John R Copeland

US Patent:

7512980, Mar 31, 2009

Filed:

May 26, 2005

Appl. No.:

10/908809

Inventors:

John A. Copeland - Atlanta GA, US
John Jerrim - Gainesville GA, US

Assignee:

Lancope, Inc. - Alpharetta GA

International Classification:

G06F 11/30

US Classification:

726 23, 726 22, 726 25, 726 26, 713151, 709203, 709224, 709227, 705 51

Abstract:

A flow-based intrusion detection system for detecting intrusions in computer communication networks. Data packets representing communications between hosts in a computer-to-computer communication network are processed and assigned to various client/server flows. Statistics are collected for each flow. Then, the flow statistics are analyzed to determine if the flow appears to be legitimate traffic or possible suspicious activity. A concern index value is assigned to each flow that appears suspicious. By assigning a value to each flow that appears suspicious and adding that value to the total concern index of the responsible host, it is possible to identify hosts that are engaged in intrusion activity. When the concern index value of a host exceeds a preset alarm value, an alert is issued and appropriate action can be taken.

US Patent:

7644151, Jan 5, 2010

Filed:

Mar 25, 2002

Appl. No.:

10/106298

Inventors:

John Jerrim - Duluth GA, US
John A. Copeland - Atlanta GA, US

Assignee:

Lancope, Inc. - Alpharetta GA

International Classification:

G06F 15/173

US Classification:

709224, 709223, 709225, 709227, 709212, 713154, 725 25, 726 22, 726 23, 726 25

Abstract:

A zone locking system detects unauthorized network usage internal to a firewall. The system determines unauthorized network usage by classifying internal hosts inside a firewall into zones. Certain specified zones are unauthorized to initiate client communications with other selected zones. However, zone override services can be designated for each associated internal zone, and thus, authorizing selected network services. An alarm or other appropriate action is taken upon the detection of unauthorized network usage.

US Patent:

20020144156, Oct 3, 2002

Filed:

Jan 31, 2002

Appl. No.:

10/062621

Inventors:

John Copeland - Atlanta GA, US

International Classification:

G06F011/30

US Classification:

713/201000, 709/224000

Abstract:

A port profiling system detects unauthorized network usage. The port profiling system analyzes network communications to determine the service ports being used. The system collects flow data from packet headers between two hosts or Internet Protocol (IP) addresses. The collected flow data is analyzed to determine the associated network service provided. A host data structure is maintained containing a profile of the network services normally associated with the host. If the observed network service is not one of the normal network services performed as defined by the port profile for that host, an alarm signal is generated and action can be taken based upon the detection of an Out of Profile network service. An Out of Profile operation can indicate the operation of a Trojan Horse program on the host, or the existence of a non-approved network application that has been installed.

US Patent:

20030105976, Jun 5, 2003

Filed:

Nov 30, 2001

Appl. No.:

10/000396

Inventors:

John Copeland - Atlanta GA, US

International Classification:

G06F011/30

US Classification:

713/201000, 709/224000

Abstract:

A flow-based intrusion detection system for detecting intrusions in computer communication networks. Data packets representing communications between hosts in a computer-to-computer communication network are processed and assigned to various client/server flows. Statistics are collected for each flow. Then, the flow statistics are analyzed to determine if the flow appears to be legitimate traffic or possible suspicious activity. A concern index value is assigned to each flow that appears suspicious. By assigning a value to each flow that appears suspicious and adding that value to the total concern index of the responsible host, it is possible to identify hosts that are engaged in intrusion activity. When the concern index value of a host exceeds a preset alarm value, an alert is issued and appropriate action can be taken.

