METHOD AND SYSTEM FOR AUTONOMOUS CONTROL AND PROTECTION OF COMPUTER SYSTEMS

• US 20110055920A1
• Filed: 06/11/2007
• Published: 03/03/2011
• Est. Priority Date: 06/09/2006
• Status: Active Grant

• Current Assignee: Arizona Board of Regents (University of Arizona)
• Original Assignee: Arizona Board of Regents (University of Arizona)
• Inventors: Hariri, Salim
• Granted Patent: US 9,015,828 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A management system includes a plurality of components within a computer system. A plurality of component resource managers is provided, and each of the components is controlled by at least one of the plurality of component resource managers. A plurality of component management interfaces is also provided. Each of the components communicates with at least one of the controlling component resource managers via one of the component management interfaces. At least one runtime manager autonomously controls operation of the components and the component resource managers.

Claims

1. A management system for autonomously managing security of a computer system, the management system comprising:

a plurality of components within a computer system;

a plurality of component resource managers, wherein each of the components is controlled by at least one of the plurality of component resource managers;

a plurality of component management interfaces, wherein each of the components communicates with at least one of the controlling component resource managers via one of the component management interfaces; and

at least one runtime manager autonomously controlling operation of the components and the component resource managers.

2. The management system of claim 1, further comprising a monitoring engine within each of the component resource managers in communication with at least one of the components through one of the component management interfaces, whereby the monitoring engine collects monitoring data.

3. The management system of claim 2, further comprising an analysis engine within each of the component resource managers having at least one algorithm responsive to the monitored data.

4. The management system of claim 3, wherein the algorithm further comprises an anomaly algorithm useful for identifying anomalous activity within the monitored data.

5. The management system of claim 3, further comprising a control port within the component management interface communicatively connecting the analysis engine and the monitoring engine with the at least one of the components.

6. The management system of claim 1, wherein each component is in communication with only one of the plurality of component resource managers.

7. A method of providing autonomously managing security of a computer system, the method comprising the steps of:

controlling a plurality of components with a plurality of component resource managers;

communicating between the plurality of components and the plurality of component resource managers using a plurality of component management interfaces; and

autonomously controlling operation of the components and the component resource managers with at least one runtime manager.

8. The method of claim 7, further comprising communicating between one of the components and one of the component resource managers using one of the component management interfaces.

9. The method of claim 7, further comprising monitoring for anomalous activity using the component management interfaces.

10. The method of claim 7, further comprising:

classifying data communicated through components according to a level of anomalous activity in the data; and

routing the data according to the anomalous activity classification.

11. The method of claim 10, wherein the step of classifying data further comprises classifying data communicated through components according to a level of anomalous activity in the data, wherein at least three distinct classifications are provided.

12. The method of claim 7, further comprising:

data-mining the component resource managers to collect activity data;

classifying activity data according to a level of anomalous activity in the activity data; and

routing future data according to the anomalous activity classification of the activity data.

13. The method of claim 7, further comprising:

data-mining the component resource managers to collect activity data;

classifying activity data according to a level of anomalous activity in the activity data; and

altering resource allocation according to the anomalous activity classification of the activity data.

14. The method of claim 7, further comprising:

data-mining the component resource managers to collect activity data;

compiling the activity data; and

defining anomalous activity classifications according to activity data compilations.

15. A management system for providing autonomously managing security of a computer system, comprising:

means for controlling a plurality of components with a plurality of component resource managers;

means for communicating between the plurality of components and the plurality of component resource managers using a plurality of component management interfaces; and

means for autonomously controlling operation of the components and the component resource managers with at least one runtime manager.

16. The system of claim 15, further comprising means for monitoring for anomalous activity using the component management interfaces.

17. The system of claim 15, further comprising:

means for classifying data communicated through components according to a level of anomalous activity in the data; and

means for routing the data according to the anomalous activity classification.

18. The system of claim 15, further comprising:

means for data-mining the component resource managers to collect activity data;

means for classifying activity data according to a level of anomalous activity in the activity data; and

means for routing future data according to the anomalous activity classification of the activity data.

19. The system of claim 15, further comprising:

means for data-mining the component resource managers to collect activity data;

means for classifying activity data according to a level of anomalous activity in the activity data; and

means for altering resource allocation according to the anomalous activity classification of the activity data.

20. The system of claim 15, further comprising:

means for data-mining the component resource managers to collect activity data;

means for compiling the activity data; and

means for defining anomalous activity classifications according to activity data compilations.

21. A management system for providing autonomously managing security of a computer system, comprising:

computer readable program code for controlling a plurality of components with a plurality of component resource managers;

computer readable program code for communicating between the plurality of components and the plurality of component resource managers using a plurality of component management interfaces; and

computer readable program code for autonomously controlling operation of the components and the component resource managers with at least one runtime manager.

22. The system of claim 21, further comprising computer readable computer code for monitoring for anomalous activity using the component management interfaces.

23. The system of claim 21, further comprising:

computer readable computer code for classifying data communicated through components according to a level of anomalous activity in the data; and

computer readable computer code for routing the data according to the anomalous activity classification.

24. The system of claim 21, further comprising:

computer readable computer code for data-mining the component resource managers to collect activity data;

computer readable computer code for classifying activity data according to a level of anomalous activity in the activity data; and

computer readable computer code for routing future data according to the anomalous activity classification of the activity data.

25. The system of claim 21, further comprising:

computer readable computer code for data-mining the component resource managers to collect activity data;

computer readable computer code for classifying activity data according to a level of anomalous activity in the activity data; and

computer readable computer code for altering resource allocation according to the anomalous activity classification of the activity data.

26. The system of claim 21, further comprising:

computer readable computer code for data-mining the component resource managers to collect activity data;

computer readable computer code for compiling the activity data; and

computer readable computer code for defining anomalous activity classifications according to activity data compilations.