US 2015/0033336 A1 · LOGGING ATTACK CONTEXT DATA

Abstract

Methods and systems are provided for improved attack context data logging. In one embodiment, additional context is provided for an attack by logging either a predetermined or configurable number or predetermined or configurable timeframe of packets before and optionally after detection of a packet associated with an attack. This additional context facilitates understanding of the attack and can help in connection with improving the implementation of signatures that are used to detect attacks and reducing false positives. In one aspect, the system is configured to assess multiple packets across one or more sessions and temporarily store each packet in a buffer having a configurable size such that once an attack is detected, a log can be generated based at least in part on packets present in the buffer. Then, the log can be analyzed so as to understand the context of the attack.

Claims19

Dependent claims

A network appliance system comprising:

one or more processors;
a communication interface device;
one or more internal data storage devices operatively coupled to the one or more processors and storing:
a configuration module to allow configuration of a quantify of packets to be logged prior to a network attack;
a logging module configured to receive information regarding a plurality of packets and generate a log to facilitate analysis of context of the network attack;
a buffer module configured to define a buffer based on the quantity and receive and temporarily store within the buffer packets provided thereto;
and
an intrusion prevention module configured to scan a plurality of received packets and copy a subset of the plurality of received packets to the buffer module and when a packet of the plurality of received packets triggers detection of the network attack by the intrusion prevention module, the intrusion prevention module causes the subset of the plurality of received packets and the packet to be sent to the logging module.

5 more elements

Dependencies are inferred from the claim text.

Logging attack context data

Life of this patent

Logging attack context data

Life of this patent

Abstract

Claims19