Apparatus and a security node for use in determining security attacks

• US 20080096526A1
• Filed: 10/20/2006
• Published: 04/24/2008
• Est. Priority Date: 10/20/2006
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Miettinen, Markus, Hatonen, Kimmo
• Granted Patent: US 8,331,904 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/048 mobile agents
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Apparatus including functionality configured to monitor said apparatus for security attacks; and a reporter configured to send data to a security node, wherein the data sent to said security node is dependent on a security level of said apparatus.

Claims

1. Apparatus comprising:

functionality configured to monitor said apparatus for security attacks; and

a reporter configured to send data to a security node, wherein the data sent to said security node is dependent on a security level of said apparatus.

2. Apparatus as claimed in claim 1, wherein said security level is dependent on information received from said security node.

3. Apparatus as claimed in claim 1, wherein said security level is dependent on an output of said functionality.

4. Apparatus as claimed in claim 1, wherein more data is sent to said security node when there is a higher security level than when there is a lower security level.

5. Apparatus as claimed in claim 1, wherein all of the data is sent to the security node for one security level.

6. Apparatus as claimed in claim 1, wherein said apparatus is configured to receive request for data from said security node and said reporter is configured to send requested data to said security node.

7. Apparatus as claimed in claim 1, comprising a memory arranged to store security data.

8. Apparatus as claimed in claim 7, wherein said sent data comprises at least some of said security data.

9. Apparatus as claimed in claim 7, wherein said memory is configured such that oldest security data is overwritten by newest security data.

10. Apparatus as claimed in claim 1, wherein said functionality is configured to detect a potential security attack and in response to said detection to cause a transmission of information to said security node.

11. Apparatus as claimed in claim 1, wherein said functionality is configured to detect potential security attack and in response to said detection to cause a change of security level.

12. Apparatus as claimed in claim 1, wherein said apparatus is configured to have at least two security levels.

13. Apparatus as claimed in claim 1, wherein in response to a change in security level said reporter is configured to send data to said security node, said data comprising data occurring prior to the change in security level.

14. Apparatus as claimed in claim 1, wherein said functionality is at least one of rule based and behaviour profile-based.

15. Apparatus as claimed in claim 1, wherein said apparatus is a mobile device.

16. An apparatus comprising:

a data collector configured to receive data from a plurality of devices;

a correlator configured to correlate said received data to filter said received data; and

functionality configured to determine from said received data security attacks.

17. An apparatus as claimed in claim 16, wherein said functionality is configured to send a request to at least one device for security data.

18. An apparatus as claimed in claim 17, wherein said functionality is configured to send a request to at least one device for security data if said device is suspected of having a security attack.

19. An apparatus as claimed in claim 17, wherein said functionality is configured to monitor traffic at least one of to and from said devices.

20. An apparatus as claimed in claim 16, wherein said correlator is arranged to provide an output to said functionality.

21. An apparatus as claimed in claim 17, wherein said functionality is configured to send information to at least one device, said information defining a security level for said device.

22. A method comprising:

collecting security related data;

sending at least some of said security related data to a security node, the amount of data sent being dependent on a security level.

23. A method comprising:

receiving data from a plurality of devices;

correlating said received data to filter said received data; and

determining from said received data security attacks.

24. A system comprising:

a device comprising functionality configured to monitor said device for security attacks and a reporter configured to send data to a security node; and

a security node configured to receive data from said devices, said security node comprising a functionality configured to determine from said received data security attacks.

25. A computer readable medium comprising:

program code for collecting security related data; and

program code for sending at least some of said security related data to a security node, the amount of data sent being dependent on a security level.

26. A computer readable medium comprising:

program code for receiving data from a plurality of devices;

program code for correlating said received data to filter said received data; and

program code for determining from said received data security attacks

27. An apparatus comprising:

data collecting means for receiving data from a plurality of devices;

correlation means for correlating said received data to filter said received data; and

means for determining from said received data security attacks.

28. Apparatus comprising:

means for monitoring said apparatus for security attacks; and

reporting means for sending data to a security node, wherein the data sent to said security node is dependent on a security level of said apparatus.