1. A method for correlating event information, comprising:
receiving event information for a plurality of detected events wherein:
the event information for a particular detected event comprises a plurality of attributes associated with the particular detected event; and
the particular detected event is associated with at least one data packet in an enterprise network;
assigning a plurality of attribute values to each detected event, the attribute values of each detected event defining a point in n-dimensional space;
storing the event information for each detected event in accordance with the attribute values assigned to that detected event;
receiving a target event comprising a plurality of attributes wherein:
the target event is associated with at least one data packet that threatens the enterprise network;
the attributes of the target event are associated with attribute values; and
the attribute values of the target event define a target point in n-dimensional space;
receiving a plurality of proximity limits that define a portion of n-dimensional space surrounding the target point; and
identifying a plurality of detected events wherein the points defined by the attribute values of the identified detected events are within the portion of n-dimensional space defined by the proximity limits.
2. The method of claim 1, further comprising:
correlating the event information of the identified detected events with at least one attacker profile, the at least one attacker profile comprising a plurality of characteristics of an attacker of an enterprise network;
storing the event information of the identified detected events with the at least one attacker profile; and
displaying to an operator the at least one attacker profile.
3. The method of claim 2, further comprising generating a new attacker profile if the event information of the identified detected events does not correlate with at least one attacker profile, the new attacker profile based at least in part on the event information of the identified detected events.
4. The method of claim 2, wherein the correlation is performed using at least one Bayesian network or at least one neural network.
5. The method of claim 1, wherein the event information is received by a plurality of sensors operable to receive data associated with potential attacks on at least one enterprise network.
6. The method of claim 1, wherein:
each attribute value of a particular detected event corresponds to a particular attribute value of the target event; and
each proximity limit corresponds to a particular attribute value of the target event.
7. The method of claim 1, wherein:
a first attribute of the detected event is a source IP address;
a second attribute of the detected event is a destination IP address; and
a third attribute of the detected event is a time of detection.
8. The method of claim 1, wherein:
a first axis of the n-dimensional space corresponds to source IP addresses of the plurality of detected events; and
a second axis of the n-dimensional space corresponds to destination IP addresses of the plurality of detected events.
9. The method of claim 1, wherein the target event is at least one of the following:
a computer virus;
a trojan horse;
a computer worm; and
at least a portion of malicious computer code.
10. The method of claim 1, wherein the target event and the attribute values associated with the target event are received from an operator.
11. The method of claim 1, wherein the plurality of proximity limits are received from an operator.
12. A system for correlating event information, comprising:
at least one sensor operable to receive event information for a plurality of detected events wherein:
the event information for a particular detected event comprises a plurality of attributes associated with the particular detected event; and
the particular detected event is associated with at least one data packet in an enterprise network;
at least one processor operable to:
assign a plurality of attribute values to each detected event, the attribute values of each detected event defining a point in n-dimensional space;
receive a target event comprising a plurality of attributes wherein:
the target event is associated with at least one data packet that threatens the enterprise network;
the attributes of the target event are associated with attribute values; and
the attribute values of the target event define a target point in n-dimensional space;
receive a plurality of proximity limits that define a portion of n-dimensional space surrounding the target point; and
identify a plurality of detected events wherein the points defined by the attribute values of the identified detected events are within the portion of n-dimensional space defined by the proximity limits; and
at least one memory module operable to store the event information for each detected event in accordance with the attribute values assigned to that detected event.
13. The system of claim 12, further comprising a graphical user interface and wherein:
the processor is further operable to correlate the event information of the identified detected events with at least one attacker profile, the at least one attacker profile comprising a plurality of characteristics of an attacker of an enterprise network;
the memory module is further operable to store the event information of the identified detected events with the at least one attacker profile; and
the graphical user interface is operable to display to an operator the at least one attacker profile.
14. The system of claim 13, wherein the processor is further operable to generate a new attacker profile if the event information of the identified detected events does not correlate with at least one attacker profile, the new attacker profile based at least in part on the event information of the identified detected events.
15. The system of claim 13, wherein the processor is operable to perform the correlation using at least one Bayesian network or at least one neural network.
16. The system of claim 12, wherein:
each attribute value of a particular detected event corresponds to a particular attribute value of the target event; and
each proximity limit corresponds to a particular attribute value of the target event.
