Intrusion threat detection

• US 20020112185A1
• Filed: 02/26/2001
• Published: 08/15/2002
• Est. Priority Date: 07/10/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Hodges, Jeffrey D.
• Granted Patent: US 8,661,539 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system is disclosed that can be used to monitor for an attempted intrusion of an access system. The system detects an access system event in the access system and determines whether the access system event is of a type that is being monitored. If the access system event is of a type that is being monitored, the system reports information about the access system event. This information can be used by a rules engine or other process to determine if the access system event was part of an attempted intrusion of the access system.

Claims

1. A method of monitoring for security information about an access system, comprising the steps of:

detecting an access system event in said access system;

determining that said access system event is of a type that is being monitored; and

reporting information about said access system event.

2. A method according to claim 1, wherein:

said step of detecting includes determining whether an entity is attempting to access a resource on a network without appropriate permissions.

3. A method according to claim 1, wherein:

said access system event is an authentication failure event.

4. A method according to claim 1, wherein:

said access system event is an authentication success event.

5. A method according to claim 1, wherein:

said access system event is an authorization failure event.

6. A method according to claim 1, wherein:

said access system event is an authorization success event.

7. A method according to claim 1, wherein:

said access system includes an access management system and an identity management system.

8. A method according to claim 1, further comprising the steps of:

storing information about said access system event.

9. A method according to claim 8, wherein:

said step of storing includes storing a log entry in a log about said access system event.

10. A method according to claim 9, wherein:

said step of detecting includes detecting said log entry.

11. A method according to claim 1, wherein:

said step of reporting includes reporting information from an identity profile, said identity profile pertains to a first user, said access system event involves said first user.

12. A method according to claim 11, wherein:

said step of reporting includes reporting an identification of a resource, said access system event pertains to said resource.

13. A method according to claim 11, wherein:

said step of reporting includes storing an identification of an access rule, said access system event utilizes said access rule.

14. A method according to claim 11, wherein:

said step of reporting includes reporting an identification of a time of said access system event.

15. A method according to claim 11, wherein:

said step of detecting an access event consists of denying authorization for said first user to access a resource.

16. A method according to claim 11, further comprising the step of:

accessing said identity profile in an LDAP directory.

17. A method according to claim 11, further comprising the step of:

receiving configuration information, said configuration information includes an identification of a type of access system event to monitor.

18. A method according to claim 11, further comprising the step of:

receiving configuration information, said configuration information includes an identification of identity profile attributes to store in said log entry.

19. A method according to claim 1, further comprising the steps of:

receiving a request to access a resource from said first user; and

attempting to authenticate said first user, said step of detecting includes denying authentication for said first user.

20. A method according to claim 19, wherein:

said step of attempting to authenticate said first user includes accessing said identity profile for said first user.

21. A method according to claim 19, wherein:

said step of attempting to authenticate said first user includes accessing said identity profile for said first user in an LDAP directory.

22. A method according to claim 1, wherein said step of reporting includes the steps of:

sending said information about said access system event to a database server;

grouping said information about said access system event with information about other events;

sending said information about said access system event and said information about other events to a security server; and

applying a rules engine at said security server to determine whether one or more attempted intrusions have occurred, based on said information about said access system event and said information about other events.

23. A method according to claim 1, wherein said step of reporting includes the steps of:

accessing instructions for an event type associated with said access system event; and

performing said instructions.

24. A method according to claim 23, wherein:

said step of performing said instructions includes transmitting said information about said access system event toward a rules engine for evaluating whether said access system event is related to a potential threat of intrusion.

25. A method according to claim 1, wherein:

said step of reporting includes determining whether said access system event is related to a potential threat of intrusion and providing an alert if said access system event is related to said potential threat of intrusion.

27. A method according to claim 26, wherein:

said step of reporting includes providing information from an identity profile in response to said access system event, said identity profile pertains to a first user, said access system event involves said first user.

28. A method according to claim 27, further comprising the step of:

accessing said identity profile in an LDAP directory.

29. A method according to claim 27, further comprising the step of:

receiving configuration information, said configuration information includes an identification of identity profile attributes to provide in said step of storing.

30. A method according to claim 26, wherein:

said step of reporting includes the steps of;

sending information about said access system event to a database server,

grouping said information about said access system event with information about other events,

sending said information about said access system event and said information about other events to a security server; and

said step of determining includes applying a rules engine at said security server to determine whether one or more attempted intrusions have occurred based on said information about said access system event and said information about other events.

31. A method according to claim 26, wherein said step of reporting includes the steps of:

accessing instructions for an event type associated with said access system event; and

performing said instructions.

26. A method of security monitoring, comprising the steps of:

detecting an access system event;

reporting said access system event; and

determining whether said access system event is part of an attempted intrusion of said access system.

32. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

detecting an access system event in an access system;

determining that said access system event is of a type that is being monitored; and

reporting information about said access system event.

33. One or more processor readable storage devices according to claim 32, wherein:

said step of reporting includes reporting information from an identity profile, said identity profile pertains to a first user, said access system event involves said first user.

34. One or more processor readable storage devices according to claim 33, wherein said step of reporting further includes the step of:

accessing said identity profile in an LDAP directory.

35. One or more processor readable storage devices according to claim 33, wherein said method further includes the step of:

receiving configuration information, said configuration information includes an identification of identity profile attributes to report.

36. One or more processor readable storage devices according to claim 32, wherein said step of reporting includes the steps of:

sending said information about said access system event to a database server;

grouping said information about said access system event with information about other events;

sending said information about said access system event and said information about other events to a security server; and

applying a rules engine at said security server to determine whether one or more attempted intrusions have occurred based on said information about said access system event and said information about other events.

37. One or more processor readable storage devices according to claim 32, wherein said step of reporting includes the steps of:

accessing instructions for an event type associated with said access system event; and

performing said instructions.

39. An access system according to claim 38, wherein said step of reporting includes the step of:

reporting information from an identity profile, said identity profile pertains to a first user, said access system event involves said first user.

40. An access system according to claim 39, wherein said method further includes the step of:

accessing said identity profile in an LDAP directory.

41. An access system according to claim 39, wherein said method further includes the step of:

receiving configuration information, said configuration information includes an identification of identity profile attributes to report.

42. An access system according to claim 38, wherein said step of reporting includes the steps of:

sending said information about said access system event to a database server;

grouping said information about said access system event with information about other events;

sending said information about said access system event and said information about other events to a security server; and

applying a rules engine at said security server to determine whether one or more attempted intrusions have occurred based on said information about said access system event and said information about other events.

43. An access system according to claim 38, wherein said step of reporting includes the steps of:

accessing instructions for an event type associated with said access system event; and

performing said instructions.

38. An access system, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to preform a method comprising the steps of;

detecting an access system event,

determining that said access system event is of a type that is being monitored, and

reporting information about said access system event.