US 2017/0318037 A1 · DISTRIBUTED ANOMALY MANAGEMENT

Abstract

Examples relate to distributed anomaly management. In one example, a computing device may: receive real-time anomaly data for a first set of client devices, wherein the received anomaly data includes: anomalous network behavior data received from a network intrusion detection system (NICKS) monitoring network traffic behavior, anomalous host event data received from a host intrusion detection system (HIDS) monitoring host events originating from client devices in the first set, and anomalous process activity data received from a trace intrusion detection system (TIDS) monitoring process activity performed by client devices in the first set; for each client device in the first set of client devices for which anomaly data is received, associate the received anomaly data with the client device; and determine, for a particular client device, a measure of risk, wherein the measure of risk is dynamically adjusted based on the received real-time anomaly data.

Claims15

Dependent claims

A computing device for distributed anomaly management, the computing device comprising:

a hardware processor;
and
a data storage device storing instructions that, when executed by the hardware processor, cause the hardware processor to:
receive real-time anomaly data for a first set of client devices, wherein the received anomaly data includes:
anomalous network behavior data received from a network intrusion detection system (NIRS) monitoring network traffic behavior for client devices in the first set,
anomalous host event data received from a host intrusion detection system (HIDS) monitoring host events originating from client devices in the first set, and
anomalous process activity data received from a trace intrusion detection system (TIDS) monitoring process activity performed by client devices in the first set;
for each client device in the first set of client devices for which anomaly data is received, associate the received anomaly data with the client device in a database;
and
determine, for a particular client device included in the first set of client devices, a measure of risk, wherein the measure of risk is dynamically adjusted based on the received real-time anomaly data associated with the particular client device.

7 more elements

A method for distributed anomaly management, implemented by a hardware processor, the method comprising:

receiving real-time anomaly data for a first set of client devices, wherein the received anomaly data includes at least one of:
anomalous network behavior data received from a network intrusion detection system (NIDS) monitoring network traffic for client devices in the first set,
anomalous host event data received from a host intrusion detection system (HIDS) monitoring host events originating from client devices in the first set, or
anomalous process activity data received from a trace intrusion detection system (TIDS) monitoring process activity performed by client devices in the first set;
for each client device in the first set of client devices for which anomaly data is received, associating the received anomaly data with the client device in a database;
generating redacted anomaly data that includes a subset of the anomaly data received for each of the client devices included in the first set;
and
providing the redacted anomaly data to a separate computing device that manages anomalies for a second set of client devices.

5 more elements

A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing device for distributed anomaly management, the machine-readable storage medium comprising instructions to cause the hardware processor to:

receive real-time anomaly data for a particular client device included in a first set of client devices, wherein the received anomaly data includes at least two of:
anomalous network behavior data received from a network device monitoring network traffic for the particular client device,
anomalous host event data received from a host event device monitoring host events originating from the particular client device, or
anomalous process activity data received from a trace device monitoring process activity performed by the particular client device;
obtain, from at least one other computing device that manages anomalies for a second set of client devices, shared data relevant to the received anomaly data;
and
determine a measure of risk for the particular client device based on the anomaly data and the shared data.

4 more elements

Dependencies are inferred from the claim text.

Distributed anomaly management

Life of this patent

Distributed anomaly management

Life of this patent

Abstract

Claims15