17. The system of claim 12, wherein:
a first attribute of the detected event is a source IP address;
a second attribute of the detected event is a destination IP address; and
a third attribute of the detected event is a time of detection.
18. The system of claim 12, wherein:
a first axis of the n-dimensional space corresponds to source IP addresses of the plurality of detected events; and
a second axis of the n-dimensional space corresponds to destination IP addresses of the plurality of detected events.
19. The system of claim 12, wherein the target event is an attack on at least one enterprise network, the attack detected by an intrusion detection system the target event is at least one of the following:
a computer virus;
a trojan horse;
a computer worm; and
at least a portion of malicious computer code.
20. The system of claim 12, wherein the target event and the attribute values associated with the target event are received from an operator.
21. The system of claim 12, wherein the plurality of proximity limits are received from an operator.
22. An apparatus for correlating event information, comprising:
at least one processor operable to:
receive event information for a plurality of detected events wherein:
the event information for a particular detected event comprises a plurality of attributes associated with the particular detected event; and
the particular detected event is associated with at least one data packet in an enterprise network;
assign a plurality of attribute values to each detected event, the attribute values of each detected event defining a point in n-dimensional space;
receive a target event comprising a plurality of attributes wherein:
the target event is associated with at least one data packet that threatens the enterprise network;
the attributes of the target event are associated with attribute values; and
the attribute values of the target event define a target point in n-dimensional space;
receive a plurality of proximity limits that define a portion of n-dimensional space surrounding the target point; and
identify a plurality of detected events wherein the points defined by the attribute values of the identified detected events are within the portion of n-dimensional space defined by the proximity limits; and
at least one memory module operable to store the event information for each detected event in accordance with the attribute values assigned to that detected event.
23. The apparatus of claim 22, further comprising a graphical user interface and wherein:
the processor is further operable to correlate the event information of the identified detected events with at least one attacker profile, the at least one attacker profile comprising a plurality of characteristics of an attacker of an enterprise network;
the memory module is further operable to store the event information of the identified detected events with the at least one attacker profile; and
the graphical user interface is operable to display to an operator the at least one attacker profile.
24. The apparatus of claim 23, wherein the processor is further operable to generate a new attacker profile if the event information of the identified detected events does not correlate with at least one attacker profile, the new attacker profile based at least in part on the event information of the identified detected events.
25. The apparatus of claim 23, wherein the processor is operable to perform the correlation using at least one Bayesian network or at least one neural network.
26. The apparatus of claim 22, wherein:
each attribute value of a particular detected event corresponds to a particular attribute value of the target event; and
each proximity limit corresponds to a particular attribute value of the target event.
27. The apparatus of claim 22, wherein:
a first attribute of the detected event is a source IP address;
a second attribute of the detected event is a destination IP address; and
a third attribute of the detected event is a time of detection.
28. The apparatus of claim 22, wherein:
a first axis of the n-dimensional space corresponds to source IP addresses of the plurality of detected events; and
a second axis of the n-dimensional space corresponds to destination IP addresses of the plurality of detected events.
29. The apparatus of claim 22, wherein the target event is at least one of the following:
a computer virus;
a trojan horse;
a computer worm; and
at least a portion of malicious computer code.
30. The apparatus of claim 22, wherein the target event and the attribute values associated with the target event are received from an operator.
31. The apparatus of claim 22, wherein the plurality of proximity limits are received from an operator.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A semiconductor device comprising a substrate and a thin-film transistor, a gate line layer and a source line layer which are supported by the substrate,
wherein the gate line layer includes a gate line and the thin-film transistor’s gate electrode,
the source line layer includes a source line and the thin-film transistor’s source and drain electrodes,
the thin-film transistor includes the gate electrode, a gate insulating layer formed over the gate electrode, a semiconductor layer stacked on the gate insulating layer, and the source and drain electrodes,
the semiconductor device further includes:
an interlevel insulating layer which is formed over the source and drain electrodes and which includes a first insulating layer that contacts at least with the surface of the drain electrode;
a first transparent conductive layer which is formed on the interlevel insulating layer and which has a first hole;
a dielectric layer which is formed on the first transparent conductive layer and which covers a side surface of the first hole of the first transparent conductive layer; and
a second transparent conductive layer formed over the dielectric layer so as to overlap with at least a portion of the first transparent conductive layer with the dielectric layer interposed between them, and
wherein the dielectric layer has a second hole and the first insulating layer has a third hole,
the interlevel insulating layer and the dielectric layer have a first contact hole, the sidewall of which includes respective side surfaces of the second and third holes, at least a portion of the side surface of the third hole being aligned with the side surface of the second hole,
the second transparent conductive layer contacts with the drain electrode inside the first contact hole, thereby forming a contact portion where the second transparent conductive layer and the drain electrode contact with each other, and
when viewed along a normal to the substrate, at least a part of the contact portion overlaps with the gate line layer.
