System, method and computer program product for automatic response to computer system misuse using active response modules

A system for use with an intrusion detection system that allows automatic responses to an instance of computer misuse, comprising:

• first means for providing a user with a list of a plurality of ARMs;
• second means for allowing said user to configure each of said plurality of ARMs;
• and
• third means for allowing said user to link at least one of said plurality of ARMs to a computer misuse.

A system, comprising:

• a data processing element;
• an intrusion detection system;
• a plurality of pre-defined ARMs each having means for instructing said data processing element to perform an action in response to a command from said intrusion detection system;
• means for activating a subset of said plurality of pre-defined ARMs for a misuse;
• wherein said intrusion detection system comprises:
• means for detecting said misuse;
• means for identifying said subset activated for said misuse;
• and
• means for invoking said subset to thereby respond to said misuse.

A Fix-it active response module (ARM), for use with an intrusion detection system, which allows automatic response to detected instances of computer misuse, comprising:

• first means for allowing a user to specify a sensitive directory;
• second means for updating a cache by copying data located within said sensitive directory to said cache;
• third means for allowing said user to specify the frequency for updating said cache by said second means;
• fourth means for allowing said user to toggle one or more of the following fix-it options:
• (i) Restore;
• (ii) Save_Bad;
• and
• (iii) Delete_Corrupt;
• fifth means, responsive to said Restore fix-it option, for copying said data from said cache to said sensitive directory based on an instance of detected misuse by the intrusion detection system;
• sixth means, responsive to said Save_Bad fix-it option, for copying a corrupted version of said data from said sensitive directory based on said instance of detected misuse by the intrusion detection system;
• and
• seventh means, responsive to said Delete_Corrupt fix-it option, for deleting said corrupted version of said data from said sensitive directory based on said instance of detected misuse by the intrusion detection system.

A computer program product comprising a computer usable medium having computer readable program code means embodied in said medium for causing an application program to execute on a computer that provides a fix-it active response module (ARM), for use with an intrusion detection system, which allows automatic response to detected instances of file related computer misuse, said computer readable program code means comprising:

• a first computer readable program code means for causing the computer to allow a user to specify a sensitive directory;
• a second computer readable program code means for causing the computer to update a cache by copying data located within said sensitive directory to said cache;
• a third computer readable program code means for causing the computer to allow a user to specify the frequency for updating said cache by said second means;
• a fourth computer readable program code means for causing the computer to allow said user to toggle one or more of the following fix-it options:
• (i) Restore;
• (ii) Save_Bad;
• and
• (iii) Delete13Corrupt;
• a fifth computer readable program code means for causing the computer to respond to said Restore fix-it option and copy said data from said cache to said sensitive directory based on an instance of detected misuse by the intrusion detection system;
• a sixth computer readable program code means for causing the computer to respond to said Save_Bad fix-it option and copy a corrupted version of said data from said sensitive directory based on said instance of detected misuse by the intrusion detection system;
• and
• a seventh computer readable program code means for causing the computer to respond to said Delete_Corrupt fix-it option and delete said corrupted version of said data from said sensitive directory based on said instance of detected misuse by the intrusion detection system.

A computer program product comprising a computer usable medium having computer readable program code means embodied in said medium for causing an application program to execute on a computer that provides a system for use with an intrusion detection system that allows automatic responses to an instance of computer misuse, said computer readable program code means comprising:

• a first computer readable program code means for causing the computer to provide a user with a list of a plurality of ARMs;
• a second third computer readable program code means for causing the computer to allow said user to configure each of said plurality of ARMs;
• and
• a third computer readable program code means for causing the computer to allow said user to link at least one of said plurality of ARMs to a computer misuse.