Back to results
US 2004/0111638 A1Published application
Rule-based network survivability framework
OwnerSatyendra Yadav, Nilesh M. Bhideinventors
Life of this patent
Estimating the term…
Abstract
The present disclosure relates to the survivability of a network system and, more particularly, to a multi-tiered network intrusion detection and response system.
Claims32
1:
- A hierarchical system comprising:
- at least one network sensor device (NSD) to monitor a behaviour of a network and perform a first action based at least in part upon a first set of rules;
- at least one network operating center (NOC) to at least process events received from the at least one network sensor device;
- and
- at least one system operating center (SOC) to at least
- create a second set of rules and
- distribute the second set of rules to selected ones of the at least one network sensor device or the at least one network operating center.
4 more elements
2:
- The hierarchal system of claim 1, wherein
- the at least one network sensor device, the at least one network operating center, and the at least one system operating center are arranged in a tiered fashion;
- the at least one network sensor device occupies the lowest tier of the hierarchical arrangement;
- and
- the at least one system operating center occupies the highest tier of the hierarchical arrangement.
2 more elements
3:
- The system of claim 1, wherein the network sensor device includes:
- a network interface to facilitate the monitoring of the behaviour of a network;
- a storage medium to store a first set of rules;
- and
- a rule engine to
- detect a first adverse network condition utilizing, at least in part, the first set of rules;
- and
- performing a first action based, at least in part, upon the first adverse network condition and the first set of rules.
5 more elements
4:
- The system of claim 1, wherein the first action performed by the rule engine includes at least one of the following:
- logging information pertaining to the first adverse network condition to a file;
- forwarding data to a second network sensor device;
- transmitting an instruction or rule to a second network sensor device;
- transmitting a request for data to second network sensor device;
- ignoring the first adverse network condition;
- altering an internal state of the rules engine;
- and
- altering the first set of rules utilized by the network sensor device.
6 more elements
5:
- The system of claim 1, wherein the at least one network sensor device is capable of
- receiving the second set of rules;
- and
- updating the first set of rules utilizing the second set of rules.
1 more element
6:
- The system of claim 1, wherein the network operating center includes a network sensor device.
7:
- The system of claim 1, wherein the network operating center is capable of
- receiving events from the at least one network sensor device;
- filtering the events utilizing a third set of rules;
- and
- reporting at least one event to the system operating center.
2 more elements
8:
- The system of claim 7, wherein the network operating center is capable of
- determining a second action to perform based on the third set of rules;
- and
- transmitting a fourth set of rules to the network sensor device;
- and wherein the NSD is capable of, during operation,
- receiving the fourth set of rules;
- updating the first set of rules utilizing the fourth set of rules.
4 more elements
9:
- The system of claim 8, wherein the network sensor device is capable of updating the first set of rules utilizing at least one of the following:
- modifying the first set of rules as instructed by the fourth set of rules;
- replacing the first set of rules with the fourth set of rules;
- and
- appending the fourth set of rules to the first set of rules.
2 more elements
10:
- The system of claim 8, wherein the network operating center is capable of
- transmitting a fourth set of rules to a first network sensor device;
- and
- transmitting a fifth set of rules to a second network sensor device.
1 more element
11:
- The system of claim 8, wherein the system operating center is capable of
- receiving a report from the at least one network operating center;
- and
- transmitting the second set of rules in response to the received report.
1 more element
12:
- The system of claim 11, wherein the system operating center is capable of
- transmitting the second set of rules to at least one network sensor device.
13:
- The system of claim 11, wherein the sensor operating center includes a network sensor device.
14:
- The system of claim 13, wherein the sensor operating center is capable of dynamically creating the second set of rules utilizing a third set of rules.
15:
- An apparatus comprising:
- a network interface to facilitate the monitoring of the behaviour of a network;
- a memory to store a first set of rules;
- and
- a rule engine to
- detect a first adverse network condition utilizing, at least in part, the first set of rules;
- and
- perform a first action based, at least in part, upon the first adverse network condition and the first set of rules.
5 more elements
16:
- The apparatus of claim 15, wherein the first action performed by the rule engine includes at least one of the following:
- logging information pertaining to the first adverse network condition to a file;
- forwarding data to a second network sensor device;
- transmitting an instruction or rule to a second network sensor device;
- transmitting a request for data to second network sensor device;
- ignoring the first adverse network condition;
- altering an internal state of the rules engine;
- and
- altering the first set of rules utilized by the network sensor device.
6 more elements
17:
- The apparatus of claim 15, wherein the rule engine is capable of
- receiving a second set of rules;
- and
- updating the first set of rules utilizing the second set of rules.
