Detection of security incidents through simulations

    公开(公告)号:US10089475B2

    公开(公告)日:2018-10-02

    申请号:US15361288

    申请日:2016-11-25

    Applicant: SAP SE

    Abstract: A virtual testing environment VTE is instantiated for automated measurement of performance of a security monitoring system (SMS). Predefined attacks are executed against a cloned version of a monitored system in the VTE. The predefined attacks are defined at an attack catalog. Based on an execution result of the predefined attacks, a detection rate of the SMS at the VTE and a protection level of the cloned version of the monitored system are measured. Based on the detection rate and the protection level, an action for improving SMS and the protection of the monitored system is determined. Based on the determined action, logic modifications related to SMS and improvement on protection measures for the monitored system are performed.

    System and user context in enterprise threat detection

    公开(公告)号:US11252168B2

    公开(公告)日:2022-02-15

    申请号:US16125256

    申请日:2018-09-07

    Applicant: SAP SE

    Abstract: A transfer of master data is executed in a backend computing system. The master data includes user data and system data. The transfer of master data includes receiving user data associated with a particular user identifier in the backend computing system, transferring the received user data to an event stream processor, receiving system data associated with a particular log providing computing system in the backend computing system, transferring the received user data to the event stream processor, and executing a transfer of log data associated with logs of computing systems connected to the backend computing system.

    DETECTION OF SECURITY INCIDENTS THROUGH SIMULATIONS

    公开(公告)号:US20180150638A1

    公开(公告)日:2018-05-31

    申请号:US15361288

    申请日:2016-11-25

    Applicant: SAP SE

    CPC classification number: G06F21/577

    Abstract: A virtual testing environment VTE is instantiated for automated measurement of performance of a security monitoring system (SMS). Predefined attacks are executed against a cloned version of a monitored system in the VTE. The predefined attacks are defined at an attack catalog. Based on an execution result of the predefined attacks, a detection rate of the SMS at the VTE and a protection level of the cloned version of the monitored system are measured. Based on the detection rate and the protection level, an action for improving SMS and the protection of the monitored system is determined. Based on the determined action, logic modifications related to SMS and improvement on protection measures for the monitored system are performed.

    SYSTEM AND USER CONTEXT IN ENTERPRISE THREAT DETECTION

    公开(公告)号:US20220006828A1

    公开(公告)日:2022-01-06

    申请号:US17479850

    申请日:2021-09-20

    Applicant: SAP SE

    Abstract: A transfer of master data is executed in a backend computing system. The master data includes user data and system data. The transfer of master data includes receiving user data associated with a particular user identifier in the backend computing system, transferring the received user data to an event stream processor, receiving system data associated with a particular log providing computing system in the backend computing system, transferring the received user data to the event stream processor, and executing a transfer of log data associated with logs of computing systems connected to the backend computing system.

    SYSTEM AND USER CONTEXT IN ENTERPRISE THREAT DETECTION

    公开(公告)号:US20190007442A1

    公开(公告)日:2019-01-03

    申请号:US16125256

    申请日:2018-09-07

    Applicant: SAP SE

    Abstract: A transfer of master data is executed in a backend computing system. The master data includes user data and system data. The transfer of master data includes receiving user data associated with a particular user identifier in the backend computing system, transferring the received user data to an event stream processor, receiving system data associated with a particular log providing computing system in the backend computing system, transferring the received user data to the event stream processor, and executing a transfer of log data associated with logs of computing systems connected to the backend computing system.

Patent Agency Ranking