Global deployment of host-based intrusion sensors

• US 20030093692A1
• Filed: 11/13/2001
• Published: 05/15/2003
• Est. Priority Date: 11/13/2001
• Status: Abandoned Application

• Current Assignee: SRI International, Inc.
• Original Assignee: SRI International, Inc.
• Inventors: Porras, Phillip A.
• Application Number:
  US10/012,104
• Publication Number:
  US 20030093692A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method includes, in a server, receiving parameters pertinent to host systems connected to a local area network and deploying a host-based intrusion detection system from the server to each of the host systems based on the received parameters.

Claims

1. A method comprising:

in a server, receiving parameters pertinent to host systems connected to a local area network; and

deploying a host-based intrusion detection system from the server to each of the host systems based on the received parameters.

2. The method of claim 1 in which one of the parameters come from the group comprising of an Internet Protocol (IP) addresses for each of the host systems, administrative account information for each of the host systems, or a preferred target directory for each of the host systems.

3. The method of claim 1 in which deploying comprises:

logging into an administrative account on each of the hosts systems;

loading the host-based intrusion detection system into a target directory in each of the host systems;

installing the host-based intrusion detection systems in each of the host systems; and

starting the host-based intrusion detection system in each of the host systems.

4. The method of claim 1 further comprising configuring the host-based intrusion detection system on each of the host systems from the server.

5. The method of claim 4 in which configuring comprises updating configuration files on each of the host systems using S-HTTP on the server.

6. The method of claim 5 in which updating comprises interaction through a browser-like interface on the server.

7. The method of claim 4 further comprising monitoring alerts generated by each of the host-based intrusion detection systems in each of the hosts using a viewer installed on the server.

8. The method of claim 7 in which the viewer comprises an S-HTTP graphical user interface (GUI).

14. The computer program product of claim 3 in which updating comprises interaction through a browser-like interface on the server.

16. The computer program product of claim 7 in which the viewer is an S-HTTP graphical user interface (GUI).

9. A computer program product residing on a computer readable medium having instructions stored thereon which, when executed by the processor, cause the processor to:

in a server, receive parameters pertinent to host systems connected to a local area network; and

deploy a host-based intrusion detection system from the server to each of the host systems in conjunction with the received parameters.

10. The computer program product of claim 9 in which one of the parameters come from the group comprising of:

Internet Protocol (IP) addresses for each of the host systems;

administrative account information for each of the host systems; and

a preferred target directory for each of the host systems.

11. The computer program product of claim 9 in which the instruction to deploy comprises:

logging into an administrative account on each of the hosts systems;

loading the host-based intrusion detection system into a target directory in each of the host systems;

installing the host-based intrusion detection systems in each of the host systems; and

starting the host-based intrusion detection system in each of the host systems.

12. The computer program product of claim 9 further comprising an instruction to configure the host-based intrusion detection system on each of the host systems from the server.

13. The computer program product of claim 12 in which the instruction to configure comprises updating configuration files on each of the host systems using S-HTTP on the server.

15. The computer program product of claim 12 further comprising an instruction to monitor alerts generated by each of the host-based intrusion detection systems in each of the hosts on a viewer installed on the server.

17. A system comprising:

a network of host systems;

a network appliance connected to the network, the network appliance comprising;

a graphical user interface (GUI);

means for receiving parameters pertinent to host systems; and

means for deploying a host-based intrusion detection system to each of the host systems in conjunction with the received parameters.

18. The system of claim 17 in which the GUI is an S-HTTP GUI.

19. The system of claim 17 in which the GUI is a web-like browser.

20. The system of claim 17 in which one of the parameters come from the group comprising of:

Internet Protocol (IP) addresses for each of the host systems;

administrative account information for each of the host systems; and

a preferred target directory for each of the host systems.

22. The system of claim 17 further comprising means for configuring the host-based intrusion detection system on each of the host systems from the server.

23. The system of claim 22 in which means for configuring comprises updating configuration files on each of the host systems using S-HTTP on the server through the GUI.

24. The system of claim 23 in which updating comprises interaction through a browser-like interface on the server.

25. The system of claim 22 further comprising means monitoring alerts generated by each of the host-based intrusion detection systems in each of the hosts on a viewer installed on the server.

26. The system of claim 25 in which the viewer is an S-HTTP graphical user interface (GUI).

21. The system of 17 in which the means for deploying comprises:

logging into an administrative account on each of the hosts systems;

loading the host-based intrusion detection system into a target directory in each of the host systems;

installing the host-based intrusion detection systems in each of the host systems; and

starting the host-based intrusion detection system in each of the host systems.

27. A processor and a memory configured to:

receive parameters pertinent to host systems connected to a local area network in a server; and

deploy a host-based intrusion detection system from the server to each of the host systems in conjunction with the received parameters.

28. A method comprising:

in a host system residing on a network, receiving a remote request from a server to log on to administrative account; and

receiving an installation of a host-based intrusion detection system from the server.

29. The method of claim 28 further comprising sending alerts from the host-based intrusion system to the server.

30. The method of claim 28 in which the installation comprises allowing the server to unpack, install and start the host-based intrusion detection system.

31. The method of claim 28 further comprising receiving configuration changes for the host-based intrusion detection system from the server.