1 more element
18:
- The apparatus of claim 17, wherein the rule engine is capable of
- receiving events from at least one network sensor device;
- filtering the events utilizing the first set of rules;
- and
- reporting at least one event to a system operating center.
2 more elements
19:
- The apparatus of claim 17, wherein the rule engine is capable of dynamically creating a third set of rules utilizing the first set of rules.
20:
- The apparatus of claim 19, wherein the rule engine is capable of monitoring a behaviour of a network.
21:
- The apparatus of claim 20, wherein the rule engine is capable of monitoring at least one of the following:
- the state of a computer;
- an amount of computer processor usage;
- an amount of storage space available to a computer;
- traffic on a network;
- and
- the available bandwidth of a network.
4 more elements
22:
- The apparatus of claim 21, wherein the set of rules includes rules for generating an event as a result of at least one of the following network attacks:
- a network identify spoofing attack;
- a denial-of-service attack;
- a password-based attack;
- a data modification attack;
- a man-in-the-middle attack;
- a worm attack;
- a compromised key attack;
- and
- an application-layer attack.
7 more elements
23:
- A method of utilizing a first network intrusion detection device (NIDD) that is part of a network intrusion detection system (NIDS) that is arranged in a hierarchal fashion comprising:
- monitoring a behaviour of a network;
- detecting a first adverse network condition utilizing, at least in part, a first set of rules;
- performing a first action to facilitate attempting to maintain the survivability of the network;
- and
- dynamically changing the first set of rules based, at least in part, upon the behaviour of the network.
3 more elements
24:
- The method of claim 23, wherein dynamically changing the first set of rules includes:
- reporting an event to a second device that is part of the network intrusion detection system that is part of a higher tier;
- receiving a second set of rules from the second device;
- and
- altering the first set of rules utilizing, at least in part, the second set of rules.
2 more elements
25:
- The method of claim 23, further comprising:
- generating a first event based, at least in part, upon the monitored behaviour and the first set of rules;
- and
- wherein detecting a first adverse network condition includes:
- considering the first event to be an adverse network condition based, at least in part, upon the first set of rules.
2 more elements
26:
- The method of claim 25, further comprising:
- monitoring, at least in part, of at least one of the following:
- the state of a computer;
- an amount of computer processor usage;
- an amount of storage space available to a computer;
- traffic on a network;
- and
- the available bandwidth of a network;
- and
- generating a first event based at leats in part upon the monitoring.
7 more elements
27:
- The method of claim 25, wherein performing the first action includes:
- assigning the first adverse network condition a priority based, at least in part upon, the first set of rules;
- and
- further comprising:
- selecting the first action to perform based, at least in part, upon the assigned priority.
2 more elements
28:
- The method of claim 25, wherein performing the first action includes ignoring the first adverse network condition if the first network condition is assigned a low priority.
29:
- The method of claim 25, wherein performing the first action includes performing at least one of the following actions:
- logging the occurrence of the adverse network condition;
- forwarding data to a second device that is part of the network intrusion detection system;
- transmitting an instruction or rule to a second device that is part of the network intrusion detection system;
- transmitting a request for data to a second device that is part of the network intrusion detection system;
- altering an internal state machine of to a second device that is part of the network intrusion detection system;
- and
- altering a rule utilized by to a second device that is part of the network intrusion detection system.
5 more elements
30:
- An article comprising:
- a storage medium having a plurality of machine accessible instructions, wherein when the instructions are executed by a machine, the instructions provide for utilizing a first network intrusion detection device (NIDD) that is part of a network intrusion detection system (NIDS) that is arranged in a hierarchal fashion comprising:
- monitoring a behaviour of a network;
- detecting a first adverse network condition utilizing, at least in part, a first set of rules;
- performing a first action to facilitate attempting to maintain the survivability of the network;
- and
- dynamically changing the first set of rules based, at least in part, upon the behaviour of the network.
4 more elements
31:
- The article of claim 30, wherein the instructions providing for dynamically changing the first set of rules includes instructions for:
- reporting an event to a second device that is part of the network intrusion detection system that is part of a higher tier;
- receiving a second set of rules from the second device;
- and
- altering the first set of rules utilizing, at least in part, the second set of rules.
2 more elements
32:
- The article of claim 30, wherein the instructions providing for performing a first action to facilitate attempting to maintain the survivability of the network includes instructions for:
- logging the occurrence of the adverse network condition to a file;
- and
- transmitting data to a second network intrusion detection device that is part of a higher tier.
1 more element