Duration of alerts and scanning of large data stores

• US 20070050777A1
• Filed: 06/16/2006
• Published: 03/01/2007
• Est. Priority Date: 06/09/2003
• Status: Abandoned Application

• Current Assignee: Industrial Defender, Inc. (Capgemini SE)
• Original Assignee: Industrial Defender, Inc. (Capgemini SE)
• Inventors: Ginter, Andrew, Jensen, John, Harms, Daryl, Hutchinson, Thomas
• Application Number:
  US11/455,312
• Publication Number:
  US 20070050777A1
• Time in Patent Office: Days
• US Class Current: 718/104
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Described are techniques used in monitoring the performance, security and health of a system used in an industrial application. Agents included in the industrial network report data to an appliance or server. The appliance stores the data and determines when an alarm condition has occurred. Notifications are sent upon detecting an alarm condition. The alarm thresholds may be user defined. A threat thermostat controller determines a threat level used to control the connectivity of a network used in the industrial application.

Claims

1. A method for monitoring data elements comprising:

receiving one or more sets of data elements, each set representing a grouping of one or more data elements;

receiving an associated resource allocation of a first resource for each of said one or more sets; and

performing processing for each of said one or more sets of data elements, wherein said processing includes scanning and monitoring data elements for differences, and wherein at least one of said scanning and said monitoring is performed in accordance with the associated resource allocation for each set.

2. The method of claim 1, wherein said resource allocation indicates an amount of said first resource to be consumed during a defined time period.

3. The method of claim 2, wherein a sum of all the associated resource allocations for all the sets of data elements indicates a total amount of said first resource allocated for consumption during a defined time period.

4. The method of claim 3, wherein said first resource is a processor and said resource allocation indicates an amount of processor execution time to be consumed during a defined time period.

5. The method of claim 3, wherein an associated resource allocation for one of said sets is specified as a percentage of said total amount.

6. The method of claim 3, wherein an associated resource allocation for one of said sets is specified as a numeric value.

7. The method of claim 1, wherein each of said sets of data elements has an associated level of priority indicating a level of priority of data elements included therein.

8. The method of claim 1, further comprising, for each set of data elements:

providing a set of one or more rules; and

determining data elements belonging to said each set using said one or more rules as a filter.

9. The method of claim 8, wherein said set of rules includes at least one inclusionary rule defining one or more criteria, wherein a data element having said one or more criteria is included in said each set of data elements.

10. The method of claim 8, wherein said set of rules includes at least one exclusionary rule defining one or more criteria, wherein a data element having said one or more criteria is not included in said each set of data elements.

11. The method of claim 1, wherein one or more data stores are specified for each set from which data elements are selected for inclusion into said each set.

12. The method of claim 11, wherein said one or more data stores includes at least one data store selected from a database and a file system.

13. The method of claim 12, wherein at least one of said data stores specified has a hierarchical structure and rules are specified using said hierarchical structure to determine which data elements belong to said each set of data elements.

14. The method of claim 1, further comprising:

determining one or more attributes of each data element, each attribute characterizing data, metadata, or schema information for said each data element, wherein said determining one or more attributes is performed as part of said scanning;

determining differences between a current value for each of said one or more attributes and a predetermined value; and

generating an alert in accordance with any of said differences.

15. The method of claim 14, wherein said determining differences is performed by comparing hash values for a current value and a predetermined value for at least one attribute including sensitive data.

16. The method of claim 1, wherein a second resource is specified for at least one of said sets, said second resource having an associated resource allocation for each of said data sets, and wherein at least one of said scanning and said monitoring are performed in accordance with the associated resource allocations for said first and said second resources for each set, said at least one of said scanning and said monitoring consuming allocated resources for a data set if any one the associated resource allocations of said first or said second resources has been consumed.

17. The method of claim 1, wherein said resource allocation indicates a number of disk inputs performed during at least one of said scanning and said monitoring of a data set for a defined time period, each of said disk inputs representing a portion of data read from a device during said at least one of said scanning and said monitoring.

18. The method of claim 3, further comprising:

determining an elapsed time for said at least one of said scanning and said monitoring to consume said total amount of said first resource allocated during a defined time period;

if the elapsed time is less than said defined time period, scheduling said processing to resume at a beginning of a next defined time period;

if the elapsed time is not less than said defined time period, scheduling said processing to resume execution immediately.

19. The method of claim 1, wherein, a first process is performing scanning and monitoring data elements for differences, and after said first process processes one or more data elements, another process waiting for execution is executed prior to resuming execution of said first process by said first process relinquishing control of a processor independent of an operating system technique to share said processor.

20. The method of claim 1, wherein, a first process is performing scanning and monitoring data elements for differences, and after said first process processes a predetermined amount of data with respect to at least one of said scanning and said monitoring, another process waiting for execution is executed prior to resuming execution of said first process by said first process relinquishing control of a processor independent of an operating system technique to share said processor.

21. The method of claim 1, wherein, a first process is performing scanning and monitoring data elements for differences, and after said first process consumes a fixed amount of a resource with respect to at least one of said scanning and said monitoring, another process waiting for execution is executed prior to resuming execution of said first process by said first process relinquishing control of a processor independent of an operating system technique to share said processor.

22. The method of claim 14, wherein said predetermined value is an expected value obtained in accordance with one or more previous scans of a data element at a prior point in time.

