Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1998-05-20
2001-08-14
Hua, Ly V. (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S152000
Reexamination Certificate
active
06275942
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates generally to computer network security systems, and more particularly to providing a system, method and computer program product for providing flexible and automatic responses to instances of computer system misuse.
2. Related Art
Given the current explosion in the use of and reliance on computers and computer networks (especially the global Internet), computer security is becoming a major concern of corporations, organizations, individuals and other computer users. Today, for example, many organizations are reliant on computers and computer networks to link remote offices, share data and other resources among employees within an office, communicate with customers via electronic mail, reach new customers via electronic commerce, and to provide information by operating World Wide Web pages that are accessible via the Internet. This reliance on computer networks has a downside in that sensitive data now resides on computer network servers which, left unprotected, can potentially cost an organization millions of dollars if misused.
Computer misuse generally involves the unauthorized access of an organization's computers (or resources connected to the communication network) from outside “hackers,” or can involve employees inside the organization accessing information or other resources without authorization. That is, an instance of computer misuse can take the form of an outside intrusion or an inside unauthorized access. Moreover, misuse can not only take the form of unauthorized access of an organization's computers (and thus data) but also the destruction (i.e., deletion) of data. Such destruction of vital data (e.g., customer databases) can also be costly to an organization. In essence, a misuse is any activity that would be deemed unacceptable if it were known to the party responsible for the security of the particular computer network in question.
With the problem of computer misuse rising, a new computer security industry has developed and blossomed over the past several years. Products such as virus detectors, firewalls, and virtual private networks (VPNs) have come into existence. Furthermore, there exist several authentication, network management, digital certificate, and intrusion detection software on the market all aimed at computer security.
Of note, however, are the several forms of intrusion detection products now available. Intrusion detection involves monitoring a computing environment, looking for unauthorized users or those authorized users who are misbehaving (e.g., a disgruntled employee deleting sensitive data). Generally, these systems incorporate state table, anomaly detection and/or expert system techniques to detect patterns (commonly referred to as “signatures” or “footprints”) of misuse. A signature is simply a set of events (states of a computer) and a set of instructions that transition between events that define a misuse. For example, a user who unsuccessfully attempts to login three times, and then achieves a successful login, may define the signature (a collection of events and transitions) of an outside hacker attempting to invade an organization's network.
The various intrusion detection products typically make use of a misuse engine software module that is the “heart” of the detection system and behaves like a security camera for the network. An exemplary misuse engine, as part of an intrusion detection system, is described in U.S. Pat. No. 5,557,742 issued to Smaha et al., which is incorporated herein by reference in its entirety.
One shortcoming of today's intrusion detection systems is that once an intrusion (i.e., a signature) is detected, the response is usually “hard coded.” That is, the response to a particular misuse is usually determined and defined when the engine is installed in a particular computing environment. Thus, once the misuse engine detects a problem, the response is always fixed. The conventional responses to detected misuses have been to contact a system administrator via electronic mail, telephone or pager, or simply log the detected misuse into a log file for later analysis. These systems are inflexible and do not provide for a true real-time response to a misuse of an organization's computer network. They also do not attempt to counter or fix the problems arising from the detected misuse. Further, they do not provide a flexible upgrade path to take advantage of new technologies, or to adopt to evolving needs of the computer user.
Therefore, given the above-described limitations, what is needed are a system and method for automatic response to computer system misuse. Further, what is needed is a system, method and computer program product that allow new automated response modules to be installed after the initial deployment of the intrusion detection system. In other words, what is needed is a flexible, true real-time reaction to a detected misuse rather than or in addition to an alarm (i.e., a simple notification).
SUMMARY OF THE INVENTION
The present invention is directed to a system, method and computer program product for automatic response to computer system misuse using active response modules (ARMs). The method for automatically responding to a computer misuse includes the steps of defining a plurality of ARMs to process instances of computer misuse, receiving an instance of misuse from an intrusion detection system (the instance of the misuse having been detected by the misuse engine) and identifying ARMs associated with and activated for the detected computer misuse. The method then, for each of the identified ARMs, collects pertinent data from the misuse engine and invokes each of the identified ARMs with the pertinent data.
The system includes a data processing element, a misuse engine that is part of an intrusion detection system, and a plurality of ARMs each having means for instructing the data processing element to perform an action or series of actions in response to being invoked by the misuse engine. The misuse engine includes means for detecting a misuse, means for identifying any of the ARMs associated with and active for the misuse, and means for invoking the identified ARMs to thereby respond to the misuse.
One advantage of the present invention is that it provides automated active response modules (ARMs) that can respond in real-time to instances of computer misuse detected by a misuse engine.
Another advantage of the present invention is that the ARMs provide flexible response to instances of computer misuse detected by a misuse engine. New ARMs may be defined and deployed in a “plug and play” manner into an existing computing environment that utilizes any type of intrusion detection system. At any time, any of the ARMs may be associated with and activated for any given instance of misuse.
Another advantage of the present invention is that the flexibility of the ARMs allows compatibility with several different types of computer network elements. Any time a computer environment adds, removes, or changes a particular network element, the ARMs may be modified accordingly to ensure compatibility.
Yet another advantage of the present invention is that different ARMs may be created and installed as add-ons into any existing computing environment containing a variety of network elements manufactured by different vendors. Several different ARMs may be pre-configured to communicate (i.e., “plug”) into different vendors' network elements.
Further features and advantages of the invention as well as the structure and operation of various embodiments of the present invention are described in detail below with reference to the accompanying figures.
REFERENCES:
patent: 5414833 (1995-05-01), Hershey et al.
patent: 5557742 (1996-09-01), Smaha et al.
patent: 5623600 (1997-04-01), Ji et al.
patent: 5892900 (1999-04-01), Ginter et al.
patent: 5917912 (1999-06-01), Ginter et al.
J. Alves-Foss, “An Overview of SNIF: A Tool for Surveying Network Information Flow”, Feb. 16, 1995, pp. 94-101.
Bernhard Thomas
Escamilla Terry
Leddy William
Letsinger Richard
Marks Crosby
Hua Ly V.
Network Associates, Inc.
Pennie & Edmonds LLP
LandOfFree
System, method and computer program product for automatic... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System, method and computer program product for automatic..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System, method and computer program product for automatic... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2537766