Adaptive system and method for responding to computer network security attacks

A dynamic network security system for responding to a security attack on a computer network, said computer network having a multiplicity of computer nodes, and said system comprising:

• a plurality of security agents configured to concurrently detect occurrences of security events on associated ones of said computer nodes, said security events characterizing said attack;
• a processor in data communication with said security agents and configured to process said security events to form an attack signature;
• and
• a network status display in communication with said processor and configured to display attack status information in response to said attack signature, said attack status information being representative of said attack,
• wherein said processor is trained to respond to a plurality of training signatures, each of said training signatures representing one of a plurality of simulated attacks;
• and
• said processor is further configured to compare said attack signature to each of said training signatures to determine which of said simulated attacks most closely matches said attack, and wherein:
• said network status display presents a display map divided into a plurality of display cells;
• and
• each of said training signatures is mapped into said display cells prior to said attack, and
• wherein said display cells are divided into a plurality of regions, said regions being configured to indicate an attack type and severity of said attack.

A method of operating a dynamic network security system to respond to a plurality of attacks on a computer network, said method comprising the steps of:

• training said security system to respond to a plurality of training signatures, each of said training signatures representing one of a plurality of simulated attacks;
• receiving a first attack signature, said first attack signature being configured to characterize a first one of said plurality of attacks;
• comparing said first attack signature to each of said training signatures to determine which of said training signatures most closely matches said first attack signature;
• displaying attack status information in a network status display in response to said first attack signature and a most closely matching training signature;
• and
• adapting said security system to respond to a second one of said plurality of attacks, said second attack being characterized by a second attack signature that resembles said first attack signature,
• wherein said network status display provides a two dimensional image of said computer network, said network status display being divided into a plurality of display cells, and said training step comprises the steps of:
• performing a first one of said simulated attacks on said network, said first simulated attack having a first training signature;
• mapping said first training signature into one of said display cells in response to said first simulated attack;
• and
• repeating said performing and mapping steps for the remaining ones of said training signatures.

A method of operating a dynamic network security system to respond to a plurality of attacks on a computer network, said method comprising the steps of:

• training said security system to respond to a plurality of training signatures, each of said training signatures representing one of a plurality of simulated attacks;
• receiving a first attack signature, said first attack signature being configured to characterize a first one of said plurality of attacks;
• comparing said first attack signature to each of said training signatures to determine which of said training signatures most closely matches said first attack signature;
• displaying attack status information in a network status display in response to said first attack signature and a most closely matching training signature;
• and
• adapting said security system to respond to a second one of said plurality of attacks, said second attack being characterized by a second attack signature that resembles said first attack signature,
• wherein said displaying step further comprises the step of tracking a change in said at least one security event type and said attack severity of said first attack.

A method of operating a dynamic network security system to respond to a plurality of attacks on a computer network, said method comprising the steps of:

• training said security system to respond to a plurality of training signatures, each of said training signatures representing one of a plurality of simulated attacks;
• receiving a first attack signature, said first attack signature being configured to characterize a first one of said plurality of attacks;
• comparing said first attack signature to each of said training signatures to determine which of said training signatures most closely matches said first attack signature;
• displaying attack status information in a network status display in response to said first attack signature and a most closely matching training signature;
• and
• adapting said security system to respond to a second one of said plurality of attacks, said second attack being characterized by a second attack signature that resembles said first attack signature,
• wherein said adapting step comprises the steps of:
• introducing said first attack signature to said security system as a new training signature;
• and
• mapping said new training signature into said network status display.

A method of operating a dynamic network security system to respond to a first and a second attack on a computer network, said computer network having a multiplicity of nodes, said method comprising the steps of:

• training said security system to respond to a plurality of training signatures, each of said training signatures representing one of a plurality of simulated attacks;
• detecting security events on said nodes to form a first attack signature representing said first attack, each of said security events causing an anti-security effect on said computer network;
• comparing said first attack signature to each of said training signatures to determine which of said training signatures most closely resembles said first attack signature;
• generating a mitigation list, said mitigation list being a catalogue of actions to take to mitigate said first attack;
• displaying attack status information and said mitigation list in a network status display in response to said first attack signature and a most closely matching training signature, said attack status information being configured to include location identifiers and a security event type for each of said security events;
• mitigating said attack;
• and
• adapting said security system to respond to said second attack, said second attack being characterized by a second attack signature that most closely resembles said first attack signature,
• wherein said network status display provides a two dimensional image of said computer network, said network status display being divided into a plurality of display cells, and said training step comprises the steps of:
• performing a first one of said simulated attacks on said network, said first simulated attack having a first training signature;
• mapping said first training signature into one of said display cells in response to at least one security event type and an attack severity for said first training signature,
• said at least one security event type being at least one of a plurality of known security event types, each of said known security event types being configured to cause an anti-security effect on said computer network, and said attack severity being a level of security breach said simulated attack causes said computer network;
• and
• repeating said performing and mapping steps for remaining ones of said training signatures.