-
1.发明授权Systems and methods for correlating log messages into actionable security incidents and managing human responses 有权将日志消息与可操作的安全事件相关联并管理人类响应的系统和方法公开(公告)号：US08156553B1
公开(公告)日：2012-04-10
申请号：US12171713
申请日：2008-07-11
IPC分类号： G06F11/00
CPC分类号： G06Q10/06
摘要： Systems and methods for correlating log messages into actionable incidents. Some embodiments implement a method which includes comparing a plurality of disparate log messages to a plurality of incident descriptions. The disparate log messages can be parsed. When the messages correlate with an incident description an incident case can be created. Workflow steps can be associated with the incident case and output along with the incident case. Additional disparate log messages can be compared to the incident expressions and, when additional messages correlate with the correlated incident description, the incident case can be adjusted. In some embodiments, the adjustment can include adding workflow steps to the incident case. Results of various workflow steps can be monitored and adjustments can be made accordingly. In some embodiments, the results can include out-of-bounds activities.
摘要翻译： 将日志消息与可执行事件相关联的系统和方法。 一些实施例实现一种方法，其包括将多个不同的日志消息与多个事件描述进行比较。 可以解析不同的日志消息。 当消息与事件描述相关时，可以创建事件案例。 工作流程步骤可以与事件案例和输出以及事件案例相关联。 可以将额外的不同日志消息与事件表达式进行比较，并且当附加消息与相关事件描述相关时，可以调整事件情况。 在一些实施例中，调整可以包括向事件案例添加工作流步骤。 可以监控各种工作流步骤的结果，并进行相应的调整。 在一些实施例中，结果可以包括超出范围的活动。
-
2.发明授权公开(公告)号：US08407335B1
公开(公告)日：2013-03-26
申请号：US12141202
申请日：2008-06-18
申请人： Christopher A. Church , Paul Fisher , Eugene Golovinsky , Pavel S Trakhtman , Mikhail Govshteyn
发明人： Christopher A. Church , Paul Fisher , Eugene Golovinsky , Pavel S Trakhtman , Mikhail Govshteyn
IPC分类号： G06F15/173 , G06F15/16 , G06F11/00
CPC分类号： G06F11/3082 , G06F11/0709 , G06F11/0787 , G06F11/3006
摘要： An appliance is co-located on a network with computing devices. Log messages generated by the computing devices are collected by the appliance, filtered based on the content and stored in transmission priority queues based on the content. The appliance packetizes the log messages based on the transmission priority queue and the available bandwidth and compresses the packet. The appliance encrypts the packet, digitally signs the encrypted packet and sends the packet to a first data center over a public network. The first data center stores the packet in reliable storage and performs processing on the data. A copy of the packet is sent to a second data center that stores the copy and performs processing on the copied data. The appliance deletes the packet from its buffer after it has received acknowledgement that the second data center has received the packet.
摘要翻译： 设备与计算设备共同位于网络上。 由计算设备生成的日志消息由设备收集，基于内容过滤并基于内容存储在传输优先级队列中。 设备根据传输优先级队列和可用带宽对日志消息进行分组，并压缩报文。 设备加密数据包，对加密的数据包进行数字签名，并通过公共网络将数据包发送到第一个数据中心。 第一个数据中心将数据包存储在可靠的存储器中，并对数据进行处理。 数据包的副本被发送到存储复制的第二数据中心，并对复制的数据执行处理。 在收到第二个数据中心收到数据包的确认后，设备会从缓冲区中删除数据包。
-
3.发明申请公开(公告)号：US20070169194A1
公开(公告)日：2007-07-19
申请号：US11321620
申请日：2005-12-29
IPC分类号： G06F12/14
CPC分类号： H04L63/1416 , G06F21/552 , G06F21/554
摘要： Embodiments of the invention provide a security expert system (SES) that automates intrusion detection analysis and threat discovery that can use fuzzy logic and forward-chaining inference engines to approximate human reasoning process. Embodiments of the SES can analyze incoming security events and generate a threat rating that indicates the likelihood of an event or a series of events being a threat. In one embodiment, the threat rating is determined based on an attacker rating, a target rating, a valid rating, and, optionally, a negative rating. In one embodiment, the threat rating may be affected by a validation flag. The SES can analyze the criticality of assets and calibrate/recalibrate the severity of an attack accordingly to allow for triage. The asset criticality can have a user-defined value. This ability allows the SES to protect and defend critical network resources in a discriminating and selective manner if necessary (e.g., many attacks).
摘要翻译： 本发明的实施例提供一种安全专家系统（SES），其自动化可以使用模糊逻辑和前向链接推理机来近似人类推理过程的入侵检测分析和威胁发现。 SES的实施例可以分析传入的安全事件并产生威胁等级，其指示事件或一系列事件成为威胁的可能性。 在一个实施例中，威胁等级是基于攻击者等级，目标等级，有效等级以及可选地为负的等级来确定的。 在一个实施例中，威胁等级可能受到验证标志的影响。 SES可以分析资产的关键性，并相应地校准/重新校准攻击的严重性，以便进行分诊。 资产重要性可以具有用户定义的值。 这种能力允许SES以必要的方式（例如，许多攻击）以辨别和选择的方式来保护和保护关键网络资源。
-
4.发明授权公开(公告)号：US07594270B2
公开(公告)日：2009-09-22
申请号：US11321620
申请日：2005-12-29
IPC分类号： G08B23/00
CPC分类号： H04L63/1416 , G06F21/552 , G06F21/554
摘要： Embodiments of the invention provide a security expert system (SES) that automates intrusion detection analysis and threat discovery that can use fuzzy logic and forward-chaining inference engines to approximate human reasoning process. Embodiments of the SES can analyze incoming security events and generate a threat rating that indicates the likelihood of an event or a series of events being a threat. In one embodiment, the threat rating is determined based on an attacker rating, a target rating, a valid rating, and, optionally, a negative rating. In one embodiment, the threat rating may be affected by a validation flag. The SES can analyze the criticality of assets and calibrate/recalibrate the severity of an attack accordingly to allow for triage. The asset criticality can have a user-defined value. This ability allows the SES to protect and defend critical network resources in a discriminating and selective manner if necessary (e.g., many attacks).
摘要翻译： 本发明的实施例提供一种安全专家系统（SES），其自动化可以使用模糊逻辑和前向链接推理机来近似人类推理过程的入侵检测分析和威胁发现。 SES的实施例可以分析传入的安全事件并产生威胁等级，其指示事件或一系列事件成为威胁的可能性。 在一个实施例中，威胁等级是基于攻击者等级，目标等级，有效等级以及可选地为负的等级来确定的。 在一个实施例中，威胁等级可能受到验证标志的影响。 SES可以分析资产的关键性，并相应地校准/重新校准攻击的严重性，以便进行分诊。 资产重要性可以具有用户定义的值。 这种能力允许SES以必要的方式（例如，许多攻击）以辨别和选择的方式来保护和保护关键网络资源。
-
-
-
搜索结果
4 条记录 (耗时 0.018 秒)