2. The semiconductor device of claim 1, wherein the semiconductor layer is an oxide semiconductor layer.
3. The semiconductor device of claim 1, wherein
when viewed along a normal to the substrate, the contact portion overlaps in its entirety with the gate line layer.
4. The semiconductor device of claim 1, wherein the interlevel insulating layer further includes a second insulating layer which is arranged between the first insulating layer and the first transparent conductive layer, the first insulating layer is an inorganic insulating layer, and the second insulating layer is an organic insulating layer.
5. The semiconductor device of claim 4, wherein the second insulating layer has a fourth hole,
when viewed along a normal to the substrate, the outer edge of the second hole is located at least partially inside the outer edge of the fourth hole, and
at least a portion of the side surface of the fourth hole of the second insulating layer is covered with the dielectric layer.
6. The semiconductor device of claim 5, wherein when viewed along a normal to the substrate, the outer edge of the second hole is located in its entirety inside the outer edge of the fourth hole.
7. The semiconductor device of claim 1, further comprising a first connecting portion formed on the substrate,
wherein the gate line layer includes a first lower conductive layer,
the source line layer includes a first upper conductive layer formed in contact with the first lower conductive layer,
the first connecting portion includes: the first lower conductive layer; the first upper conductive layer; the interlevel insulating layer and the dielectric layer extended onto the first upper conductive layer; an upper transparent connecting layer formed on the dielectric layer out of the same conductive film as the second transparent conductive layer; and a lower transparent connecting layer formed between the interlevel insulating layer and the dielectric layer out of the same conductive film as the first transparent conductive layer, and
the interlevel insulating layer and the dielectric layer have a second contact hole, in which the upper transparent connecting layer contacts with a portion of the first upper conductive layer, and
the dielectric layer has a third contact hole, in which the upper transparent connecting layer contacts with a portion of the lower transparent connecting layer.
8. The semiconductor device of claim 7, wherein the dielectric layer has a fifth hole, the first insulating layer has a sixth hole,
the sidewall of the second contact hole includes respective side surfaces of the fifth and sixth holes, and at least a portion of the side surface of the sixth hole is aligned with the side surface of the fifth hole.
9. The semiconductor device of claim 1, further comprising a terminal portion formed on the substrate,
wherein the gate line layer includes a second lower conductive layer,
the source line layer includes a second upper conductive layer which in contact with the second lower conductive layer,
the terminal portion includes: the second lower conductive layer; the second upper conductive layer; the first insulating layer and the dielectric layer which are extended onto the second upper conductive layer; and an external connecting layer formed on the dielectric layer out of the same conductive film as the second transparent conductive layer, and
the first insulating layer and the dielectric layer have a fourth contact hole, the respective side surfaces of the first insulating layer and dielectric layer are aligned with each other on the sidewall of the fourth contact hole, and
the external connecting layer contacts with a portion of the second upper conductive layer in the fourth contact hole.
