Method and System for Dynamic Network Intrusion Monitoring, Detection and Response

• US 20070162973A1
• Filed: 10/20/2006
• Published: 07/12/2007
• Est. Priority Date: 03/16/2000
• Status: Active Grant

• Current Assignee: BT Americas Incorporated (BT Group PLC)
• Original Assignee: BT Counterpane, Inc. (BT Group PLC)
• Inventors: Schneier, Bruce, Gross, Andrew, Callas, Jonathan
• Granted Patent: US 7,895,641 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A probe attached to a customer'"'"'s network collects status data and other audit information from monitored components of the network, looking for footprints or evidence of unauthorized intrusions or attacks. The probe filters and analyzes the collected data to identify potentially security-related events happening on the network. Identified events are transmitted to a human analyst for problem resolution. The analyst has access to a variety of databases (including security intelligence databases containing information about known vulnerabilities of particular network products and characteristics of various hacker tools, and problem resolution databases containing information relevant to possible approaches or solutions) to aid in problem resolution. The analyst may follow a predetermined escalation procedure in the event he or she is unable to resolve the problem without assistance from others. Various customer personnel can be alerted in a variety of ways depending on the nature of the problem and the status of its resolution. Feedback from problem resolution efforts can be used to update the knowledge base available to analysts for future attacks and to update the filtering and analysis capabilities of the probe and other systems.

Claims

1-44. -44. (canceled)

45. A system for operating a probe as part of a security monitoring system for a computer network, the system comprising:

a) a sensor coupled to collect status data from at least one monitored component of the network;

b) a filtering subsystem coupled to analyze status data to identify potentially security-related events represented in the status data, wherein the analysis includes filtering followed by an analysis of post-filtering residue, wherein the post-filtering residue is data neither discarded nor selected by filtering;

c) a communications system coupled to transmit information about the identified events to an analyst system associated with the security monitoring system;

d) a receiver for receiving feedback at the probe based on empirically-derived information reflecting operation of the security monitoring system; and

e) a modification control system for dynamically modifying an analysis capability of the probe during operation thereof based on the received feedback.

46. The system of claim 45, wherein the identifying step includes performing a multi-stage analysis of the status data.

47. The system of claim 46, wherein the multi-stage analysis includes performing a discrimination analysis on the status data.

48. The system of claim 47, wherein the discrimination analysis includes positive filtering.

49. The system of claim 47, wherein the discrimination analysis includes negative filtering.

50. The system of claim 46, wherein the multi-stage analysis includes analysis at the probe and analysis at a secure operations center configured to receive data from the probe.

51. The system of claim 45, wherein the identifying step includes aggregating and synthesizing the status data at the probe.

52. The system of claim 51, wherein the identifying step includes cross-correlating data across the monitored components.

53. The system of claim 51, wherein the identifying step includes analyzing the frequency of occurrence of the events.

54. The system of claim 45, further comprising after the step (c), a secure operations center coupled to perform further computer-based analysis and to receive data from the probe.

55. The system of claim 54, wherein the computer-based analysis includes aggregating, synthesizing, and presenting alerts on an ensemble basis.

56. The system of claim 54, wherein the identifying step includes cross-correlating data across the monitored components.

57. The system of claim 54, wherein the identifying step includes analyzing the frequency of occurrence of the events.

58. The system of claim 54, wherein the computer-based analysis includes cross-probe correlation.

59. The system of claim 45, further comprising instantaneously self-tuning the probe based on previously collected status data.

60. The system of claim 45, wherein the dynamic modifying step includes consideration of non-real-time information from ongoing security research efforts.

61. The system of claim 45, wherein the receiving feedback step occurs in substantially real time.

62. A method of operating a secure operations center as part of a security monitoring system for a customer computer network, comprising:

creating an event record for information received about an identified potentially security-related event occurring on the network;

correlating the event record with customer information and a symptom record;

using the correlated symptom record to link the event record to problem resolution information;

consolidating the event record, correlated customer information and symptom record, and linked problem resolution information into a problem ticket; and

providing the problem ticket to a security analyst console for analysis.

63. The method of claim 62, further comprising:

correlating the event record with a pre-existing event record stored on an event database within the secure operations center; and

linking the event record to an open problem ticket associated with the pre-existing event record.

64. The method of claim 62, wherein the problem resolution information links the symptom to a diagnosis.

65. The method of claim 62, wherein the problem resolution information links the symptom to a technology.

66. The method of claim 62, further comprising:

correlating the event record with a vulnerability; and

using the correlated vulnerability to link the event record to problem resolution information.

67. The method of claim 66, wherein the problem resolution information links the vulnerability to a diagnosis.

68. The method of claim 66, wherein the problem resolution information links the vulnerability to a technology.

69. The method of claim 62, wherein the potentially security-related event is identified by filtering followed by an analysis of post-filtering residue, wherein the post-filtering residue is neither discarded nor selected by filtering.

70. The method of claim 62, further comprising:

updating the problem resolution information after the potentially security-related event is resolved.