System and method for auditing governance, risk, and compliance using a pluggable correlation architecture

• US 10,057,285 B2
• Filed: 04/15/2009
• Issued: 08/21/2018
• Est. Priority Date: 01/30/2009
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Choudhary, Usman, Antony, John Melvin, Cooper, Michael Howard, Srinivasan, Pattabiraman
• Primary Examiner(s): Mincarelli, Jan P
• Application Number:
  US12/424,428
• Publication Number:
  US 20100198636A1
• Time in Patent Office: 3,415 Days
• Field of Search: 705 11, 715757, 715736, 714 471
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Described herein is a system and method for auditing governance, risk, and compliance using an event correlation architecture. In particular, the event correlation architecture may include a solution designer for defining a solution pack that enforces one or more specific governance, risk, or compliance controls, and a solution manager for deploying the solution pack within the event correlation architecture to configure the architecture for enforcement of the one or more controls. Thus, a collection of content defined in the solution pack may be used to enrich one or more events received at the event correlation architecture, and a correlation engine may then correlate the events using the content in the solution pack to enforce the one or more governance, risk, or compliance controls.

Claims

1. A method for auditing computer network security risk using an event correlation architecture, comprising:

executing, by a computer system, a correlation runtime environment having an extensible service-oriented architecture and comprising a collection manager configured to enforce intrusion detection, data integrity, and network security controls;

deploying a set of two or more correlation engines into the correlation runtime environment, the set of two or more correlation engines comprising;

an intrusion detection correlation engine configured to evaluate an event stream in a first format according to first semantics and in view of predefined network security rules; and

a compliance correlation engine configured to evaluate the event stream in a second format according to second semantics and in view of predefined regulatory rules;

collecting, by the computer system through the collection manager, information from each of a plurality of disparate sources;

adding, by the computer system through the collection manager, metadata to the collected information, the metadata defining the respective business relevance for each event of a plurality of events corresponding to the collected information and normalizing the collected information across the plurality of disparate sources into event information based at least partially on a policy-based taxonomy categorizing the collected information as corresponding to one or more events of the plurality of events, wherein the respective business relevance is based at least partially on one or more metadata tags identifying an asset value for the respective event of the plurality of events;

exposing an application program interface by execution of a configuration module to facilitate pluggable event correlation at least partially by user-customization of the correlation runtime environment via execution of;

a rule builder receiving rule definitions via the exposed application program interface to define expressions associated with a plurality of rules;

an action builder receiving action definitions to define actions associated with correlated events;

the rule builder and the action builder defining rules, expressions, and associated actions based at least partially on the rule definitions and the actions associated with the correlated events via the exposed application program interface, the defined rules and the defined expressions representing patterns of events relating to relationships among events and comprising;

a first subrule that includes a first filtering expression defined to trigger when a first event of the plurality of events occurs, wherein the first filtering expression comprises determining whether the event information indicates that a severity threshold or a criticality requirement is satisfied for the first event of the plurality of events;

a second subrule that includes a second filtering expression defined to trigger when a second event occurs, wherein the second filtering expression is different from the first filtering expression;

a rule contingent on the first subrule and the second subrule, the rule builder facilitating definition of an aggregate rule to trigger upon repeat subrule triggers a specified number of times in a specified time period, a composite rule to trigger upon different subrule triggers within the specified time period, and a sequence rule to trigger upon subrule triggering in a specified sequence;

deploying the defined rules, the defined expressions, and the defined associated action into the correlation runtime environment so that the set of two or more correlation engines are further configured to evaluate the defined expressions associated with the plurality of rules to determine whether the event stream includes one or more events occur in a predetermined pattern;

converting, by the computer system through the collection manager using one or more input adapters, the event information corresponding to the plurality of events into different formats, each having different semantics, used by the set of two or more correlation engines, the different formats comprising the first format according to first semantics and the second format according to second semantics;

correlating, by the computer system through the set of two or more correlation engines, two or more events of the plurality of events based at least partially on the predefined network security rules, the predefined regulatory rules, the defined expressions associated with the plurality of rules, the event information in the different semantic formats, and the metadata added to each event, and determining that the rule contingent on the first subrule and the second subrule has been triggered;

converting, by the computer system through the collection manager using one or more output adapters, an output, corresponding to the correlated two or more events and the actions defined with the action builder, from one or more of the different formats having the different semantics into another distinct format used by a set of one or more workflow engines;

generating, by the computer system through the set of one or more workflow engines, a remediation workflow responsive to the output, the remediation workflow to coordinate processes for threat remediation and the remediation workflow specifies the actions defined with the action builder; and

executing, by the computer system, the actions specified by the remediation workflow to enforce the network security controls, the one or more actions corresponding to denying access to a node or disabling a user account.

