Hierarchy-based method and apparatus for detecting attacks on a computer system

• US 20030004689A1
• Filed: 06/13/2002
• Published: 01/02/2003
• Est. Priority Date: 06/13/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Gong, Fengmin, Gupta, Ramesh M., Raman, Ananth, Vissamsetti, Srikant, Jain, Parveen K., Amidon, Keith E., Haeffele, Steve M.
• Granted Patent: US 7,234,168 B2
• Time in Patent Office: Days
• US Class Current: 702/188
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A method of provisioning a computer against computer attacks includes constructing a hierarchy characterizing different computer attacks and counter measures, and traversing this hierarchy to identify computer attacks and countermeasures relevant to a target platform. Detection and protection measures are collected in response to this traversing. These detection and protection measures are then downloaded to a security sensor associated with the target platform.

This application claims priority to provisional patent application 60/298,220, which was filed on Jun. 13, 2001.

Claims

1. A method of provisioning a computer against computer attacks, comprising:

constructing a hierarchy characterizing different computer attacks and counter measures;

traversing said hierarchy to identify computer attacks and countermeasures relevant to a target platform;

collecting detection and protection measures in response to said traversing; and

downloading said detection and protection measures to a security sensor associated with said target platform.