Security event data normalization

• US 20060021021A1
• Filed: 06/08/2005
• Published: 01/26/2006
• Est. Priority Date: 06/08/2004
• Status: Abandoned Application

• Current Assignee: Netforensics Incorporated
• Original Assignee: Netforensics Incorporated
• Inventors: Patel, Rajesh
• Application Number:
  US11/149,083
• Publication Number:
  US 20060021021A1
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561

Abstract

Normalizing security event data from multiple different network agents. The data from the multiple different agents is categorized and tagged with a descriptor that includes information about the nature of the event. Multiple different events from multiple different devices can therefore be evaluated using a common format which is common for the multiple different devices from different vendors.

Claims

1. A method, comprising:

receiving a packet from a network security agent indicating a network event;

converting the packet to a security event tag that represents information indicative of the event and information indicative of a type of agent which detected the event; and

using the security event tag to represent the event in place of the packet.

2. A method as in claim 1, further comprising determining if the packet is from a registered device.

3. A method as in claim 1, wherein the network security agent is one of a firewall, a network intrusion system, a router, or a virtual private network.

4. A method as in claim 1, wherein the security event tag has common fields for the same event from different agents.

5. A method as in claim 1, wherein the security event tag represents at least an IP address, at least one port, and at least one signature identifier.

6. A system, comprising:

A port that receives a packet from a network security agent indicating a network event;

A processing engine operating to convert the packet to a security event tag that represents information indicative of the event and information indicative of a type of agent which detected the event; and

A security monitoring system that uses the security event tag to represent the event in place of the packet.

7. A system as in claim 6, further comprising the network security agent.

8. A system as in claim 7, wherein said network security agent is one of a firewall, a network intrusion system, a router, or a virtual private network.

9. A method as in claim 6, wherein the security event tag has common fields for the same event from different agents.

10. A method as in claim 9, wherein the security event tag represents at least an IP address, at least one port, and at least one signature identifier.