2. The method of claim 1, further comprising correlating the filtered event information to content in a deployed solution pack at least in part by:

correlating each of the plurality of events with the one or more rules based on the metadata added to each event, the one or more rules comprising rules for evaluating patterns in the events; and

initiating one or more actions of at least one rule of the one or more rules in response to the correlation engine determining that at least one of the events of the filtered event information triggers the at least one rule.

3. The method of claim 1, further comprising generating, by the computer system, one or more reports, wherein the reports generated provide information relating to enforcement of one or more of the intrusion detection, the data integrity, and/or the network security controls.

4. A system comprising:

a processor; and

a memory coupled with the processor and storing a set of instructions which, when executed by the processor, causes the processor to audit computer network security risk, using an event correlation environment by;

executing a correlation runtime environment having an extensible service-oriented architecture and comprising a collection manager configured to enforce governance, risk, and compliance controls;

deploying a set of two or more correlation engines into the correlation runtime environment, the set of two or more correlation engines comprising;

an intrusion detection correlation engine configured to evaluate an event stream in a first format according to first semantics and in view of predefined network security rules; and

a compliance correlation engine configured to evaluate the event stream in a second format according to second semantics and in view of predefined regulatory rules;

collecting through the collection manager information from each of a plurality of disparate sources;

adding, through the collection manager, metadata to the collected information, the metadata defining the respective business relevance for each event of a plurality of events corresponding to the collected information and normalizing the collected information across the plurality of disparate event sources into event information based at least partially on a policy-based taxonomy categorizing the collected information as corresponding to one or more events of the plurality of events, wherein the respective business relevance is based at least partially on one or more metadata tags identifying an asset value for the respective event of the plurality of events;

exposing an application program interface by execution of a configuration module to facilitate pluggable event correlation at least partially by user-customization of the correlation runtime environment via execution of;

a rule builder receiving rule definitions via the exposed application program interface to define expressions associated with a plurality of rules;

an action builder receiving action definitions to define actions associated with correlated events;

the rule builder and the action builder defining rules, expressions, and associated actions based at least partially on the rule definitions and the actions associated with the correlated events via the exposed application program interface, the defined rules and the defined expressions representing patterns of events relating to relationships among events and comprising;

a first subrule that includes a first filtering expression defined to trigger when a first event of the plurality of events occurs, wherein the first filtering expression comprises determining whether the event information indicates that a severity threshold or a criticality requirement is satisfied for the first event of the plurality of events;

a second subrule that includes a second filtering expression defined to trigger when a second event occurs, wherein the second filtering expression is different from the first filtering expression;

a rule contingent on the first subrule and the second subrule, the rule builder facilitating definition of an aggregate rule to trigger upon repeat subrule triggers a specified number of times in a specified time period, a composite rule to trigger upon different subrule triggers within the specified time period, and a sequence rule to trigger upon subrule triggering in a specified sequence;

deploying the defined rules, the defined expressions, and the defined associated action into the correlation runtime environment so that the set of two or more correlation engines are further configured to evaluate the defined expressions associated with the plurality of rules to determine whether the event stream includes one or more events occur in a predetermined pattern;

converting, through the collection manager using one or more input adapters, the event information corresponding to the plurality of events into different formats, each having different semantics, used by the set of two or more correlation engines, the different formats comprising the first format according to first semantics and the second format according to second semantics;

correlating, through the set of two or more correlation engines, two or more events of the plurality of events based at least partially on the predefined network security rules, the predefined regulatory rules, the defined expressions associated with the plurality of rules, the event information in the different semantic formats, and the metadata added to each event, and determining that the rule contingent on the first subrule and the second subrule has been triggered;

converting, through the collection manager using one or more output adapters, an output corresponding to the correlated two or more events and the actions defined with the action builder, from one or more of the different formats having the different semantics into another distinct format used by a set of one or more workflow engines;

generating, through the set of one or more workflow engines, a remediation workflow responsive to the output, the remediation workflow to coordinate processes for threat remediation and the remediation workflow specifies the actions defined with the action builder; and

executing the one or more actions specified by the remediation workflow to enforce the network security controls, the one or more actions corresponding to denying access to a node or disabling a user account.

5. The system of claim 4, further comprising correlating the event information to content in a deployed solution pack at least in part by:

correlating each of the plurality of events with the one or more rules based on the metadata added to each event, the one or more rules comprising rules for evaluating patterns in the events; and

initiating one or more actions of at least one rule of the one or more rules in response to the correlation engine determining that at least one of the events of the event information triggers the at least one rule.

