×

Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems

  • US 10,038,704 B2
  • Filed: 09/04/2015
  • Issued: 07/31/2018
  • Est. Priority Date: 05/11/2004
  • Status: Active Grant
First Claim
Patent Images

1. A method of detecting a threat to a computer system in a plurality of collaborating computer systems, the method comprising:

  • receiving, at a first computer system, a first bloom filter from a collaborating second computer system, the first bloom filter representing encrypted first data relating to a source of a first intrusion attempt detected by an intrusion detection system of the collaborating second computer system;

    detecting, by the first computer system, a second intrusion attempt;

    producing a second bloom filter by performing a cryptographic function on second data relating to a source of the second intrusion attempt that results in an output value having a plurality of digits and using a subset of the plurality of digits of the output value as an index to the second bloom filter, wherein the subset does not include all of the plurality of digits of the output value;

    determining whether the second intrusion attempt correlates with the first intrusion attempt by comparing the first bloom filter and the second bloom filter; and

    indicating that a threat is present if the second intrusion attempt is determined to correlate with the first intrusion attempt,wherein receiving the first bloom filter from the collaborating second computer system comprises;

    grouping the collaborating second computer system and other collaborating systems into groups so that each collaborating system in a group occupies a position in that group;

    exchanging bloom filters between collaborating systems in the same position in the different groups; and

    rotating the position occupied by each member of at least one of the groups according to a schedule.

View all claims
  • 0 Assignments
Timeline View
Assignment View
    ×
    ×