# US 2021/0243206 A1 · Detection of security intrusion in a computing system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243206 A1 - Document ID: US20210243206A1 - Status: Published application - Kind: A1 - Application number: 16/779,516 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Suhas Shivanna - Web page: https://patentgrep.com/patent/US20210243206A1 ## CPC - G06F 21/554: {involving event detection and direct action} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 21/552: {involving long-term monitoring or reporting} - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 11/3055: {Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16)} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some examples relate to detecting a security intrusion in a computer system. In an example, the detection of the security intrusion may be performed by analyzing a plurality of log records generated corresponding to a plurality of milestone actions performed during invocation of an operation on the computing system, based on a rule-set. Upon detection of a deviation in the plurality of log record from the rule-set, a security action is performed. ## Claims ### Claim 1 A method comprising: storing a plurality of log records, by an intrusion detection engine, in a secure log store hosted in a management system of a computing system, wherein the plurality of log records are generated corresponding to a plurality of milestone actions performed during invocation of an operation on the management system; monitoring, by the intrusion detection engine, the plurality of log records stored in the secure log store; identifying, by the intrusion detection engine, whether the operation is a security sensitive operation, wherein the security sensitive operation belongs to a predefined set of a plurality of operations that are performed on the management system; in response of identifying that the operation is the security sensitive operation, analyzing, by the intrusion detection engine, the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system; and performing a security action, by the intrusion detection engine, in response of detecting the security intrusion. ### Claim 2 (depends on 1) The method of claim 1, wherein storing the plurality of log records further comprises receiving, by the intrusion detection engine, the plurality of log records from the management system. ### Claim 3 (depends on 1) The method of claim 1, wherein the secure log store is separate from an audit log repository of the management system. ### Claim 4 (depends on 1) The method of claim 1, wherein the security sensitive operation comprises one or more of operations related to adding a new user, changing security configuration of the computing system or changing password policies in the management system. ### Claim 5 (depends on 1) The method of claim 1, wherein the invocation of the operation comprises an authentication process to access the management system and an invocation process to invoke the operation on the management system, and wherein the plurality of log records comprises: a first set of log records corresponding to a first set of the plurality of milestone actions, performed during the authentication process; and a second set of log records corresponding a second set of the plurality of milestone actions performed during the invocation process. ### Claim 6 (depends on 1) The method of claim 1, wherein the invocation of the operation comprises an authentication process to access the management system and an invocation process to invoke the operation on the management system, and wherein the rule-set comprises: a first rule-set comprising a first standard set of milestone actions related to the authentication process; and a second rule-set comprising a second standard set of milestone actions related to the invocation process for each operation of the plurality of operations. ### Claim 7 (depends on 1) The method of claim 1, wherein analyzing comprises determining whether the plurality of log records follow the rule-set. ### Claim 8 (depends on 7) The method of claim 7, wherein analyzing comprises detecting the security intrusion in the management system in response of determining that the plurality of log records do not follow the rule-set. ### Claim 9 (depends on 1) The method of claim 1, wherein analyzing is performed while or immediately after completing the invocation of the operation on the management system. ### Claim 10 (depends on 1) The method of claim 1, wherein performing the security action comprises generating an alert to enable a recovery action to recover the management system before the operation is committed on the management system. ### Claim 11 (depends on 1) The method of claim 1, wherein performing the security action comprises performing a recovery action, by the intrusion detection system to recover the management system before the operation is committed on the management system. ### Claim 12 (depends on 1) The method of claim 1, wherein performing the security action comprises alerting a logged-in administrator at an instant to recover the management system before the operation is committed on the management system. ### Claim 13 (depends on 1) The method of claim 1, wherein the management system comprises a baseboard management controller of the computing system. ### Claim 14 (depends on 1) The method of claim 1, wherein the secure log store is protected using a security control. ### Claim 15 A non-transitory machine-readable storage medium encoded with instructions executable by a processor to cause the processor to: store a plurality of log records in a secure log store hosted in a management system of a computing system; wherein the plurality of log records are generated corresponding to a plurality of milestone actions performed during invocation of an operation on the management system; monitor the plurality of log records stored in the secure log store; identify whether the operation is a security sensitive operation that belongs to a predefined set of a plurality of operations that are performed on the management system; in response of identifying that the operation is the security sensitive operation, analyze the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system; and perform a security action in response of detecting the security intrusion. ### Claim 16 (depends on 15) The non-transitory machine-readable storage medium of claim 15, wherein the instructions to store comprises instructions to receive the plurality of log records from the management system. ### Claim 17 (depends on 15) The non-transitory machine-readable storage medium of claim 15, wherein the instructions to analyze comprises instructions to determine whether the plurality of log records follow the rule-set. ### Claim 18 A computing system comprising: at least one central processing unit; a memory; and an intrusion detection engine that is separate from the at least one central processing unit, the intrusion detection engine comprising: a non-transitory machine-readable storage medium encoded with instructions executable by a processor to cause the processor to: receive a plurality of log records generated corresponding to a plurality of milestone actions performed during invocation of an operation on a management system of the computing system; store the plurality of log records in a secure log store hosted in a management system of the computing system, wherein the secure log store is separate from a log repository of the management system; and monitor the plurality of log records stored in the secure log store; identify whether the operation is a security sensitive operation that belongs to a predefined set of a plurality of operations that are performed on the management system; in response of identifying that the operation is the security sensitive operation, analyze the plurality of log records based on a rule-set defined in the management system to detect a security intrusion in the management system; and perform a security action in response of detecting the security intrusion. ### Claim 19 (depends on 18) The computing system of claim 18, wherein the management system comprises a baseboard management controller of the computing system. ### Claim 20 (depends on 18) The computing system of claim 18, wherein the instructions further comprises instructions executable by the processor to cause the processor to: receive another plurality of log records generated corresponding to another plurality of milestone actions performed during invocation of an operation on the computing system via the at least one central processing unit.