Method and system for analyzing and addressing alarms from network intrusion detection systems
OwnerCraig H. Rowland, Nathan M. Cohen +4inventors
InventorsCraig H. Rowland, Nathan M. Cohen, Steven D. Shanklin, Steve R. Snapp, Stephen B. Campos, Stephen A. Burke
Life of this patent
Estimating the term…
Abstract
According to one embodiment of the invention, a method for analyzing and addressing alarms from network intrusion detection systems includes receiving an alarm indicating an attack on a target host may have occurred, automatically accessing the target host in response to the alarm, and identifying the presence of the attack on the target host.
Claims41
A method for analyzing and addressing alarms from network intrusion detection systems, comprising:
- receiving an alarm indicating an attack on a target host may have occurred;
- automatically accessing the target host in response to the alarm;
- and
- automatically identifying the presence of the attack on the target host.
A method for analyzing and addressing alarms from network intrusion detection systems, comprising:
- receiving an alarm indicating an attack on a target host may have occurred;
- automatically accessing a storage location in response to the alarm;
- determining whether investigation data for the target host already exists in the storage location;
- if the investigation data exists and the investigation data is still valid, then accessing the investigation data;
- and
- if the investigation data does not exist or if the investigation data exists but is invalid, then:
- automatically accessing the target host;
- identifying the presence of the attack on the target host;
- identifying whether the attack was successful;
- and
- identifying an audit trail of the attack on the target host.
A system for analyzing and addressing alarms from network intrusion detection systems, comprising:
- a network intrusion detection system (NIDS) operable to transmit an alarm indicating an attack on a target host may have occurred;
- a software program embodied in a computer readable medium, the software program, when executed by a processor, operable to:
- receive the alarm;
- automatically access the target host in response to the alarm;
- and
- automatically identify the presence of the attack on the target host.
A system for analyzing and addressing alarms from network intrusion detection systems, comprising:
- means for receiving an alarm indicating an attack on a target host may have occurred;
- means for automatically accessing the target host in response to the alarm;
- and
- means for automatically identifying the presence of the attack on the target host.
Dependencies are inferred from the claim text.