Apparatus and method for automatic handling of cyber-security risk events

• US 10,021,119 B2
• Filed: 09/30/2015
• Issued: 07/10/2018
• Est. Priority Date: 02/06/2015
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Carpenter, Seth G., Dietrich, Kenneth W.
• Primary Examiner(s): Shepperd, Eric W
• Application Number:
  US14/871,503
• Publication Number:
  US 20160234229A1
• Time in Patent Office: 1,014 Days
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

This disclosure provides an apparatus and method for automatic handling of cyber-security risk events and other risk events. A method includes detecting, by a monitoring system, a first event associated with a device in a computing system. The method includes initializing a risk item corresponding to the first event, and setting the risk item to a full risk value, in response to detecting the event. The method includes determining whether a second event, corresponding to the first event, has been detected. The method includes altering the risk value over time in response to determining that no second event has been detected. The method includes determining if the risk value for the risk item has passed a threshold. The method includes clearing the event in response to the risk value passing the threshold.

Claims

1. A method comprising:

detecting, by a monitoring system, a first event associated with a device in a computing system;

in response to detecting the event, initializing a risk item corresponding to the first event, by the monitoring system, and setting the risk item to a full risk value;

determining, by the monitoring system, whether a second event, corresponding to the first event, has been detected, wherein the second event corresponds to the first event when the second event is a repeat of the first event, is a same type of event as the first event, or is generated by a same process, system, or device as the first event;

in response to determining, by the monitoring system, that no second event has been detected, reducing the risk value over time;

in response to determining, by the monitoring system, that multiple corresponding second events have been detected, increasing the risk value to value that is greater than the full risk value;

altering, by the monitoring system, when no second event has been detected, the risk value by reducing the risk value according to a decay function wherein the decay function is defined as;

For t<

P;

Risk=R*(1−

(t/P))

For t>

=P;

Risk=0,

where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected;

determining, by the monitoring system, if the risk value for the risk item has passed a threshold; and

clearing the event, by the monitoring system, in response to the risk value passing the threshold.

2. The method of claim 1, further comprising storing event details for the first event.

3. The method of claim 1, further comprising, in response to determining that a single second event has been detected, not altering the risk value.

4. The method of claim 1, wherein, the risk value that is greater than the full risk value indicates a significant ongoing risk.

5. The method of claim 1, further comprising displaying an alert that indicates the risk item and the risk value.

6. The method of claim 1, wherein a user specifies whether the second event is the repeat of the first event, is the same type of event as the first event, or is generated by the same process system, or device as the first event.

7. A monitoring system, further comprising:

a processing device;

a memory; and

a network interface,

wherein the processing device is configured to;

detect a first event associated with a device in a computing system;

in response to detecting the event, initialize a risk item corresponding to the first event and set the risk item to a full risk value;

determine whether a second event, corresponding to the first event, has been detected, wherein the second event corresponds to a first event when the second event is a repeat of the first event, is a same type of event as the first event, or is generated by a same process, system, or device as the first event;

in response to determining that no second event has been detected, alter the risk value over time;

in response to determining that no second event has been detected, increase the risk value to a value that is greater than the full risk value;

altering, by the monitoring system, when no second event has been detected, the risk value by reducing the risk value according to a decay function wherein the decay function is defined as;

For t<

P;

Risk=R*(1−

(t/P))

For t>

=P;

Risk=0,

where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected;

determine if the risk value for the risk item has passed a threshold; and

clear the event in response to the risk value passing the threshold.

8. The monitoring system of claim 7, wherein the monitoring system also stores event details for the first event.

9. The monitoring system of claim 7, wherein, in response to determining that a single second event has been detected, the monitoring system does not alter the risk value.

10. The monitoring system of claim 7, wherein, the risk value that is greater than the full risk value indicates a significant ongoing risk.

11. The monitoring system of claim 7, wherein the monitoring system displays an alert that indicates the risk item and the risk value.

12. A non-transitory computer-readable medium encoded with computer readable program code that, when executed, causes a monitoring system to:

detect a first event associated with a device in a computing system;

in response to detecting the event, initialize a risk item corresponding to the first event and set the risk item to a full risk value;

determine whether a second event, corresponding to the first event, has been detected, wherein the second event corresponds to the first event when the second event is a repeat of the first event, is a same type of event as the first event, or is generated by a same type of event as the first event, or is generated by same process, system, or device as the first event;

in response to determining that no second event has been detected, alter the risk value over time;

in response to determining that multiple corresponding second events have been detected, increase the risk value to a value that is greater than the full risk value;

executing by the computer readable program code, when no second event has been detected, to reduce the risk value by reducing the risk value according to a decay function wherein the decay function is defined as;

For t<

P;

Risk=R*(1−

(t/P))

For t>

=P;

Risk=0,

where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected;

determine if the risk value for the risk item has passed a threshold; and

clear the event in response to the risk value passing the threshold.

13. The non-transitory computer-readable medium of claim 12, wherein the monitoring system also stores event details for the first event.

14. The non-transitory computer-readable medium of claim 12, wherein, in response to determining that the second event has been detected, the monitoring system does not alter the risk value.

15. The non-transitory computer-readable medium of claim 12, wherein, in response to determining that multiple second events have been detected, the monitoring system alters the risk value to a value that indicates a significant ongoing risk.