Method and system for separating rules of a security policy from detection criteria

    公开(公告)号:US20060161965A1

    公开(公告)日:2006-07-20

    申请号:US11039637

    申请日:2005-01-19

    IPC分类号: H04L9/00 G06F17/00 H04K1/00

    CPC分类号: G06F21/55

    摘要: A method and system that enables a security policy to separate developer-provided detection criteria from an administrator-provided custom policy is provided. The security system allows a developer of detection criteria to provide a signature file containing the signatures that are available for use by a security policy. The security system also allows an administrator of a computer system to specify a custom policy that uses the signatures of the signature file. The developer may distribute the signature file to host computer systems independently of the administrator's distribution of the rules of the custom policy to the host computer systems. When a security enforcement event occurs at the host computer system, the security system applies the rules of the security policy to the event.

    Method and system for separating rules of a security policy from detection criteria
    4.
    发明授权
    Method and system for separating rules of a security policy from detection criteria 有权
    将安全策略的规则与检测标准分开的方法和系统

    公开(公告)号:US07591010B2

    公开(公告)日:2009-09-15

    申请号:US11039637

    申请日:2005-01-19

    IPC分类号: G06F9/00 G06F15/16 G06F17/00

    CPC分类号: G06F21/55

    摘要: A method and system that enables a security policy to separate developer-provided detection criteria from an administrator-provided custom policy is provided. The security system allows a developer of detection criteria to provide a signature file containing the signatures that are available for use by a security policy. The security system also allows an administrator of a computer system to specify a custom policy that uses the signatures of the signature file. The developer may distribute the signature file to host computer systems independently of the administrator's distribution of the rules of the custom policy to the host computer systems. When a security enforcement event occurs at the host computer system, the security system applies the rules of the security policy to the event.

    摘要翻译: 提供了一种使安全策略能够将开发人员提供的检测标准与管理员提供的自定义策略分开的方法和系统。 安全系统允许检测标准的开发者提供包含可由安全策略使用的签名的签名文件。 安全系统还允许计算机系统的管理员指定使用签名文件签名的自定义策略。 开发人员可以将签名文件分发到主机计算机系统,而不管管理员将自定义策略的规则分发给主机系统。 当主机计算机系统发生安全执行事件时,安全系统将安全策略的规则应用于事件。