US 8,046,835 B2 · Distributed computer network security activity model SDI-SCAM

Abstract

A distributed multi-agent system and method is implemented and employed across at least one intranet for purposes of real time collection, monitoring, aggregation, analysis and modeling of system and network operations, communications, internal and external accesses, code execution functions, network and network resource conditions as well as other assessable criteria within the implemented environment. Analytical models are constructed and dynamically updated from the data sources so as to be able to rapidly identify and characterize conditions within the environment (such as behaviors, events, and functions) that are typically characteristic with that of a normal state and those that are of an abnormal or potentially suspicious state. The model is further able to implement statistical flagging functions, provide analytical interfaces to system administrators and estimate likely conditions that characterize the state of the system and the potential threat. The model may further recommend (or alternatively implement autonomously or semi-autonomously) optimal remedial repair and recovery strategies as well as the most appropriate countermeasures to isolate or neutralize the threat and its effects.

Claims18

Dependent claims

A system that detects the state of a computer network, comprising:

a plurality of distributed agents disposed in said computer network, each said distributed agent comprising:
data collection means for passively collecting, monitoring, and aggregating data representative of activities of respective nodes within said computer network;
means responsive to the data from the data collection means for analyzing said data to develop activity models representative of activities of said computer network in a normal state and activities of said computer network in an abnormal state as a result of intrusions, infections, scams and/or other suspicious activities in said computer network;
and
means for comparing collected data to said activity models to determine whether said computer network is in said normal state or said abnormal state at different times and to dynamically update said activity models based on said collected data,
wherein said analyzing means performs a pattern analysis on the collected data to identify patterns in the collected data representative of suspicious activities and said comparing means compares the results of the pattern analysis of data collected by an agent to the results of pattern analysis of data collected by analyzing means of other agents to identify similar patterns of suspicious activity in different portions of the computer network.

3 more elements

Dependencies are inferred from the claim text.

Distributed computer network security activity model SDI-SCAM

Life of this patent

Distributed computer network security activity model SDI-SCAM

Life of this patent

Abstract

Claims18