Methods and systems for managing security in computing networks
AssigneeInternational Business Machines Corporation
InventorsSteven LINGAFELT, Suzanne C. DEFFEYES, Gary K. THORNTON, Amir KHAN
Life of this patent
Estimating the term…
Abstract
Embodiments for managing computing network security by one or more processors are described. A signal that is representative of authorized anomalous behavior is received. The signal includes at least one of an identity and a type of activity associated with the authorized anomalous behavior. A security incident is detected. If the detected security incident corresponds to the authorized anomalous behavior, the generating of an alert in response to the detecting of the security incident is suppressed.
Claims21
A method, by one or more processors, for managing computing network security comprising:
- receiving a signal representative of authorized anomalous behavior, wherein the signal comprises at least one of an identity and a type of activity associated with the authorized anomalous behavior;
- detecting a security incident;
- and
- if the detected security incident corresponds to the authorized anomalous behavior, suppressing the generating of an alert in response to the detecting of the security incident.
A system for managing computing network security comprising:
- at least one processor that
- receives a signal representative of authorized anomalous behavior, wherein the signal comprises at least one of an identity and a type of activity associated with the authorized anomalous behavior;
- detects a security incident;
- and
- if the detected security incident corresponds to the authorized anomalous behavior, suppresses the generating of an alert in response to the detecting of the security incident.
A computer program product for managing computing network security by one or more processors, the computer program product comprising a non-transitory computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising:
- an executable portion that receives a signal representative of authorized anomalous behavior, wherein the signal comprises at least one of an identity and a type of activity associated with the authorized anomalous behavior;
- an executable portion that detects a security incident;
- and
- an executable portion that, if the detected security incident corresponds to the authorized anomalous behavior, suppresses the generating of an alert in response to the detecting of the security incident.
Dependencies are inferred from the claim text.