23. The method of claim 14, wherein said predetermined value is determined using at least one of:

simulation and theoretically expected results.

24. A method for scanning data elements comprising:

receiving one or more sets of data elements, each set representing a grouping of one or more data elements;

receiving an associated resource allocation of a first resource for each of said one or more sets; and

performing scanning for each of said one or more sets of data elements in accordance with the associated resource allocation for each set.

25. A computer readable medium which comprises code stored thereon for monitoring data elements that:

receives one or more sets of data elements, each set representing a grouping of one or more data elements;

receives an associated resource allocation of a first resource for each of said one or more sets; and

performs processing for each of said two or more sets of data elements, wherein said processing includes scanning and monitoring data elements for differences, and wherein at least one of said scanning and said monitoring is performed in accordance with the associated resource allocation for each set.

26. A method for displaying alerts on an alert display area comprising:

receiving an alert message in connection with an alert condition in a system; and

displaying said alert message for an alert condition, wherein, said alert message includes a duration time representing an amount of time said alert condition has existed in the system.

27. The method of claim 26, wherein if said alert condition has not subsided at a time when said alert message is displayed, said duration time includes as said duration time an indicator that said alert condition is ongoing.

28. The method of claim 26, wherein said alert message that is displayed represents an alert condition having a non-zero duration time.

29. The method of claim 26, wherein said duration time is determined by using a model describing severity transitions of transitioning from a first severity level to a second severity level.

30. The method of claim 29, wherein each severity level included in said model is associated with only a single state and said model includes transitions from a first state having said first severity level to a second state having said second severity level.

31. The method of claim 29, wherein at least one severity level included in said model is associated with more than one state and said model includes transitions from a first state having said first severity level to a second state having said second severity level.

32. The method of claim 26, further comprising:

displaying an acknowledgement indicator indicating that said alert message requires manual acknowledgement, wherein said alert message is displayed until said alert message has been acknowledged using said acknowledgement indicator and said alert condition has cleared.

33. The method of claim 32, wherein, in response to performing an acknowledgement by selecting said acknowledgement indicator, said acknowledgement indicator is displayed in a visually differentiable state than when said alert message has not been acknowledged.

34. The method of claim 26, wherein said alert condition is associated with one of a security alert and a performance alert.

35. The method of claim 26, wherein said duration time has a starting time and an ending time, said starting time being determined when said alert condition is first detected and said ending time indicating when said alert condition has subsided.

36. The method of claim 27, wherein, at a point in time, a display including alert messages includes at most a single alert message associated with said alert condition which includes a duration time indicating that said alert condition is ongoing.

37. The method of claim 27, wherein, at a point time, a display including alert messages includes a plurality of alert messages associated with said alert condition, each of said plurality of alert messages including a duration time indicating that said alert condition is ongoing.

38. The method of claim 37, wherein each of said plurality of alert messages is associated with a unique severity level.

39. The method of claim 35, wherein a state of said alert condition is determined using a model, and wherein said starting time and said ending time of said duration time are determined in accordance with one or more states of said model.

40. The method of claim 26, wherein said alert message is a first alert message for a non-instantaneous alert, and the method further comprising:

displaying on a display screen said first alert message for a non-instantaneous alert and a second alert message for an instantaneous alert.

41. The method of claim 29, wherein said model includes a set of states and a set of severities, each of said severities being associated with one or more states, said model utilizing one of an overlapping technique or a non-overlapping technique in connection with determining said duration time, wherein said overlapping technique has at most one ongoing alert, and, when transitioning from a first severity to a second severity, said first severity is determined to end and said second severity is determined to start, wherein said non-overlapping technique has one or more ongoing alerts so that a time duration for one alert may overlap with a duration time of a second alert, and, when transitioning from a lower severity to a higher severity, said higher severity is determined to start, and when transitioning from a higher severity to a lower severity, said higher severity is determined to end.

42. The method of claim 41, wherein said model indicates whether to output alert messages for intervening severities when transitioning from a first severity to a second severity.

43. The method of claim 41, wherein said model includes a rule indicating at least one severity for which alert messages are not to be generated when transitioning into the at least one severity.

44. A computer readable medium comprising code stored thereon for displaying alerts on an alert display area that:

receives an alert message in connection with an alert condition in a system; and

displays said alert message for an alert condition, wherein said alert message includes a duration time representing an amount of time said alert condition has existed in the system.

45. The computer readable medium of claim 44, wherein said alert condition represents a non-instantaneous alert having a duration time determined using a model for modeling said alert condition, said model including a set of one or more severities, a set of one or more states, a set of one or more transitions defining transitioning between states, a first parameter indicating whether said model utilizes an overlapping technique or a non-overlapping technique in time for said second severity is determined to start with said overlapping technique, and wherein, with said non-overlapping technique, when transitioning from a lower severity to a higher severity, a duration time for said higher severity is determined to start, and when transitioning from a higher severity to a lower severity, a duration time for said higher severity is determined to end.

46. The computer readable medium of claim 45, wherein said model indicates whether to output alert messages for intervening severities when transitioning from a first severity to a second severity.

47. The computer readable medium of claim 46, wherein said model includes a rule indicating at least one severity for which alert messages are not to be generated when transitioning into the at least one severity.