Back to results
US 11,637,842 B2Granted
Detection of security intrusion in a computing system
AssigneeHewlett Packard Enterprise Development LP
InventorSuhas Shivanna
Life of this patent
Estimating the term…
Abstract
Some examples relate to detecting a security intrusion in a computer system. In an example, the detection of the security intrusion may be performed by analyzing a plurality of log records generated corresponding to a plurality of milestone actions performed during invocation of an operation on the computing system, based on a rule-set. Upon detection of a deviation in the plurality of log record from the rule-set, a security action is performed.
Claims20
A method comprising:
- storing a plurality of log records, by a first processor of a management system of a computing system, in a secure log store hosted in the management system, wherein the plurality of log records are generated corresponding to a plurality of milestone actions performed during invocation of an operation on the management system, wherein the computing system comprises a second processor separate from the first processor to execute an operating system of the computing system, the first processor to monitor and manage the computing system, the invocation of the operation comprises an authentication process to access the management system, the plurality of log records representing a first plurality of actions of the authentication process and a first order of the first plurality of actions, and a given action of the first plurality of actions comprises generating a session identifier;
- monitoring, by the first processor, the plurality of log records stored in the secure log store;
- identifying, by the first processor, whether the operation is a security sensitive operation, wherein the security sensitive operation belongs to a predefined set of a plurality of operations that are performed on the management system;
- in response of identifying that the operation is the security sensitive operation, analyzing, by the first processor, the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system, wherein the rule-set comprises a second plurality of actions for the authentication process and a second order for the authentication process, and the analyzing comprises comparing the second plurality of actions and the second order to the first plurality of actions and the first order;
- and
- performing a security action, by the first processor, in response of detecting the security intrusion.
3 more elements
A non-transitory machine-readable storage medium encoded with instructions executable by a first processor of a management system of a computing system, wherein the computing system comprises a second processor separate from the first processor to execute an operating system of the computing system, the first processor to manage and monitor the computing system, and the instructions, when executed by the first processor, cause the first processor to:
- store a plurality of log records in a secure log store hosted in the management system;
- wherein the plurality of log records are generated corresponding to a plurality of milestone actions performed during invocation of an operation on the management system, the invocation of the operation comprises an authentication process to access the management system, and the invocation of the operation comprises an invocation process to invoke the operation on the management system;
- monitor the plurality of log records stored in the secure log store;
- identify whether the operation is a security sensitive operation that belongs to a predefined set of a plurality of operations that are performed on the management system;
- in response to identifying that the operation is the security sensitive operation, analyze the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system, wherein the rule-set comprises a first plurality of actions and an order for the first plurality of actions for the authentication process, the rule-set comprises a second plurality of actions and an order for the second plurality of actions for the invocation process, and analyzing the plurality of log records comprises:
- detecting, based on the rule-set and the plurality of log records, an anomaly in at least one of the authentication process or the invocation process;
- and
- responsive to detecting the anomaly, detecting the security intrusion;
- and
- perform a security action in response of detecting the security intrusion.
7 more elements
A computing system comprising:
- at least one central processing unit to execute an operating system;
- a memory;
- and
- an intrusion detection engine that is separate from the at least one central processing unit, the intrusion detection engine comprising:
- a non-transitory machine-readable storage medium encoded with instructions executable by a processor separate from the at least one central processing unit to manage and monitor the computing system as part of a management system of the computing system, wherein the instructions, when executed by the processor, cause the processor to:
- receive a plurality of log records generated corresponding to a plurality of milestone actions performed during invocation of an operation on a management system of the computing system, wherein the invocation of the operation comprises an authentication process to access the management system, the plurality of log records representing a first plurality of actions of the authentication process and a first order of the first plurality of actions, and a given action of the first plurality of actions comprises generating a session identifier;
- store the plurality of log records in a secure log store hosted in a management system of the computing system, wherein the secure log store is separate from a log repository of the management system;
- and
- monitor the plurality of log records stored in the secure log store;
- identify whether the operation is a security sensitive operation that belongs to a predefined set of a plurality of operations that are performed on the management system;
- in response of identifying that the operation is the security sensitive operation, analyze the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system, wherein the rule-set comprises a second plurality of actions for the authentication process and a second order for the authentication process, and the analyzing comprises comparing the second plurality of actions and the second order to the first plurality of actions and the first order;
- and
- perform a security action in response of detecting the security intrusion.
10 more elements
Dependencies are inferred from the claim text.