Stateful distributed event processing and adaptive security

• US 20020194495A1
• Filed: 06/14/2002
• Published: 12/19/2002
• Est. Priority Date: 06/14/2001
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Gladstone, Philip J.S., Kraemer, Jeffrey A.
• Granted Patent: US 7,594,267 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

The invention provides method and apparatus for maintaining a networked computer system including first and second nodes and an event processing server, the method comprising the first and second nodes detecting changes in state, the event processing server receiving notification of the changes in state from the first and second nodes, the event processing server correlating changes in state detected in the first and second nodes, and the event processing server executing a maintenance decision which affects the first and second nodes. The detecting, transmitting, correlating, and executing occurs without human intervention.

Claims

1. A method of maintaining a networked computer system including first and second nodes and an event processing server, comprising:

the first and second nodes detecting changes in state;

the event processing server receiving notification of the changes in state from the first and second nodes;

the event processing server correlating changes in state detected in the first and second nodes; and

the event processing server executing a maintenance decision which affects the first and second nodes;

wherein the detecting, transmitting, correlating, and executing occurs without human intervention.

2. The method of claim 1 wherein the changes in state are a result of at least one of an event and the absence of an event.

3. The method of claim 1 wherein the changes in state are recognized by a reference monitor.

4. The method of claim 3 wherein the monitor is a stateful reference monitor.

5. The method of claim 1 wherein the event processing server receiving the report is the result of one of the first and second nodes reporting to the event processing server, and the event processing server polling the first and second nodes.

6. The method of claim 1 further including the event processing server updating an operating policy on the network.

7. The method of claim 6 wherein the updating the operating policy includes at least one of requesting security policy changes on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters.

8. The method of claim 6 further including at least one node enacting the updated operating policy.

9. The method of claim 1 further including notifying an external entity of actions taken.

10. The method of claim 9, wherein the external entity is a network administrator.

11. The method of claim 9, wherein the external entity is a software application executing on the network.

13. The method of claim 12 wherein the change in state is a result of at least one of an event and the absence of an event.

14. The method of claim 12 wherein the change in state is recognized by a reference monitor.

15. The method of claim 14 wherein the reference monitor is a stateful reference monitor.

16. The method of claim 12 wherein the event processing server receiving the report is the result of one of the node reporting to the event processing server, and the event processing server polling the node.

17. The method of claim 12 wherein the maintenance decision affects the at least one node detecting the change in state.

18. The method of claim 12 wherein the maintenance decision affects at least one node other than the node detecting the change in state.

19. The method of claim 12 further including the event processing server updating an operating policy on the network.

20. The method of claim 19 wherein the updating the operating policy includes at least one of requesting security policy changes on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters.

21. The method of claim 19 further including at least one node enacting the updated operating policy.

22. The method of claim 12, further including notifying an external entity of actions taken.

23. The method of claim 22, wherein the external entity is a network administrator.

24. The method of claim 22, wherein the external entity is a software application executing on the network.

26. The method of claim 25 wherein the change in state is a result of at least one of an event and the absence of an event.

27. The method of claim 25 wherein the change in state is recognized by a reference monitor.

28. The method of claim 27 wherein the reference monitor is a stateful reference monitor.

29. The method of claim 25 further including the at least one node notifying an event processing server on the network.

30. The method of claim 25 further including the event processing server responding to the notification by updating an operating policy on the network.

31. The method of claim 30 wherein the updating the operating policy includes at least one of requesting updates to security policy on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters.

32. The method of claim 30 further including the at least one node enacting the updated operating policy.

33. The method of claim 25, further including notifying an external entity of actions taken.

34. The method of claim 33, wherein the external entity is a network administrator.

35. The method of claim 33, wherein the external entity is a software application executing on the network.

37. The computer-readable medium of claim 36 further including instructions defining communicating the change in state to an event processing server.

38. The computer-readable medium of claim 37 further including instructions defining processing maintenance instructions received from the event processing server.

39. The computer-readable medium of claim 36 further including instructions defining transmitting notification to a network administrator of actions taken.

12. A method for maintaining a networked computer system including:

at least one node detecting a change in state;

an event processing server on the network receiving notification of the at least one change in state from the at least one node; and

the event processing server responding to the notification by executing a maintenance decision;

wherein the detecting, receiving, and responding occurs without human intervention.

25. A method for maintaining a node on a networked computer system including:

at least one node detecting a change in state; and

the at least one node reacting to the change in state;

wherein the at least one node detecting and reacting occurs without human intervention.

36. A computer-readable medium having instructions recorded thereon, which instructions, when executed, enable at least one processor in a networked computer system to:

detect a change in state of a node; and

process instructions defining reacting to the detected change in state.

40. A computer-readable medium having instructions recorded thereon, which instructions, when executed, enable at least one processor in a networked computer system to:

maintain an operating policy for the network;

receive notification of a change in state from at least one node; and

update the operating policy based on the change in state.

41. The computer-readable medium of claim 40 further including instructions defining storing received notifications of changes in state in memory.

42. The computer-readable medium of claim 41 further including instructions defining correlating notifications received from a plurality of nodes.

43. The computer-readable medium of claim 41 further including instructions defining storing received notifications in electronic file storage.

44. The computer-readable medium of claim 40, further including instructions defining notifying an external entity of actions taken.

45. The computer-readable medium of claim 44, wherein the external entity is a network administrator.

46. The computer-readable medium of claim 44, wherein the external entity is a software application executing on the network.

48. The method of claim 47, further comprising an act of:

executing, by a human operator, the maintenance decision on at least one node on the networked computer system.

49. The method of claim 47, further comprising an act of:

executing, without human intervention, the maintenance decision on at least one node on the networked computer system.

50. The method of claim 49, wherein a human operator is prompted and allotted a predetermined period to execute the maintenance decision before it is executed without human intervention.

47. A method for maintaining a networked computer system including:

at least one node detecting a change in state;

an event processing server on the network receiving notification of the at least one change in state from the at least one node; and

the event processing server responding to the notification by dispensing a maintenance decision.