32. The method of claim 31 further comprising sending a local copy of a configuration file to the server.

33. A method comprising:

in a server, receiving parameters pertinent to host systems connected to a local area network; and

deploying an information sensor from the server to each of the host systems based on the received parameters.

34. The method of claim 33 in which one of the parameters comes from the group comprising of an Internet Protocol (IP) address for each of the host systems, administrative account information for each of the host systems, or a preferred target directory for each of the host systems.

35. The method of claim 33 in which the information sensor generates intrusion alarms.

36. The method of claim 33 in which the information sensor generates anomaly reports.

37. The method of claim 33 in which the information sensor generates information pertaining to security of each of the host systems.

38. The method of claim 33 in which deploying comprises:

logging into each of the hosts systems; and

loading the information sensor into a target directory in each of the host systems.

39. The method of claim 38 in which deploying further comprises installing the information sensor.

40. The method of claim 39 in which deploying further comprises starting the information sensor in each of the host systems.

41. The method of claim 33 further comprising configuring the information sensor on each of the host systems from the server.

42. The method of claim 41 in which configuring comprises updating configuration files on each of the host systems using a cryptographically secure communication channel on the server.

43. The method of claim 42 in which the cryptographically secure communication channel is S-HTTP.

44. The method of claim 42 in which updating comprises interaction through a browser-like interface on the server.

45. The method of claim 41 further comprising monitoring alerts generated by each of the information sensors in each of the hosts using a viewer installed on the server.

46. The method of claim 45 in which the viewer comprises a cryptographically secure communication channel graphical user interface (GUI).

60. The computer program product of claim 45 in which the viewer comprises a cryptographically secure communication channel graphical user interface (GUI).

47. A computer program product residing on a computer readable medium having instructions stored thereon which, when executed by the processor, cause the processor to:

in a server, receive parameters pertinent to host systems connected to a local area network; and

deploy an information sensor from the server to each of the host systems based on the received parameters.

48. The computer program product of claim 47 in which one of the parameters come from the group comprising of an Internet Protocol (IP) address for each of the host systems, administrative account information for each of the host systems, or a preferred target directory for each of the host systems.

49. The computer program product of claim 47 in which the information sensor generates intrusion alarms.

50. The computer program product of claim 47 in which the information sensor generates anomaly reports.

51. The computer program product of claim 47 in which the information sensor generates information pertaining to security of each of the host systems.

52. The computer program product of claim 47 in which instructions to deploy comprise:

logging into each of the hosts systems; and

loading the information sensor into a target directory in each of the host systems.

53. The computer program product of claim 52 in which instructions to deploy further comprise installing the information sensor.

54. The computer program product of claim 53 in which instructions to deploy further comprise starting the information sensor in each of the host systems.

55. The computer program product of claim 47 further comprising instructions to configure the information sensor on each of the host systems from the server.

56. The computer program product of claim 55 in which instructions to configure include instructions to update configuration files on each of the host systems using a cryptographically secure communication channel on the server.

57. The computer program product of claim 56 in which the cryptographically secure communication channel is S-HTTP.

58. The computer program product of claim 56 in which instructions to update include interaction through a browser-like interface on the server.

59. The computer program product of claim 55 further comprising instructions to monitor alerts generated by each of the information sensors in each of the hosts using a viewer installed on the server.

61. A system comprising:

a network of host systems;

a network appliance connected to the network, the network appliance comprising;

a graphical user interface (GUI);

means for receiving parameters pertinent to host systems; and

means for deploying an information sensor system to each of the host systems in conjunction with the received parameters.

62. The system of claim 61 in which the GUI is a cryptographically secure communication channel GUI.

63. The system of claim 61 in which the GUI is a web-like browser.

64. The system of claim 61 in which one of the parameters comes from the group comprising of:

Internet Protocol (IP) addresses for each of the host systems;

administrative account information for each of the host systems; and

a preferred target directory for each of the host systems.

66. The system of claim 61 further comprising means for configuring the information sensor system on each of the host systems from the server.

67. The system of claim 66 in which means for configuring comprises updating configuration files on each of the host systems using a cryptographically secure communication channel on the server through the GUI.

68. The system of claim 67 in which updating comprises interaction through a browser-like interface on the server.

69. The system of claim 66 further comprising means monitoring alerts generated by each of the information sensor systems in each of the hosts on a viewer installed on the server.

70. The system of claim 69 in which the viewer is a cryptographically secure communication channel graphical user interface (GUI).

65. The system of 61 in which the means for deploying comprises:

logging into each of the host systems;

loading the information sensor system into a target directory in each of the host systems;

installing the information sensor systems in each of the host systems; and

starting the information sensor system in each of the host systems.

71. A processor and a memory configured to:

receive parameters pertinent to host systems connected to a local area network in a server; and

deploy an information sensor system from the server to each of the host systems in conjunction with the received parameters.

72. A method comprising:

in a host system residing on a network, receiving a remote request from a server to log on; and

receiving an installation of an information sensor system from the server.

73. The method of claim 72 further comprising sending alerts from the host-based intrusion system to the server.

74. The method of claim 72 in which the installation comprises allowing the server to unpack, install and start the information sensor system.

75. The method of claim 72 further comprising receiving configuration changes for the information sensor system from the server.

76. The method of claim 75 further comprising sending a local copy of a configuration file to the server.