Back to results
US 2021/0243206 A1Published application
Detection of security intrusion in a computing system
AssigneeHewlett Packard Enterprise Development LP
InventorSuhas Shivanna
Life of this patent
Estimating the term…
Abstract
Some examples relate to detecting a security intrusion in a computer system. In an example, the detection of the security intrusion may be performed by analyzing a plurality of log records generated corresponding to a plurality of milestone actions performed during invocation of an operation on the computing system, based on a rule-set. Upon detection of a deviation in the plurality of log record from the rule-set, a security action is performed.
Claims20
A method comprising:
- storing a plurality of log records, by an intrusion detection engine, in a secure log store hosted in a management system of a computing system, wherein the plurality of log records are generated corresponding to a plurality of milestone actions performed during invocation of an operation on the management system;
- monitoring, by the intrusion detection engine, the plurality of log records stored in the secure log store;
- identifying, by the intrusion detection engine, whether the operation is a security sensitive operation, wherein the security sensitive operation belongs to a predefined set of a plurality of operations that are performed on the management system;
- in response of identifying that the operation is the security sensitive operation, analyzing, by the intrusion detection engine, the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system;
- and
- performing a security action, by the intrusion detection engine, in response of detecting the security intrusion.
3 more elements
A non-transitory machine-readable storage medium encoded with instructions executable by a processor to cause the processor to:
- store a plurality of log records in a secure log store hosted in a management system of a computing system;
- wherein the plurality of log records are generated corresponding to a plurality of milestone actions performed during invocation of an operation on the management system;
- monitor the plurality of log records stored in the secure log store;
- identify whether the operation is a security sensitive operation that belongs to a predefined set of a plurality of operations that are performed on the management system;
- in response of identifying that the operation is the security sensitive operation, analyze the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system;
- and
- perform a security action in response of detecting the security intrusion.
4 more elements
A computing system comprising:
- at least one central processing unit;
- a memory;
- and
- an intrusion detection engine that is separate from the at least one central processing unit, the intrusion detection engine comprising:
- a non-transitory machine-readable storage medium encoded with instructions executable by a processor to cause the processor to:
- receive a plurality of log records generated corresponding to a plurality of milestone actions performed during invocation of an operation on a management system of the computing system;
- store the plurality of log records in a secure log store hosted in a management system of the computing system, wherein the secure log store is separate from a log repository of the management system;
- and
- monitor the plurality of log records stored in the secure log store;
- identify whether the operation is a security sensitive operation that belongs to a predefined set of a plurality of operations that are performed on the management system;
- in response of identifying that the operation is the security sensitive operation, analyze the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system;
- and
- perform a security action in response of detecting the security intrusion.
10 more elements
Dependencies are inferred from the claim text.