6. The system of claim 4, further comprising generating one or more reports, wherein the reports generated provide information relating to enforcement of one or more of intrusion detection, data integrity, and/or the network security controls.

7. A non-transitory, computer-readable memory device storing a set of instructions which, when executed by a processor, causes the processor to audit computer network security risk using an event correlation architecture by:

executing a correlation runtime environment having an extensible service-oriented architecture and comprising a collection manager configured to enforce one or more governance, risk, and compliance controls;

deploying a set of two or more correlation engines into the correlation runtime environment, the set of two or more correlation engines comprising;

an intrusion detection correlation engine configured to evaluate an event stream in a first format according to first semantics and in view of predefined network security rules; and

a compliance correlation engine configured to evaluate the event stream in a second format according to second semantics and in view of predefined regulatory rules;

collecting through the collection manager information from each of a plurality of disparate sources;

adding, through the collection manager, metadata to the collected information, the metadata defining the respective business relevance for each event of a plurality of events corresponding to the collected information and normalizing the collected information across the plurality of disparate event sources into event information based at least partially on a policy-based taxonomy categorizing the collected information as corresponding to one or more events of the plurality of events, wherein the respective business relevance is based at least partially on one or more metadata tags identifying an asset value for the respective event of the plurality of events;

exposing an application program interface by execution of a configuration module to facilitate pluggable event correlation at least partially by user-customization of the correlation runtime environment via execution of;

a rule builder receiving rule definitions via the exposed application program interface to define expressions associated with a plurality of rules;

an action builder receiving action definitions to define actions associated with correlated events;

the rule builder and the action builder defining rules, expressions, and associated actions based at least partially on the rule definitions and the actions associated with the correlated events via the exposed application program interface, the defined rules and the defined expressions representing patterns of events relating to relationships among events and comprising;

a first subrule that includes a first filtering expression defined to trigger when a first event of the plurality of events occurs, wherein the first filtering expression comprises determining whether the event information indicates that a severity threshold or a criticality requirement is satisfied for the first event of the plurality of events;

a second subrule that includes a second filtering expression defined to trigger when a second event occurs, wherein the second filtering expression is different from the first filtering expression;

a rule contingent on the first subrule and the second subrule, the rule builder facilitating definition of an aggregate rule to trigger upon repeat subrule triggers a specified number of times in a specified time period, a composite rule to trigger upon different subrule triggers within the specified time period, and a sequence rule to trigger upon subrule triggering in a specified sequence;

deploying the defined rules, the defined expressions, and the defined associated action into the correlation runtime environment so that the set of two or more correlation engines are further configured to evaluate the defined expressions associated with the plurality of rules to determine whether the event stream includes one or more events occur in a predetermined pattern;

converting, through the collection manager using one or more input adapters, the event information corresponding to the plurality of events into different formats, each having different semantics, used by the set of two or more correlation engines, the different formats comprising the first format according to first semantics and the second format according to second semantics;

correlating, through the set of two or more correlation engines, two or more events of the plurality of events based at least partially on the predefined network security rules, the predefined regulatory rules, the defined expressions associated with the plurality of rules, the event information in the different semantic formats, and the metadata added to each event, and determining that the rule contingent on the first subrule and the second subrule has been triggered;

converting, through the collection manager using one or more output adapters, an output corresponding to the correlated two or more events and the actions defined with the action builder, from one or more of the different formats having the different semantics into another distinct format used by a set of one or more workflow engines;

generating, through the set of one or more workflow engines, a remediation workflow responsive to the output, the remediation workflow to coordinate processes for threat remediation and the remediation workflow specifies the actions defined with the action builder; and

executing the actions specified by the remediation workflow to enforce the network security controls, the one or more actions corresponding to denying access to a node or disabling a user account.

8. The non-transitory, computer-readable memory device of claim 7, wherein the auditing comprises:

correlating the event information to content in a deployed solution pack at least in part by;

correlating each of the plurality of events with the one or more rules based on the metadata added to each event, the one or more rules comprising rules for evaluating patterns in the events; and

initiating one or more actions of at least one rule of the one or more rules in response to the correlation engine determining that at least one of the events of the filtered event information triggers the at least one rule.

9. The non-transitory, computer-readable memory device of claim 7, wherein the auditing comprises generating one or more reports, wherein the reports generated provide information relating to enforcement of one or more of intrusion detection, data integrity, and/or the network security controls.