Network-based alert management

Details Network-based alert management Network-based alert management

2000-07-25

2004-03-09

Heckler, Thomas M. (Department: 2185)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

C709S224000

Reexamination Certificate

active

06704874

ABSTRACT:

TECHNICAL FIELD
This invention relates to network-based alert management.
BACKGROUND
Computer networks may include one or more digital security monitors or sensors that automatically analyze traffic on the network to identify potentially suspicious activity. The sensors may be implemented in either software or hardware. Monitors may focus on security monitoring and/or on fault analysis.
Upon detecting suspicious activity, the sensors typically generate some kind of digital alert message or signal, and attempt to bring that message to the attention of network I/S managers whose responsibility it is to respond and react in an appropriate defensive manner against hostile digital attacks or to recover quickly from catastrophic failures.
SUMMARY
In an aspect, the invention features a method of managing alerts in a network including receiving alerts from network sensors, consolidating the alerts that are indicative of a common incident and generating output reflecting the consolidated alerts. Alerts are formatted into a standard alert format by the network sensors or an input receiving logic of an alert management system, or a combination of both. The alert format may be selected from a group of formats including IDIP, SNMP, HP OpenView, Attach Specification CIDF and GIDO. Alerts may be tagged with corresponding significance scores where the significance scores may include a priority measure for the corresponding alerts. The priority measure may be derived from a priority map that can be automatically generated or dynamically adjusted. The priority map may contain relative priority scores for resource availability, resource integrity and resource confidentiality.
In another aspect, the invention features a method of managing alerts including receiving alerts from a number of network sensors, filtering the alerts to produce one or more internal reports and consolidating the internal reports that are indicative of a common incident-to-incident report. Related incident reports may be correlated. The network sensors may format the received alerts. Filtering includes deleting alerts that do not match specified rules. The filtering rules may be dynamically adjusted. Filtering may also include tagging alerts with a significance score that can indicate a priority measure and relevance measure.
Among the advantages of the invention may be one or more of the following.
The alert manager can be tailored to a particular application by dynamically adding or removing data connections to sources of incoming alerts, and by dynamically varying the process modules, user filter clauses, priority clauses, topology clauses, and output. Process modules may be added, modified, and deleted while the alert manager is active. Output may be configured for a variety of graphical user interfaces (GUIs). In embodiments, useful, for example, for each category of attack the user can define different priorities as related to denial of service, security, and integrity.
Process modules are logical entities within the alert manager that can respond to an incoming alert in real time and virtual time, i.e., data within an application can cause the alert manager to respond.
The alert manager can act as a sender or receiver. In embodiments, useful, for example, the alert manager can listen to a specific port in a network or connect to an external process on a host computer and process its data.
The alert management process can be an interpretive process allowing the incorporation of new process clauses and new rules.
The alert management process may provide a full solution for managing a diverse suite of multiparty security and fault monitoring services. Example targets of the alert management process are heterogeneous network computing environments that are subject to some perceived operational requirements for confidentiality, integrity, or availability. Inserted within the network are a suite of potential multiparty security and fault monitoring services such as intrusion detection systems, firewalls, security scanners, virus protection software, network management probes, load balancers, or network service appliances. The alert management process provides alert distributions within the monitored network through which security alerts, fault reports, and performance logs may be collected, processed and distributed to remote processing stations (e.g., Security Data Centers, Administrative Help Desks, MIS stations). Combined data produced by the security, fault, or performance monitoring services provide these remote processing stations detailed insight into the security posture, and more broadly the overall health, of the monitored network.
Value may be added to the content delivered by the alert management process to the remote processing station(s) that subscribe to alerts in the form of an advanced alert processing chain. For example, alerts received by the alert management process and prepared for forwarding to a remote processing station, may be filtered using a dynamically downloadable message criteria specification.
In a further aspect, alerts may be tagged with a priority indication flag formulated against the remote processing station's alert processing policy and tagged with a relevance flag that indicates the likely severity of the attack with respect to the known internal topology of the monitored network.
In a further aspect of the invention, alerts may be aggregated (or consolidated) into single incident reports when found to be associated with a series of equivalent alerts produced by the same sensor or by other sensors, based upon equivalence criteria, and the incident reports forwarded to the remote processing station.
The alert management system is configurable with respect to the data needs and policies specified by the remote processing station. These processes are customizable on a per remote processing station basis. For example, two remote processing stations may in parallel subscribe to alerts from the alert management process, with each having individual filtering policies, prioritization schemes, and so forth, applied to the alert/incident reports it receives.
Other features and advantages will become apparent from the following description and from the claims.


REFERENCES:
patent: 4672609 (1987-06-01), Humphrey et al.
patent: 4773028 (1988-09-01), Tallman
patent: 5210704 (1993-05-01), Husseiny
patent: 5440723 (1995-08-01), Arnold et al.
patent: 5539659 (1996-07-01), McKee et al.
patent: 5557742 (1996-09-01), Smaha et al.
patent: 5706210 (1998-01-01), Kumano et al.
patent: 5748098 (1998-05-01), Grace
patent: 5790799 (1998-08-01), Mogul
patent: 5878420 (1999-03-01), de la Salle
patent: 5919258 (1999-07-01), Kayashima et al.
patent: 5922051 (1999-07-01), Sidey
patent: 5940591 (1999-08-01), Boyle et al.
patent: 5974237 (1999-10-01), Shurmer et al.
patent: 5974457 (1999-10-01), Waclawshy et al.
patent: 5991881 (1999-11-01), Conklin et al.
patent: 6009467 (1999-12-01), Ratcliff et al.
patent: 6052709 (2000-04-01), Paul
patent: 6070244 (2000-05-01), Orchier et al.
patent: 6144961 (2000-11-01), de la Salle
patent: 6396845 (2002-05-01), Sugita
patent: 6453346 (2002-09-01), Garg et al.
patent: 6460141 (2002-10-01), Olden
patent: 6519703 (2003-02-01), Joyce
patent: 2002/0032717 (2002-03-01), Malan et al.
patent: 2002/0032793 (2002-03-01), Malan et al.
patent: 2002/0032880 (2002-03-01), Poletto et al.
patent: 2002/0035698 (2002-03-01), Malan et al.
patent: 2002/0138753 (2002-09-01), Munson
patent: 2002/0144156 (2002-10-01), Copeland, III
patent: 2003/0037136 (2003-02-01), Labovitz et al.
patent: 99/13427 (1999-03-01), None
patent: 99/57626 (1999-11-01), None
patent: 00/10278 (2000-02-01), None
patent: 00/25214 (2000-05-01), None
patent: 00/25527 (2000-05-01), None
patent: 00/34867 (2000-06-01), None
patent: 02/101516 (2002-12-01), None
Debar, et al., “Towards a Taxonomy of Intrusion-Detection Systems,” Computer Networks 31 (1999), 805-822.
Garvey, et al, “An Inference Technique for Integrating Knowledge from Disparate Sources,” Proc. IJCAI, Vancouver, B.C., Aug., 1981, 319-325.
Kaven, “The Digital D

Affiliated with

Also associated with

Rating

Network-based alert management does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Network-based alert management, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Network-based alert management will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3214097