US 7,735,141 B1Granted

Intrusion event correlator

OwnerSteven E. Noel, Eric B. Robertson +1inventors

InventorsSteven E. Noel, Eric B. Robertson, Sushil Jajodie

Life of this patent

Estimating the term…

Loading patent…

Abstract

Disclosed is a system for correlating intrusion events using attack graph distances. The system includes an attack graph generator, an exploit distance calculator, an intrusion detector, an event report/exploit associator, an event graph creator, an event graph distance calculator, a correlation value calculator, and a coordinated attack analyzer. An attack graph is constructed for exploits and conditions in a network. The exploit distance calculator determines exploit distances for exploit pair(s). The intrusion detector generates event. Events are associated with exploits. Event graph distances are calculated. Correlation values are calculated for event pair(s) using event graph distances. The correlation values are analyzed using a correlation threshold to detect coordinated attacks.

Claims8

Dependent claims

A non-transitory computer readable medium containing a computer program that when executed by one or more processors, causes the one or more processors to execute to perform the steps of:

a) constructing an attack graph for a network by mapping interdependencies among a multitude of exploits with respect to a multitude of conditions on a multitude of processing machines in said network, at least one of said multitude of exploits including at least one precondition mapped to at least one postcondition, said multitude of conditions including at least one of said at least one precondition and at least one of said at least one postcondition;
b) determining exploit distances for at least one exploit pair, each of said at least one exploit pair being a pair of said multitude of exploits on said attack graph;
c) receiving a multitude of event reports, each of said multitude of event reports used to report detected intrusions;
d) associating each of said multitude of event reports with at least one of said multitude of exploits;
e) creating an event graph by mapping at least one of said multitude of event reports to at least one other of said multitude of event reports;
f) determining event graph distances for at least one event pair, each of said at least one event pair being a pair of said multitude of event reports on said event graph;
g) calculating a multitude of correlation values, each of said multitude of correlation values calculated for at least one of said at least one event pair using said event graph distances;
and
h) looking for coordinated attacks by analyzing said multitude of correlation values using a correlation threshold.

6 more elements

Dependencies are inferred from the claim text.