US Patent:

20070180526, Aug 2, 2007

Filed:

Jan 18, 2007

Appl. No.:

11/624441

Inventors:

John COPELAND - Atlanta GA, US

Assignee:

LANCOPE, INC. - Alpharetta GA

International Classification:

G06F 15/16
G06F 12/14
G06F 11/00
G06F 17/00
G06F 15/173
G06F 9/00
G06F 12/16
G06F 15/18
G08B 23/00

US Classification:

726023000, 726025000, 726013000, 726014000, 709224000

Abstract:

A flow-based intrusion detection system for detecting intrusions in computer communication networks. Data packets representing communications between hosts in a computer-to-computer communication network are processed and assigned to various client/server flows. Statistics are collected for each flow. Then, the flow statistics are analyzed to determine if the flow appears to be legitimate traffic or possible suspicious activity. A concern index value is assigned to each flow that appears suspicious. By assigning a value to each flow that appears suspicious and adding that value to the total concern index of the responsible host, it is possible to identify hosts that are engaged in intrusion activity. When the concern index value of a host exceeds a preset alarm value, an alert is issued and appropriate action can be taken.

US Patent:

20070289017, Dec 13, 2007

Filed:

Aug 24, 2007

Appl. No.:

11/844568

Inventors:

John COPELAND - Atlanta GA, US

Assignee:

LANCOPE, INC. - Alpharetta GA

International Classification:

G06F 11/30
G06F 15/173

US Classification:

726023000, 709224000

Abstract:

A port profiling system detects unauthorized network usage. The port profiling system analyzes network communications to determine the service ports being used. The system collects flow data from packet headers between two hosts or Internet Protocol (IP) addresses. The collected flow data is analyzed to determine the associated network service provided. A host data structure is maintained containing a profile of the network services normally associated with the host. If the observed network service is not one of the normal network services performed as defined by the port profile for that host, an alarm signal is generated and action can be taken based upon the detection of an Out of Profile network service. An Out of Profile operation can indicate the operation of a Trojan Horse program on the host, or the existence of a non-approved network application that has been installed.

US Patent:

45772070, Mar 18, 1986

Filed:

Dec 30, 1982

Appl. No.:

6/454550

Inventors:

John A. Copeland - Dunwoody GA

Assignee:

AT&T Bell Laboratories - Murray Hill NJ

International Classification:

H01L 3300

US Classification:

357 17

Abstract:

A dual wavelength optical source includes a monolithic integrated pair of series-opposition connected diodes, each fabricated for emitting light having a different wavelength than the other. Polarity of a common bias current conducted through the diodes is reversed for activating alternatively light emission from the diodes. Active emission regions of the diodes are stacked upon one another for efficiently coupling the resulting beams of the different wavelengths of emitted light through a surface into the core of a single mode optical fiber.

US Patent:

57846103, Jul 21, 1998

Filed:

Nov 21, 1994

Appl. No.:

8/342978

Inventors:

John Ray Copeland - Decatur AL
Leslie Marie Doby - Matthews NC
Larry Page Hobbs - Charlotte NC
Vil Patrick Johnikin - Charlotte NC
Julie Ann Pridmore - Charlotte NC
Sterling Richardson Smith - Charlotte NC
Thomas Chester Smith - Charlotte NC
Lori London Weaver - Salisbury NC
Filip Jay Yeskel - Charlotte NC

Assignee:

International Business Machines Corporation - Armon NY

International Classification:

G06F 1500
G06F 1730

US Classification:

395615

Abstract:

A digital document image archive and distribution system includes an archive system and a distributed digital document image retrieval system. The system has communication nodes located at an image capture site and at one or more remote archive retrieval sites, these sites forming a communications network operating as a chained client/server network composed of workstation components and a capture site host computer component. An originating remote workstation retrieves a digital document image from the image capture site by creating a transaction file that identifies a digital document image to be retrieved. This transaction file is sent to a remote server workstation whereat a plurality of transaction files are batched by priority. The batched transaction files are transmitted to the capture site workstation whereat the host component retrieves a group of digital document images from archive storage, including the digital document image that is identified by the transaction file. The host then sends the group of digital document images to a capture site server workstation, which workstation then sends the group of digital document images from the capture site server workstation to the remote server workstation, whereupon the group of digital document images is sent from the remote server workstation to the originating remote workstation.