Distributed data search, audit and analytics

• US 20110035781A1
• Filed: 04/07/2010
• Published: 02/10/2011
• Est. Priority Date: 04/07/2009
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Moghe, Pratyush
• Application Number:
  US12/755,912
• Publication Number:
  US 20110035781A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system that comprises of a set of components that interact together to achieve large-scale distributed data auditing, searching, and analytics. Traditional systems require auditing data to be captured and centralized for analytics, which leads to scaling and bottleneck issues (both on network and processing side). Unlike these systems, the system described herein leverages the combination of distributed storage and intelligence, along with centralized policy intelligence and coordination, to allow for large-scale data auditing that scales. This architecture allows for data auditing in “billions” of events, unlike traditional architectures that struggled in the realm of “millions” of events.

Claims

1. A distributed system associated with an enterprise computing environment in which data servers are being monitored for insider attacks, the distributed system comprising:

a set of client appliances distributed across the enterprise computing environment, wherein each client appliance is associated with a subset of the data servers being monitored for insider attacks;

a set of one or more server appliances, wherein each server appliance is associated with one or more client appliances of the set of client appliances; and

a control routine executed by a processor for receiving and executing a query across one or more server appliances, which query, in turn, is executed by each server appliance against the client appliances and their associated data servers, and, in response, returns a consolidated audit result.

2. The distributed system as described in claim 1 further including a management console through which an authorized user creates centralized policy and configuration commands, and to view data auditing results and reports.

3. The distributed system as described in claim 1 wherein the management console is used to formulate the query.

4. The distributed system as described in claim 1 wherein the server appliance collects and processes per client appliance query results.

5. The distributed system as described in claim 4 wherein the server appliance processes the per client the per client appliance query results by converting event date and times to a time zone associated with the server appliance.

6. The distributed system as described in claim 4 wherein the server appliance processes the per client appliance query results by applying a range argument.

7. The distributed system as described in claim 4 wherein the server appliance aggregates and displays per client appliance query results in a specified format.

8. The distributed system as described in claim 1 wherein a client appliance comprises:

at least one or more processors;

code executing on a given processor for generating a display interface through which an authorized entity using a given policy specification language specifies an insider attack;

code executing on a given processor that determines whether a trusted user'"'"'s given data access to an enterprise resource is indicative of the insider attack; and

code executing on a given processor and responsive to the insider attack for taking a given mitigation action.