]AT29.05.2013
BE29.05.2013
DK29.05.2013
EE29.05.2013
MC29.05.2013
PL29.05.2013
RO29.05.2013
SI29.05.2013
SK29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
IE12.11.2013
CH30.11.2013
LI30.11.2013
Former [2014/37]AT29.05.2013
BE29.05.2013
DK29.05.2013
EE29.05.2013
MC29.05.2013
PL29.05.2013
RO29.05.2013
SI29.05.2013
SK29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
CH30.11.2013
LI30.11.2013
Former [2014/34]AT29.05.2013
BE29.05.2013
DK29.05.2013
EE29.05.2013
MC29.05.2013
PL29.05.2013
SI29.05.2013
SK29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
CH30.11.2013
LI30.11.2013
Former [2014/33]AT29.05.2013
BE29.05.2013
DK29.05.2013
EE29.05.2013
MC29.05.2013
PL29.05.2013
SI29.05.2013
SK29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
Former [2014/10]AT29.05.2013
BE29.05.2013
DK29.05.2013
EE29.05.2013
PL29.05.2013
SI29.05.2013
SK29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
Former [2014/09]AT29.05.2013
BE29.05.2013
DK29.05.2013
EE29.05.2013
PL29.05.2013
SI29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
Former [2014/06]AT29.05.2013
BE29.05.2013
PL29.05.2013
SI29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
Former [2013/50]AT29.05.2013
PL29.05.2013
SI29.05.2013
BG29.08.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
Former [2013/49]AT29.05.2013
SI29.05.2013
GR30.08.2013
IS29.09.2013
PT30.09.2013
Former [2013/48]AT29.05.2013
IS29.09.2013
PT30.09.2013
Former [2013/47]PT30.09.2013
Documents cited:Search[XOP]  - WANG K ET AL, "Anomalous Payload-Based Network Intrusion Detection", Lecture Notes in Computer Science., vol. 3224, (20040917), pages 203 - 222, URL: http://www.springerlink.com/content/tqlj7cblgevdx0dj/fulltext.pdf, (20101014), XP002605194 [XOP] 1-28,47-50,54-57 * the whole document *
 [L]  - "Recent Advances in Intrusion Detection7th International Symposium, RAID 2004, Sophia Antipolis, France, September 15 - 17, 2004. Proceedings.", (2004), URL: http://www.springerlink.com/content/978-3-540-23123-3, (20101014), XP002606744
 [A]  - C. Krügel, T. Toth, E. kirda, "Service Specific Anomaly Detection for Network Intrusion Detection", (20020430), URL: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.93.843&rep=rep1&type=pdf, (20101014), XP002605141 [A] 1-28,47-50,54-57 * the whole document *
 [AOP]  - Li Zhuowei, Amitabha Das, Sukumar Nandi, "Utilizing Statistical Characteristics of N-grams for Intrusion Detection", (20031203), URL: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.59.2753&rep=rep1&type=pdf, (20101014), XP002605195 [AOP] 1-28,47-50,54-57 * the whole document *
 [LP]  - "2003 International Conference on CYBERWORLDS", (2003), URL: http://www3.ntu.edu.sg/SCE/cw2003/cw2003.htm, (20101014), XP002606739
 [AO]  - Matthew V. Mahoney, "Network traffic anomaly detection based on packet bytes", (20030312), URL: http://portal.acm.org/ft_gateway.cfm?id=952601&type=pdf&coll=GUIDE&dl=GUIDE&CFID=108706187&CFTOKEN=32712596, (20101014), XP002605196 [AO] 1-28,47-50,54-57 * the whole document *
 [L]  - "Symposium on Applied Computing. Proceedings of the 2003 ACM symposium on Applied computing. 2003, Melbourne, Florida March 09-12, 2003", (2003), URL: http://portal.acm.org/toc.cfm?id=952532&type=proceeding&coll=GUIDE&dl=GUIDE&CFID=108706187&CFTOKEN=32712596, (20101014), XP002606740
 [A]  - Matthew V. Mahoney, Philip K. Chan, "Learning Models of Network Traffic for Detecting Novel Attacks", (200208), URL: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.15.1495&rep=rep1&type=pdf, (20101014), XP002605142 [A] 1-28,47-50,54-57 * the whole document *
 [AO]  - Carol Taylor, Jim Alves-Foss, "NATE - Network Analysis of Anomalous Traffic Events,A Low-Cost Approach", (20010913), URL: http://portal.acm.org/ft_gateway.cfm?id=508186&type=pdf&coll=GUIDE&dl=GUIDE&CFID=108711061&CFTOKEN=89530491, (20101014), XP002605143 [AO] 1-28,47-50,54-57 * the whole document *
 [L]  - "New Security Paradigms Workshop archiveProceedings of the 2001 workshop on New security paradigms. 2001, Cloudcroft, New Mexico, September 10 - 13, 2001", (2001), URL: http://portal.acm.org/toc.cfm?id=508171&type=proceeding&coll=GUIDE&dl=GUIDE&CFID=108711061&CFTOKEN=89530491, (20101014), XP002606741
 [AOP]  - Rachna Vargiya, Philip Chan, "Boundary Detection in Tokenizing Network Application Payload for Anomaly Detection", (20031119), URL: http://cs.fit.edu/~pkc/dmsec03/slides/vargiya03dmsec.ppt, (20101014), XP002605197 [AOP] 1-28,47-50,54-57 * the whole document *
 [LP]  - "ICDM Workshop on Data Mining for Computer Security (DMSEC 03). November 19, 2003.", (2003), URL: http://cs.fit.edu/~pkc/dmsec03/schedule.pdf, (20101014), XP002606742 [LP] * the whole document *
International search[YP]US2004111632  ;
 [YP]US2004024736  ;
 [A]US2003014662