Filtering intrusion detection system events on a single host
AssigneeMulval Technologies, Inc.
InventorSudhakar GOVINDAVAJHALA
Life of this patent
Estimating the term…
Abstract
Embodiments disclosed herein describe a method to determine consequences of a privilege escalation alert from an intrusion detection system, the method comprising the steps of obtaining privilege escalation alert from the intrusion detection system and analyzing said privilege escalation alert information. The analysis further comprises of identifying the program affected by said privilege escalation alert and determining if it can be circumvented. The users affected by said privilege escalation alert and the transitive effects of said privilege escalation alert are identified.
Claims22
A method to determine consequences of a privilege escalation alert from an intrusion detection systems, the method comprising the steps of:
- a. obtaining privilege escalation alert from said intrusion detection system;
- and
- b. analyzing said privilege escalation alert information to determine:
- i. program affected by said privilege escalation alert;
- ii. if said affected program identified can be circumvented;
- iii. users affected by said privilege escalation alert;
- and
- iv. transitive effects of said privilege escalation alert.
A program storage device readable by computer, tangibly embodying a program of instructions executable by said computer to perform a method of determining consequences of a privilege escalation alert from an intrusion detection system, the method comprising the steps of:
- a. obtaining privilege escalation alert from said intrusion detection system;
- and
- b. analyzing said privilege escalation alert information to determine:
- i. program affected by said privilege escalation alert;
- ii. if said affected program identified can be circumvented;
- iii. users affected by said privilege escalation alert;
- and
- iv. transitive effects of said privilege escalation alert.
Dependencies are inferred from the claim text.