US 10,122,744 B2Granted

Security violation assessment tool to compare new violation with existing violation

AssigneeBank of America Corporation

InventorSasidhar Purushothaman

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method comprises receiving a notification of a new system violation and classifying, based on characteristics of the new system violation, the new system violation as one or more of: an access violation; a configurational violation; an unauthorized modification; a usage violation; and an unsecured surface violation. The method also comprises comparing the new system violation in combination with one or more of a plurality of existing system violations to a plurality of entries and determining, based on the comparison of the new system violation and the one or more plurality of existing system violations to the plurality of entries, whether the new system violation threatens the system.

Claims9

Dependent claims

A security violation assessment tool comprising:

a memory configured to store:
a plurality of entries, wherein each entry comprises:
a classification of one or more system violations, wherein each system violation comprises a deviation from a baseline, the baseline being assigned to a specific user of a system;
an indication of whether the one or more system violations is a threat to the system, wherein the threat to the system is one or more of:
a loss of confidentiality of the system;
a loss of integrity of the system;
a loss of availability of the system;
a loss of accountability of the system;
a damage to a reputation of the system;
a non-compliance issue;
and
a violation of privacy;
and
an identification of one or more components of the system threatened by the one or more system violations;
and
a plurality of existing system violations, wherein each existing system violation indicates:
a previous deviation from a baseline and comprises at least a classification of the existing system violation;
and
an identification of one or more components threatened by the existing system violation;
an identification engine configured to:
receive a notification of a new system violation;
classify, based on characteristics of the new system violation, the new system violation as one or more of:
an access violation;
a configurational violation;
an unauthorized modification;
a usage violation;
and
an unsecured surface violation;
and
identify a component of the system threatened by the new violation, wherein the threatened component is part of at least:
an application stack of the system;
a middleware stack of the system;
a database stack of the system;
an operating system stack of the system;
a hardware stack of the system;
and
a network stack of the system;
an evaluation engine configured to:
compare the new system violation in combination with one or more of the plurality of existing system violations to the plurality of entries;
and
determine, based on the comparison of the new system violation and the one or more plurality of existing system violations to the plurality of entries, whether the new system violation threatens the system;
and
a notification engine configured to flag for review the new system violation in combination with the one or more of the plurality of existing system violations in response to a determination that the new system violation in combination with the one or more of the plurality of existing system violations threatens the system.

40 more elements

A method comprising:

receiving a notification of a new system violation;
classifying, based on characteristics of the new system violation, the new system violation as one or more of:
an access violation;
a configurational violation;
an unauthorized modification;
a usage violation;
and
an unsecured surface violation;
identifying a component of a system threatened by the new violation, wherein the threatened component is part of at least:
an application stack of the system;
a middleware stack of the system;
a database stack of the system;
an operating system stack of the system;
a hardware stack of the system;
and
a network stack of the system;
comparing the new system violation in combination with one or more of a plurality of existing system violations to a plurality of entries, wherein:
each of the plurality of existing system violations indicates:
a previous deviation from a baseline and comprises at least a classification of the existing system violation;
and
an identification of one or more components threatened by the existing system violation;
and
each of the plurality of entries comprises at least:
a classification of one or more system violations, wherein each system violation comprises a deviation from a baseline, the baseline being assigned to a specific user of the system;
an indication of whether the one or more system violations is a threat to the system, wherein the threat to the system is one or more of:
a loss of confidentiality of the system;
a loss of integrity of the system;
a loss of availability of the system;
a loss of accountability of the system;
a damage to a reputation of the system;
a non-compliance issue;
and
a violation of privacy;
and
an identification of one or more components of the system threatened by the one or more system violations;
and
determining, based on the comparison of the new system violation and the one or more plurality of existing system violations to the plurality of entries, whether the new system violation threatens the system;
and
flagging for review the new system violation in combination with the one or more of the plurality of existing system violations in response to a determination that the new system violation in combination with the one or more of the plurality of existing system violations threatens the system.

36 more elements

One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

receive a notification of a new system violation;
classify, based on characteristics of the new system violation, the new system violation as one or more of:
an access violation;
a configurational violation;
an unauthorized modification;
a usage violation;
and
an unsecured surface violation;
identify a component of a system threatened by the new violation, wherein the threatened component is part of at least:
an application stack of the system;
a middleware stack of the system;
a database stack of the system;
an operating system stack of the system;
a hardware stack of the system;
and
a network stack of the system;
compare the new system violation in combination with one or more of a plurality of existing system violations to a plurality of entries, wherein:
each of the plurality of existing system violations indicates:
a previous deviation from a baseline and comprises at least a classification of the existing system violation;
and
an identification of one or more components threatened by the existing system violation;
each of the plurality of entries comprises at least:
a classification of one or more system violations, wherein each system violation comprises a deviation from a baseline, the baseline being assigned to a specific user of the system;
and
an indication of whether the one or more system violations is a threat to the system, wherein the threat to the system is one or more of:
a loss of confidentiality of the system;
a loss of integrity of the system;
a loss of availability of the system;
a loss of accountability of the system;
a damage to a reputation of the system;
a non-compliance issue;
and
a violation of privacy;
and
an identification of one or more components of the system threatened by the one or more system violations;
determine, based on the comparison of the new system violation and the one or more plurality of existing system violations to the plurality of entries, whether the new system violation threatens the system;
and
flag for review the new system violation in combination with the one or more of the plurality of existing system violations in response to a determination that the new system violation in combination with the one or more of the plurality of existing system violations threatens the system.

35 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/345,072Filed 7 Nov 2016
Published: US 2018/0131709 A110 May 2018
Granted: 6 Nov 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general

Family

US 2018/0131709 A1Pre-grant publication · published 10 May 2018
US 10,122,744 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key