Method and system for managing computer security information

A method for determining relationships between two or more computer events, comprising the steps of:

• receiving a plurality of raw computer events with a fusion engine from one or more intrusion detectors, each raw computer event having a first set of parameters and comprising one of suspicious computer activity and a computer attack;
• creating raw computer event storage areas based upon information received from a raw computer event classification database;
• storing each event in an event storage area based upon an event type parameter;
• comparing each raw computer event to data contained in a context database with the fusion engine to determine if the two or more raw computer events are part of a larger larger computer attack;
• adjusting a priority parameter or leaving the priority parameter in tact for each raw computer event in response to the comparison to the context database;
• associating each raw computer event with one or more correlation events;
• applying one or more rules to each raw computer event based upon the correlation event associations;
• and
• generating a mature correlation event message in response to each successful application of a rule.

A method for determining relationships between two or more computer events, comprising the steps of:

• receiving a plurality of raw computer events with a fusion engine from one or more intrusion detectors that assign a priority parameter to each raw computer event, each raw computer event having a first set of parameters and comprising one of suspicious computer activity and a computer attack;
• creating raw computer event storage areas based upon information received from a raw computer event classification database;
• storing each event in an event storage area based upon an event type parameter;
• comparing each raw computer event to data contained in a context database with the fusion engine to determine if the two or more raw computer events are part of a larger computer attack;
• adjusting a priority parameter or leaving the priority parameter in tack for each raw computer event in response to the comparison to the context database;
• associating each raw computer event with one or more correlation events;
• applying one or more rules corresponding with the event type parameters to each raw computer event based upon the correlation event associations;
• and
• generating a mature correlation event message in response to each successful application of a rule.

A security management system comprising:

• a plurality of data sources comprising intrusion detectors that assign a priority parameter to raw computer events:
• an event collector linked to the plurality of data sources;
• a fusion engine linked to the event collector, said fusion engine identifying relationships between two or more raw computer events generated by the data sources and adjusting each priority parameter if one or more conditions are met, the fusion engine using rules associated with event type parameters assigned to each raw computer event to determine if the two or more raw computer events are part of a larger computer attack, each raw computer event comprising one of suspicious computer activity and a computer attack;
• and
• a console linked to the event collector for displaying any output generated by the fusion engine.

A fusion engine comprising:

• a controller;
• an event reader for receiving raw computer events from intrusion detectors that assign a priority parameter to each raw computer event, each raw computer event comprising one of suspicious computer activity and a computer attack;
• a classifier linked to the event reader for classifying the received raw computer events;
• a raw computer event classification database linked to the classifier;
• a context based risk-adjustment processor linked to the classifier, for adjusting the priority parameters of raw computer events;
• a context database linked to the context based risk-adjustment processor for providing context parameters that are assigned to raw computer events and that are used by the context based risk-adjustment processor;
• and
• a rule database that comprises rules for identifying if one or more relationships exist between two or more events by determining if the two or more raw computer events are part of a larger computer attack.

A method for managing security information comprising the steps of:

• receiving with a fusion engine a raw computer event having a first ranking from one or more data sources comprising intrusion detectors, each raw computer event comprising one of suspicious computer activity and a computer attack;
• classifying the raw computer event with the fusion engine by assigning each raw computer event an event type parameter;
• storing the raw computer event;
• assigning a second ranking to the raw computer event with the fusion engine, the second ranking assesses risks of the raw computer event based upon a context of the raw computer event;
• determining if the first ranking each row computer event should be adjusted based on its second ranking;
• and
• identifying one or more relationships between two or more raw computer events by using rules associated with event type parameters to determine if the raw computer event is part of a larger computer attack.

A method for managing security information comprising the steps of:

• receiving raw computer events with a fusion engine from one or more data sources comprising intrusion detectors that assign a priority status to each raw computer event, each raw computer event comprising one of suspicious computer activity and a computer attack;
• classifying the raw computer events with the fusion engine by assigning each raw computer event an event type parameter;
• assigning context parameters to each raw computer event based on the comparison of a respective computer event and its type parameter with computer environment information;
• determining if a priority status of each raw computer event should be adjusted based on its context parameters;
• grouping two or more raw computer events into a high level correlation event with the fusion engine if the two or more raw computer events are part of a larger computer attack;
• in response to grouping the two or more raw computer events, applying one or more rules to the raw computer events;
• generating a mature correlation event message if application of a rule is successful;
• and
• displaying one or more mature correlation event messages on a console that describe relationships between raw computer events.