Method for Monitoring a message associated with an action generated by an element or the user of an IS, and corresponding computer software product, storage means and device

• US 20100274892A1
• Filed: 01/11/2008
• Published: 10/28/2010
• Est. Priority Date: 01/11/2007
• Status: Active Grant

• Current Assignee: EPT Innovation
• Original Assignee: EPT Innovation
• Inventors: Maciejak, David, Legrand, Veronique, Briguet, Christophe, Benali, Fatiha, Saraydaryan, Jacques, Pautet, Laurent
• Granted Patent: US 8,510,467 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

The invention relates to a method for monitoring at least one message, each message being associated with an action generated by at least one element or user of an information system (1000), said message(s) being collected by at least one message collecting device of the IS. According to the invention, the method comprises the step of defining a plurality of reference event categories each associated with at least one reference action from an ontology based on an intention class that characterises the purpose of each reference action, an activity type class that qualifies the nature of each reference action, a movement class that characterises the means for implementing each reference action, a target class that characterises the object of each reference action, and a gain class that characterises the result of each reference action.

Claims

1. Method for monitoring at least one message, each message being associated with an action generated by at least one element or the user of an information system (1000) hereinafter referred to as an IS, said message or messages being collected by at least one message collecting device of the IS,

characterised in that it includes the following steps:

defining a plurality of reference event categories each associated with at least one reference action from an ontology based on an intention class (2001) that characterises the purpose of each reference action, an activity type class (2006) that qualifies the nature of each reference action, a movement class (2003) that characterises the means for implementing each reference action, a target class (2002) that characterises the object of each reference action and a gain class (2005) that characterises the result of each reference action;

and for each given message,

disassembling said given message in a database formed by the intention class, the activity type class, the movement class, the target class and the gain class;

comparing the disassembled message with at least one reference event category;

generating at least one standardised event representing a correspondence between the disassembled message and the reference event category.

2. Monitoring method as claimed in claim 1, characterised in that if the disassembled message corresponds to a reference event category, then the method comprises the following steps:

verifying that the reference event category is not already present in a first storage means;

in the event of a positive verification, storing said reference event category in said first storage means.

3. Monitoring method as claimed in any one of claims 1 and 2, characterised in that if the disassembled message corresponds to none of said reference event categories, then the method includes the following step:

storing the message in a second storage means.

4. Monitoring method as claimed in any one of claims 1 to 3, characterised in that, during the step of defining a plurality of reference event categories, at least one of said reference event categories is defined from at least one other of said reference event categories and from at least one rule belonging to the group comprising:

syntactic rules;

lexical rules;

semantic rules.

5. Monitoring method as claimed in any one of claims 1 to 4, characterised in that, for at least one of said reference event categories, it comprises a step of counting a number of disassembled messages corresponding to said reference event category.

6. Monitoring method as claimed in any one of claims 1 to 5, characterised in that said intention class (2001) comprises the following intentions:

the intentions of discovering and/or collecting at least one datum in respect of at least one target of the IS (1000);

the intentions of accessing the IS by means of at least one authentication procedure that employs at least one identification datum;

the intentions of accessing at least one resource of the IS by means of at least one rights-requiring procedure;

the intentions of accessing an availability of at least one resource of the IS.

7. Monitoring method as claimed in any one of claims 1 to 6, characterised in that said movement class (2003) comprises the following movements:

movements related to at least one action that does not affect the configuration of the IS;

movements related to at least one action that does affect the configuration of the IS;

movements related to at least one attack;

movements related to at least one malicious software developed to the purpose of harming the IS;

movements related to at least one suspect action detected by at least one action detector probe of the IS;

movements related to at least one vulnerability of the IS;

movements reflecting an observed state of the IS.

8. Monitoring method as claimed in any one of claims 1 to 7, characterised in that said gain class (2005) comprises:

for intentions corresponding to movements related to at least one action that does not affect the configuration of the IS and to movements related to at least one action that does affect the configuration of the IS;

successes;

failures;

denials;

errors;

for intentions corresponding to movements related to at least one attack, to movements related to at least one malicious software developed the purpose of harming the IS, to movements related to at least one vulnerability of the IS and to movements related to at least one suspect action detected by at least one action detector probe of the IS;

detections;

for intentions corresponding to movements reflecting an observed state of the IS;

gains from intentions corresponding to at least one movement reflecting at least one action of at least one target of the IS;

gains from intentions corresponding to at least one movement reflecting at least one use of at least one threshold in respect of at least one target of the IS.

9. Monitoring method as claimed in claim 8, characterised in that the gains (2005) from intentions (2001) corresponding to movements (2003) reflecting actions of targets (2002) of the IS comprise:

valid states subsequent to at least one control;

invalid states subsequent to at least one control;

notifications about at least one target subsequent to at least one control.

10. Monitoring method as claimed in any one of claims 8 and 9, characterised in that the gains (2005) from intentions 2001) corresponding to movements (2003) reflecting uses of thresholds in respect of targets (2002) of the IS:

exceeding at least one time threshold;

exceeding at least one threshold unrelated to time;

low usage of at least one threshold;

normal usage of at least one threshold;

high usage of at least one threshold.

11. Computer software product, that can be downloaded from a communications network and/or recorded on a medium that can be read by a computer and/or run by a processor, characterised in that it includes program code instructions for implementing the monitoring method as claimed in at least one of claims 1 to 10.

12. Storage means, are possibly totally or partially removable, that can be read by a computer, storing a set of instructions that can be run by said computer to implement the monitoring method as claimed in at least one of claims 1 to 10.

13. Device for monitoring at least one message, each message being associated with an action generated by at least one element or the user of an information system (1000) hereinafter referred to as IS, said message or messages being collected by at least one message collecting device of the IS,

characterised in that it comprises:

means for defining a plurality of reference event categories each associated with at least one reference action from an ontology based on an intention class (2001) that characterises the purpose of each reference action, an activity type class (2006) that qualifies the nature of each reference action, a movement class (2003) that characterises the means for implementing each reference action, a target class (2002) that characterises the object of each reference action and a gain class (2005) that characterises the result of each reference action;

and for each given message,

means for disassembling said given message in a database formed by the intention class, the activity type class, the movement class, the target class and the gain class;

means for comparing the disassembled message with at least one reference event category;

means for generating at least one standardised event representing a correspondence between the disassembled message and the reference event category.