USE OF INFERENCE TECHNIQUES TO FACILITATE CATEGORIZATION OF SYSTEM CHANGE INFORMATION

• US 20110137905A1
• Filed: 12/08/2009
• Published: 06/09/2011
• Est. Priority Date: 12/08/2009
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Kim, Gene, Good, Tom, Whitlock, David
• Granted Patent: US 8,600,996 B2
• Time in Patent Office: Days
• US Class Current: 707/740
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3075 the data filtering being achieved in order to maintain consistency among the monitored data, e.g. ensuring that the monitored data belong to the same timeframe, to the same system or component
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data

Abstract

Methods, systems, and articles for receiving, by a monitor server, change data associated with a change captured on a target host, are described herein. In various embodiments, the target host may have provided the change data in response to detecting the change, and the change data may include one or more rules, settings, and/or parameters. Further, in some embodiments, the monitor server may analyze the change data in order to group the change data into clusters. Once the change data have been classified as clusters, a report may be generated providing classification or categorization and cluster information for the various changes. In various embodiments, the generating may comprise generating a report to the target host and/or to an administrative user.

Claims

1. A method comprising:

receiving, by a monitor server, change data associated with a plurality of changes captured on a target host, the target host providing the change data in response to detecting the plurality of changes, wherein the change data includes one or more rules, settings, and/or parameters;

analyzing, by the monitor server, the change data in order to group the change data into clusters; and

classifying, by the monitor server, the clusters relating to at least one potential reason for the plurality of changes in order to categorize at least some of the clusters.

2. The method of claim 1, wherein the classifying the clusters comprises inferring a categorization for at least some of the clusters based upon at least one known enterprise change.

3. The method of claim 1, wherein the change data includes a rule that generated the change, the target host or node from which the change data was collected, a specific element name associated with the change, and element data associated with the change.

4. The method of claim 1, further comprising generating a report to the target host and/or an administrative user, wherein the report relates to the categorization of the at least some of the clusters.

5. The method of claim 1, further comprising:

determining, by the monitor server, whether the one or more rules, settings, and/or parameters violate one or more compliance policies; and

generating, by the monitor server, one or more test results based at least on the results of the determining.

6. The method of claim 5, wherein each compliance policy includes one or more of a rule, a change name, one or more waivers from the policy, and an expression for evaluating element data of the change.

7. The method of claim 5, further comprising filtering, by the monitor server, the received change data and conditionally performing the determining based on a result of the filtering.

8. The method of claim 5, wherein the determining comprises evaluating an expression of at least one of the compliance policies against element data specified in the change data.

9. The method of claim 5, further comprising:

analyzing, by the monitor server, the one or more test results in order to group the one or more test results into test result clusters; and

classifying, by the monitor server, the test result clusters relating to at least one potential reason for the plurality of changes in order to categorize at least some of the test result clusters.

10. The method of claim 9, further comprising generating a report to the target host and/or an administrative user, wherein the report relates to the categorization of the at least some of the test result clusters.

11. A monitor server comprising:

a processor;

a change database for storing change data associated with a plurality of changes captured on a target host, the target host providing the change data in response to detecting the plurality of changes, wherein the change data includes one or more rules, settings, and/or parameters; and

logic communicatively coupled to the change database and to be operated by the processor to;

receive the change data;

store the change data in the change database;

analyze the change data in order to group the change data into clusters; and

classify the clusters relating to at least one potential reason for the plurality of changes in order to categorize at least some of the clusters.

12. The monitor server of claim 11, wherein the logic is further to:

classify the clusters relating to a potential reason for the plurality of changes by inferring a categorization for at least some of the clusters based upon at least one known enterprise change.

13. The monitor server of claim 11, wherein the logic is further to:

generate a report to the target host and/or an administrative user, wherein the report relates to the categorization of the at least some of the clusters.

14. The monitor server of claim 11, wherein the logic is further to:

determine whether the one or more rules, settings, and/or parameters violate one or more compliance policies; and

generate one or more test results based at least on the results of the determining.

15. The monitor server of claim 14, wherein the compliance policies ensure that the target host is in compliance with one or more standards.

16. The monitor server of claim 14, wherein the logic is further to:

filter the received change data and conditionally perform the determining based on a result of the filtering.

17. The monitor server of claim 14, wherein the logic is further to:

evaluate an expression of at least one of the compliance policies against element data specified in the change data.

18. The monitor server of claim 14, wherein the logic is further to:

analyze the one or more test results in order to group the one or more test results into test result clusters; and

classify the test result clusters relating to at least one potential reason for the plurality of changes in order to categorize at least some of the test result clusters.

19. The monitor server of claim 18, wherein the logic is further to:

generate a report to the target host and/or an administrative user, wherein the report relates to the categorization of the at least some of the test result clusters.

20. An article of manufacture comprising:

a storage medium; and

a plurality of programming instructions stored on the storage medium and configured to program a monitor server to;

receive change data associated with a plurality of changes captured on a target host, the target host providing the change data in response to detecting the plurality of changes, wherein the change data includes one or more rules, settings, and/or parameters;

analyze the change data in order to group the change data into clusters; and

classify the clusters relating to at least one potential reason for the plurality of changes in order to categorize at least some of the clusters.

21. The article of manufacture of claim 20, wherein the plurality of programming instructions is further configured to program the monitor server to:

classify the clusters relating to a potential reason for the plurality of changes by inferring a categorization for at least some of the clusters based upon at least one known enterprise change.

22. The article of claim 20, wherein the plurality of programming instructions are configured to generate a report based at least on the results of the classifying by the monitor server.