US 9,961,047 B2Granted

Network security management

AssigneeBritish Telecommunications public limited company

InventorSachin Karale

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods and apparatus are disclosed for processing status messages for use in network security management in respect of a network of computing devices, the status messages comprising data relating to a plurality of attributes; the method comprising: filtering received status messages according to filtering rules in order to identify (i) status messages indicative of potential or actual network security events in respect of which a predetermined response is deemed applicable; (ii) status messages in respect of which a null response is deemed applicable; and (iii) residue messages not identified as (i) or (ii); processing messages identified as (i) such that a predetermined response may be initiated; performing analysis involving clustering in respect of messages identified as residue messages; and updating the filtering rules for use in subsequent filtering of received status messages in dependence on the result of the analysis.

Claims23

Dependent claims

A method of processing status messages for use in network security management in respect of a network of computing devices, the status messages each comprising information relating to the network, information relating to at least one of said computing devices therein, or information relating to an event that has been detected by or in respect of the network or detected by or in respect of at least one of said computing devices therein, the information of which a status message is comprised comprising data relating to a plurality of attributes of said network, said at least one computing device, or said event;

the method comprising one or more processors performing steps of:
filtering received status messages according to filtering rules in order to identify, in dependence on one or more attributes of said status messages:
(i) status messages indicative of network security events in respect of which a predetermined response is deemed applicable;
(ii) status messages in respect of which a null response is deemed applicable;
and
(iii) residue messages in respect of which the filtering rules neither indicate that a predetermined response is deemed applicable, nor indicate that the null response is deemed applicable;
processing the received status messages identified as status messages indicative of network security events in respect of which the predetermined response is deemed applicable, such that the predetermined response may be initiated;
in respect of one or more received status messages identified as residue messages, having separated the one or more residue messages from those received status messages identified as being indicative of network security events in respect of which a predetermined response is deemed applicable and from those received status messages in respect of which the null response is deemed applicable, subjecting just the one or more residue messages to analysis involving clustering in dependence on one or more attributes thereof;
and
updating the filtering rules for use in subsequent filtering of received status messages using an automated updating procedure dependent on one or more results of the analysis;
wherein the clustering of residue messages is performed in dependence on one or more disparity measures each calculated according to a predetermined disparity function dependent on one or more attributes of the residue message and one or more corresponding attributes of one or more of said filtering rules.

8 more elements

An apparatus for processing status messages for use in network security management in respect of a network of computing devices, the status messages each comprising information relating to the network, information relating to at least one of said computing devices therein, or information relating to an event that has been detected by or in respect of the network or detected by or in respect of at least one of said computing devices therein, the information of which a status message is comprised comprising data relating to a plurality of attributes of said network, said at least one computing device, or said event;

the apparatus comprising:
a processing system, including one or more computer processors, the processing system being at least configured to:
filter received status messages according to filtering rules in order to identify, in dependence on one or more attributes of said status messages:
(i) status messages indicative of network security events in respect of which a predetermined response is deemed applicable;
(ii) status messages in respect of which a null response is deemed applicable;
and
(iii) residue messages in respect of which the filtering rules neither indicate that the predetermined response is deemed applicable, nor indicate that the null response is deemed applicable;
process the received status messages identified as status messages indicative of network security events in respect of which the predetermined response is deemed applicable, such that the predetermined response may be initiated;
in respect of one or more received status messages identified as residue messages, having separated the one or more residue messages from those received status messages identified as being indicative of network security events in respect of which a predetermined response is deemed applicable and from those received status messages in respect of which the null response is deemed applicable, subject just the one or more received status messages identified as residue messages to analysis involving clustering in dependence on one or more attributes thereof;
and
update the filtering rules for use in subsequent filtering of received status messages using an automated updating procedure dependent on one or more results of the analysis;
wherein the clustering of residue messages is performed by the processing system in dependence on one or more disparity measures each calculated according to a predetermined disparity function dependent on one or more attributes of the residue message and one or more corresponding attributes of one or more of said filtering rules.

9 more elements

the method comprising one or more processors performing steps of:
filtering received status messages according to filtering rules in order to identify, in dependence on one or more attributes of said status messages:
(i) status messages indicative of network security events in respect of which a predetermined response is deemed applicable;
(ii) status messages in respect of which a null response is deemed applicable;
and
(iii) residue messages in respect of which the filtering rules neither indicate that the predetermined response is deemed applicable, nor indicate that the null response is deemed applicable;
processing the received status messages identified as status messages indicative of network security events in respect of which the predetermined response is deemed applicable, such that the predetermined response may be initiated;
in respect of one or more received status messages identified as residue messages, having separated the one or more residue messages from those received status messages identified as being indicative of network security events in respect of which the predetermined response is deemed applicable and from those received status messages in respect of which the null response is deemed applicable, subjecting just the one or more residue messages to analysis involving clustering in dependence on one or more attributes thereof;
and
updating the filtering rules for use in subsequent filtering of received status messages using an automated updating procedure dependent on one or more results of the analysis;
wherein the clustering of residue messages is performed in dependence on one or more disparity measures each calculated according to a predetermined disparity function dependent on one or more attributes of the residue message and one or more corresponding attributes of one or more of other residue messages.

8 more elements

the apparatus comprising:
a processing system, including one or more computer processors, the processing system being at least configured to:
filter received status messages according to filtering rules in order to identify, in dependence on one or more attributes of said status messages:
(i) status messages indicative of network security events in respect of which a predetermined response is deemed applicable;
(ii) status messages in respect of which a null response is deemed applicable;
and
(iii) residue messages in respect of which the filtering rules neither indicate that the predetermined response is deemed applicable, nor indicate that the null response is deemed applicable;
process the received status messages identified as status messages indicative of network security events in respect of which the predetermined response is deemed applicable, such that the predetermined response may be initiated;
in respect of one or more received status messages identified as residue messages, having separated the one or more residue messages from those received status messages identified as being indicative of network security events in respect of which the predetermined response is deemed applicable and from those received status messages in respect of which the null response is deemed applicable, subject just the one or more residue messages to analysis involving clustering in dependence on one or more attributes thereof;
and
update the filtering rules for use in subsequent filtering of received status messages using an automated updating procedure dependent on one or more results of the analysis;
wherein the clustering of residue messages is performed by the processing system in dependence on one or more disparity measures each calculated according to a predetermined disparity function dependent on one or more attributes of the residue message and one or more corresponding attributes of one or more of other residue messages.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/654,301Filed 23 Dec 2013
Priority: EP 1225018621 Dec 2012
Published: US 2015/0358292 A110 Dec 2015
Granted: 1 May 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/0263
Filtering policies: rule management
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
H04L 63/1441
For detecting or protecting against malicious traffic: countermeasures against malicious traffic
G06F 16/355
Clustering; Classification: creation or modification of classes or clusters