Systems and Methods for Reporting Computer Security Incidents
AssigneeBitdefender IPR Management Ltd.
InventorsAdrianus WARMENHOVEN, Richard J. HOFSTEDE
Life of this patent
Estimating the term…
Abstract
Alert manager software dynamically assembles a security alert as various security scenarios are tested to reach a verdict. Each executed scenario may contribute a scenario-specific message, so the resulting compound security alert indicates an actual line of reasoning used in reaching the respective verdict. The described systems and methods apply, inter alia, to the analysis of high-volume network flows in corporate networks. In some embodiments, flows are pre-tagged with extra metadata to facilitate detection of malware and/or intrusion.
Claims20
A method comprising employing at least one hardware processor of a server computer system configured to protect a plurality of client systems against computer security threats to:
- in response to receiving a forensic indicator, select a first routine for evaluating a first security predicate from a plurality of routines, the first routine selected according to the forensic indicator, wherein the forensic indicator comprises a plurality of metadata elements characterizing a network flow between a client system of the plurality of client systems and another party;
- select a second routine for evaluating a second security predicate from the plurality of routines, the second routine selected according to a result of executing the first routine;
- in response to selecting the first routine, add a first text message to a security alert indicating whether the client system is subject to a computer security threat, the first text message determined according to a first message template selected according to the first routine;
- in response to selecting the second routine, add a second text message to the security alert, the second text message determined according to a second message template selected according to the second routine;
- and
- transmit the security alert to an administration device configured to display the security alert to a human operator.
A server computer system configured to protect a plurality of client systems against computer security threats, the server computer system comprising at least one hardware processor configured to execute a forensic analyzer and an alert manager connected to the forensic analyzer, wherein:
- the forensic analyzer is configured to:
- in response to receiving a forensic indicator, select a first routine for evaluating a first security predicate from a plurality of routines, the first routine selected according to the forensic indicator, wherein the forensic indicator comprises a plurality of metadata elements characterizing a network flow between a client system of the plurality of client systems and another party, and
- select a second routine for evaluating a second security predicate from the plurality of routines, the second routine selected according to a result of executing the first routine;
- and
- the alert manager is configured to:
- in response to the forensic analyzer selecting the first routine, add a first text message to a security alert indicating whether the client system is subject to a computer security threat, the first text message determined according to a first message template selected according to the first routine,
- in response to the forensic analyzer selecting the second security algorithm, add a second text message to the security alert, the second text message determined according to a second message template selected according to the second routine, and
- transmit the security alert to an administration device configured to display the security alert to a human operator.
A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a server computer system configured to protect a plurality of client systems against computer security threats, causes the server computer system to execute a forensic analyzer and an alert manager connected to the forensic analyzer, wherein:
- the forensic analyzer is configured to:
- in response to receiving a forensic indicator, select a first routine for evaluating a first security predicate from a plurality of routines, the first routine selected according to the forensic indicator, wherein the forensic indicator comprises a plurality of metadata elements characterizing a network flow between a client system of the plurality of client systems and another party, and
- select a second routine for evaluating a second security predicate from the plurality of routines, the second routine selected according to a result of executing the first routine;
- and
- the alert manager is configured to:
- in response to the forensic analyzer selecting the first routine, add a first text message to a security alert indicating whether the client system is subject to a computer security threat, the first text message determined according to a first message template selected according to the first routine,
- in response to the forensic analyzer selecting the second security algorithm, add a second text message to the security alert, the second text message determined according to a second message template selected according to the second routine, and
- transmit the security alert to an administration device configured to display the security alert to a human operator.
Dependencies are inferred from the claim text.