Intrusion event filtering and generic attack signatures
AssigneeInternational Business Machines Corporation
InventorsDavid Aro Bruton III, Patricia Jakubik, Patrick Michael LiVecchi, Linwood Hugh Overby JR.
Life of this patent
Estimating the term…
Abstract
Improvements in intrusion detection are disclosed by providing intrusion event filtering and/or generic attack signature processing. These services may be integrated into a system or server that is the potential target of attack, or alternatively may be implemented in a network device. Filtering may be provided using sensitivity levels and suspicion levels. Generic attack signatures describe relatively broad classes of intrusions. Intrusion detection policy information may be used to direct the actions to be taken upon detecting an attack.
Claims44
A method of improving intrusion detection in a computing network, comprising steps of:
- defining intrusion suspicion levels for inbound communications destined for a computing device on the computing network;
- and
- using the defined intrusion suspicion levels to determine if a particular inbound communication destined for the computing device should be treated as an intrusion event.
A method for improving intrusion detection in a computing network, comprising steps of:
- classifying an inbound communication destined for a computing device on the computing network as to an intrusion class which is applicable to the inbound communication;
- and
- determining whether the applicable intrusion class has one or more associated intrusion detection policy specifications, and if so, performing actions specified in the one or more associated intrusion detection policy specifications.
A system for improving intrusion detection in a computing network, comprising:
- means for defining intrusion suspicion levels for inbound communications destined for a computing device on the computing network;
- and
- means for using the defined intrusion suspicion levels to determine if a particular inbound communication destined for the computing device should be treated as an intrusion event.
A system for improving intrusion detection in a computing network, comprising:
- means for classifying an inbound communication destined for a computing device on the computing network as to an intrusion class which is applicable to the inbound communication;
- and
- means for determining whether the applicable intrusion class has one or more associated intrusion detection policy specifications, and if so, performing actions specified in the one or more associated intrusion detection policy specifications.
A computer program product for improving intrusion detection in a computing network, the computer program product embodied on one or more computer-readable media and comprising:
- computer-readable program code means for defining intrusion suspicion levels for inbound communications destined for a computing device on the computing network;
- and
- computer-readable program code means for using the defined intrusion suspicion levels to determine if a particular inbound communication destined for the computing device should be treated as an intrusion event.
A computer program product for improving intrusion detection in a computing network, the computer program product embodied on one or more computer-readable media and comprising:
- computer-readable program code means for classifying an inbound communication destined for a computing device on the computing network as to an intrusion class which is applicable to the inbound communication;
- and
- computer-readable program code means for determining whether the applicable intrusion class has one or more associated intrusion detection policy specifications, and if so, performing actions specified in the one or more associated intrusion detection policy specifications.
Dependencies are inferred from the claim text.