User, process, and application tracking in an intrusion detection system
OwnerPhillip Andrew Porras, Martin Wayne Fonginventors
Life of this patent
Estimating the term…
Abstract
Preferred embodiments combine audit records with other relevant information to identify and track the users, processes or applications responsible for an attack. Information that identifies a user, process, or application may be associated with subsequent audit records related to the user or process session; this information may also be associated with IDS alerts related to the session. By reliably identifying the source of user and process sessions, the preferred embodiments make it possible to selectively target the sessions and applications that are related to an intrusion or attack.
Claims20
In a computer system including operating system software that generates audit records, a method for tracking in real time a source of a user or process session comprising the steps of:
- obtaining the source's IP address;
- obtaining a session identifier from the operating system audit records;
- and
- associating the source's IP address with the session identifier.
In a computer system including operating system software that generates audit records and in which a process uses an execution system call to request invocation of an application, a method for tracking in real time the application's path name comprising the steps of:
- observing the execution system call;
- obtaining a full path name of the application as specified within an argument list of the execution system call;
- obtaining from an execution system call audit record a process identifier associated with the execution system call;
- and
- associating the application path name with the process identifier.
In a computer system including operating system software that generates audit records, a method for tracking in real time a remote user during a session initiated by the remote user, the method comprising the steps of:
- obtaining the remote user's IP address;
- obtaining a process identifier associated with the session from an audit record;
- and
- associating the process identifier with the IP address.
In an intrusion detection system in which alerts are generated in response to a suspicious activity, a method for tracking a source of the suspicious activity comprising the steps of:
- obtaining the source's IP address;
- and
- associating the source's IP address with alerts related to the suspicious activity.
In an intrusion detection system in which alerts are generated in response to a suspicious process, a method for tracking a path name of an application invoked by the suspicious process, the method comprising the steps of:
- observing an execution system call used by the suspicious process to invoke the application;
- obtaining a full path name of the application as specified within an argument list of the execution system call;
- and
- associating the path name with alerts related to the suspicious process.
Dependencies are inferred from the claim text.