10. A semiconductor device comprising a substrate and a thin-film transistor, a gate line layer, a source line layer and a terminal portion supported by the substrate,
wherein the gate line layer includes a gate line, the thin-film transistor’s gate electrode and the terminal portion’s second lower conductive layer,
the source line layer includes a source line, the thin-film transistor’s source and drain electrodes, and a second upper conductive layer formed in contact with the second lower conductive layer,
the thin-film transistor includes the gate electrode, a gate insulating layer formed over the gate electrode, a semiconductor layer stacked on the gate insulating layer, and the source and drain electrodes,
the semiconductor device further includes:
an interlevel insulating layer which is formed over the source and drain electrodes and which includes a first insulating layer that contacts at least with the surface of the drain electrode;
a first transparent conductive layer which is formed on the interlevel insulating layer and which has a first hole;
a dielectric layer which is formed on the first transparent conductive layer and which covers a side surface of the first transparent conductive layer that is located closer to the first hole; and
a second transparent conductive layer formed over the dielectric layer so as to overlap with at least a portion of the first transparent conductive layer with the dielectric layer interposed between them,
the dielectric layer has a second hole and the first insulating layer has a third hole,
the interlevel insulating layer and the dielectric layer have a first contact hole, the sidewall of which includes respective side surfaces of the second and third holes, at least a portion of the side surface of the third hole being aligned with the side surface of the second hole,
the second transparent conductive layer contacts with the drain electrode inside the first contact hole, thereby forming a contact portion where the second transparent conductive layer and the drain electrode contact with each other,
when viewed along a normal to the substrate, at least a part of the contact portion overlaps with the gate line layer,
the terminal portion includes: the second lower conductive layer; the second upper conductive layer; the first insulating layer and the dielectric layer extended onto the second upper conductive layer; and an external connecting layer formed on the dielectric layer out of the same conductive film as the second transparent conductive layer, and
the first insulating layer and the dielectric layer have a fourth contact hole, the respective side surfaces of the first insulating layer and dielectric layer are aligned with each other on the sidewall of the fourth contact hole, and
the external connecting layer contacts with a portion of the second upper conductive layer in the fourth contact hole.
11. The semiconductor device of claim 1, further comprising a protective layer formed between the semiconductor layer and the source and drain electrodes so as to contact with at least a portion of the semiconductor layer to be a channel region.
12. The semiconductor device of claim 1, wherein when viewed along a normal to the substrate, at least a part of the contact portion overlaps with the gate line or the gate electrode.
13. A display device comprising:
the semiconductor device of claim 1;
a counter substrate which is arranged so as to face the semiconductor device; and
a liquid crystal layer which is arranged between the counter substrate and the semiconductor device,
wherein the display device includes a plurality of pixels which are arranged in a matrix pattern, and
the second transparent conductive layer is divided into multiple portions which are associated with respective pixels so that each said portion functions a pixel electrode.
14. The display device of claim 13, wherein the first transparent conductive layer covers each said pixel almost entirely.
15. The display device of claim 13, wherein the second transparent conductive layer has a plurality of holes cut as slits in each said pixel, and
the first transparent conductive layer is present at least under those holes and functions as a common electrode.
16. A method for fabricating a semiconductor device including a thin-film transistor, the method comprising the steps of:
(A) forming a thin-film transistor on a substrate by forming a gate line layer including a gate line and a gate electrode, forming a gate insulating layer on the gate electrode, forming a semiconductor layer on the gate insulating layer, and forming a source line layer including source and drain electrodes;
(B) forming an interlevel insulating layer which covers the thin-film transistor and which includes a first insulating layer that contacts at least with the drain electrode;
(C) forming a first transparent conductive layer with a first hole on the interlevel insulating layer;
(D) forming a dielectric layer on the first transparent conductive layer and inside the first hole;
(E) etching the dielectric layer and the first insulating layer simultaneously, thereby cutting a first contact hole that exposes a portion of the drain electrode, the side surface of the first hole being covered with the dielectric layer and being not exposed on the sidewall of the first contact hole; and
(F) forming a second transparent conductive layer which contacts with the drain electrode in the first contact hole on the dielectric layer and in the first contact hole,
wherein when viewed along a normal to the substrate, at least a part of a contact portion where the drain electrode and the second transparent conductive layer contact with each other in the first contact hole overlaps with the gate line layer.
17. The method of claim 16, wherein the interlevel insulating layer includes the first insulating layer and a second insulating layer,
the step (B) includes the steps of: forming the first insulating layer out of an inorganic insulating film; forming the second insulating layer out of an organic insulating film on the first insulating layer; and cutting a fourth hole through the second insulating layer,
in the step (D), the dielectric layer is formed on the first transparent conductive layer and inside the first and fourth holes, and
in the step (E), the etching is carried out so that the dielectric layer and the first insulating layer are etched but the second insulating layer is not etched.
18. The method of claim 16, wherein the semiconductor layer is an oxide semiconductor layer.
19. The semiconductor device of claim 2, wherein the oxide semiconductor layer is an IGZO layer.
20. The method of claim 18, wherein the oxide semiconductor layer is an IGZO layer.