Method And Apparatus For Exercising And Debugging Correlations For Network System
    1.
    发明申请
    Method And Apparatus For Exercising And Debugging Correlations For Network System 有权
    网络系统运行调试相关方法与装置

    公开(公告)号:US20110145711A1

    公开(公告)日:2011-06-16

    申请号:US13031079

    申请日:2011-02-18

    CPC classification number: G06F21/552

    Abstract: A selected time interval of previously stored events generated by a number of computer network devices are replayed and cross-correlated according to rules. Meta-events are generated when the events satisfy conditions associated with one or more of the rules. The rules used during replay may differ from prior rules used at a time when the events occurred within a computer network that included the computer network devices. In this way, new rules can be tested against true event data streams to determine whether or not the rules should be used in a live environment (i.e., the efficacy of the rules can be tested an tor debugged against actual event data).

    Abstract translation: 由多个计算机网络设备产生的先前存储的事件的选定时间间隔根据规则被重放和交叉相关。 当事件满足与一个或多个规则相关联的条件时,生成元事件。 在播放期间使用的规则可能与在计算机网络中包含计算机网络设备的事件发生时所使用的先前规则不同。 以这种方式,可以针对真实事件数据流来测试新规则,以确定在活动环境中是否应该使用规则(即,可以针对实际事件数据来调试规则的功效)。

    META-EVENT GENERATION BASED ON TIME ATTRIBUTES
    2.
    发明申请
    META-EVENT GENERATION BASED ON TIME ATTRIBUTES 审中-公开
    基于时间特征的元生成

    公开(公告)号:US20120260306A1

    公开(公告)日:2012-10-11

    申请号:US13443682

    申请日:2012-04-10

    CPC classification number: G06F21/554 G06Q10/06

    Abstract: First stage meta-events are generated based on analyzing time attributes of base events received from a network component. Second stage meta-events are generated based on a number of the first stage meta-events that have a time attribute falling within a time period. An amount of time that has passed since a most-recent second stage meta-event was generated is determined, and if a threshold time period does not exceed the amount of time that has passed since the most-recent second stage meta-event was detected, a third stage meta-event is determined.

    Abstract translation: 基于从网络组件接收的基本事件的时间属性分析,生成第一阶段元事件。 基于具有落在时间段内的时间属性的第一级元事件的数量来生成第二级元事件。 确定从最近的第二阶段元事件生成以来已经过去的时间量,并且如果阈值时间段不超过从检测到最近的第二阶段元事件以来已经过去的时间量 ,确定第三阶段元事件。

    Method and apparatus for exercising and debugging correlations for network system
    4.
    发明授权
    Method and apparatus for exercising and debugging correlations for network system 有权
    运行和调试网络系统相关性的方法和装置

    公开(公告)号:US08560679B2

    公开(公告)日:2013-10-15

    申请号:US13031079

    申请日:2011-02-18

    CPC classification number: G06F21/552

    Abstract: A selected time interval of previously stored events generated by a number of computer network devices are replayed and cross-correlated according to rules. Meta-events are generated when the events satisfy conditions associated with one or more of the rules. The rules used during replay may differ from prior rules used at a time when the events occurred within a computer network that included the computer network devices. In this way, new rules can be tested against true event data streams to determine whether or not the rules should be used in a live environment (i.e., the efficacy of the rules can be tested and/or debugged against actual event data).

    Abstract translation: 由多个计算机网络设备产生的先前存储的事件的选定时间间隔根据规则被重放和交叉相关。 当事件满足与一个或多个规则相关联的条件时,生成元事件。 在播放期间使用的规则可能与在计算机网络中包含计算机网络设备的事件发生时所使用的先前规则不同。 以这种方式,可以针对真实事件数据流来测试新的规则,以确定在活的环境中是否应该使用规则(即,规则的功效可以针对实际事件数据进行测试和/或调试)。

    Correlation engine with support for time-based rules
    5.
    发明授权
    Correlation engine with support for time-based rules 有权
    相关引擎,支持基于时间的规则

    公开(公告)号:US08176527B1

    公开(公告)日:2012-05-08

    申请号:US10308767

    申请日:2002-12-02

    CPC classification number: G06F21/554 G06Q10/06

    Abstract: A rules engine with support for time-based rules is disclosed. A method performed by the rules engine, comprises receiving security events generated by a number of network devices. The security events are aggregated. One or more time-based rules are provided to a RETE engine. The aggregated security events are provided to the RETE engine at specific times associated with the time-based rules. The security events are cross-correlated with the one or more time-based rules; and one or more first stage meta-events are reported.

    Abstract translation: 公布了支持基于时间的规则的规则引擎。 由规则引擎执行的方法包括接收由多个网络设备产生的安全事件。 安全事件被聚合。 一个或多个基于时间的规则提供给RETE引擎。 聚合的安全事件在与时间规则相关联的特定时间提供给RETE引擎。 安全事件与一个或多个基于时间的规则相互关联; 并报告一个或多个第一阶段元事件。

    Method and apparatus for exercising and debugging correlations for network security system
    6.
    发明授权
    Method and apparatus for exercising and debugging correlations for network security system 有权
    运行和调试网络安全系统相关性的方法和装置

    公开(公告)号:US07899901B1

    公开(公告)日:2011-03-01

    申请号:US10308416

    申请日:2002-12-02

    CPC classification number: G06F21/552

    Abstract: A selected time interval of previously stored security events generated by a number of computer network devices are replayed and cross-correlated according to rules defining security incidents. Meta-events are generated when the security events satisfy conditions associated with one or more of the rules. The rules used during replay may differ from prior rules used at a time when the security events occurred within a computer network that included the computer network devices. In this way, new rules can be tested against true security event data streams to determine whether or not the rules should be used in a live environment (i.e., the efficacy of the rules can be tested and/or debugged against actual security event data).

    Abstract translation: 由许多计算机网络设备产生的先前存储的安全事件的选定时间间隔根据定义安全事件的规则被重播和交叉相关。 当安全事件满足与一个或多个规则相关联的条件时,生成元事件。 在播放期间使用的规则可能与在包括计算机网络设备的计算机网络中发生安全事件时使用的先前规则不同。 以这种方式,可以针对真实的安全事件数据流来测试新的规则,以确定是否应该在活动环境中使用规则(即,可以针对实际安全事件数据来测试和/或调试规则的功能) 。

Patent Agency Ranking