METHODS AND SYSTEMS FOR SECURING AND PROTECTING REPOSITORIES AND DIRECTORIES

• US 20110258208A1
• Filed: 01/13/2010
• Published: 10/20/2011
• Est. Priority Date: 01/13/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Aorato Ltd. (Microsoft Corporation)
• Inventors: Plotnik, Idan, Plotnik, Ohad, Podhajcer, Itay
• Granted Patent: US 8,548,998 B2
• Time in Patent Office: Days
• US Class Current: 707/756
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 7/00 Methods or arrangements for processing data by operating upon the order or content of the data handled logic circuits H03K19/00
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system and method for protecting a networked organizational data storage facility, which is accessible by a network environment, by mapping the network environment, profiling the network environment and filtering the network traffic based on said profiling of the network environment.

Claims

1-16. -16. (canceled)

17. A method of protecting a networked organizational Directory Service (DS) accessible from a Directory Service network and application (DSNA) environment, comprising the steps of:

a. analyzing traffic to and from the DS in order to identify actions according to order and structure of DS related protocols;

b. mapping the DSNA environment, using a plurality of environmental analysis adapters; and

c. profiling the DSNA environment, using a DSNA environment profiler.

18. A method of claim 17 wherein said mapping of the DSNA environment includes the steps of:

i. gathering raw information related to DS actions usage and bidirectional traffic to and from the DS for each of a plurality of entities that are capable of accessing the DS via the DSNA environment;

ii. converting said raw information into profiling information for said DSNA environment profiler; and

iii. storing said profiling information for use by said DSNA environment profiler.

19. A method of claim 17 wherein said environmental analysis adapters include

BotMaps.

20. A method of claim 18 wherein said profiling of the DSNA environment includes the steps of

i. profiling said entities based on said profiling information from said mapping of the DSNA environment;

ii. analyzing bidirectional DSNA traffic between the DS and said entities, using a DSNA traffic analyzer; and

iii. creating a plurality of filters, based on said profiling of said entities and said analyzing of said network traffic from said entities, for protecting the DS.

21. The method of claim 20, further comprising the step of:

c. filtering said bidirectional DSNA traffic between said entities and the DS using said filters;

22. The method of claim 21, wherein said filtering includes the step of processing a message of said bidirectional DSNA traffic using a DS protocol pack.

23. The method of claim 22, wherein said filtering includes the step of processing at least one message stream including a plurality of said messages, of said bidirectional DSNA traffic, using a stream level workflow.

24. The method of claim 23, wherein said filtering includes the step of processing at least one scenario including a plurality of said message streams, using a scenario level workflow.

25. The method of claim 24, wherein said DS protocol pack is responsible for validating said message.

26. The method of claim 25, wherein said stream level workflow includes steps selected from the group consisting of:

a. determining whether a said individual message belongs to a new stream;

b, determining whether a said individual message structure is valid;

c. determining whether a said individual message location is valid;

d. determining whether a said individual message has been validated by validation extensions;

e. determining whether said individual message is valid, having said valid structure, said valid location and said validation from said validation extensions; and

f. determining whether said stream level workflow is to be disposed.

27. A method of claim 26, wherein said scenario level workflow includes steps selected from the group consisting of:

a. determining whether a said individual message belongs to a new scenario;

b. passing said individual message to a said stream workflow;

c. determining whether said stream workflow is valid, thereby validating said individual message;

d. determining whether said stream workflow reached a state of completion;

e. determining whether said scenario workflow has reached a state of completion; and

f. determining whether said scenario workflow is to be disposed.

28. A system for protecting a networked organizational Directory Service (DS) accessible by a Directory Service network and application (DSNA) environment, comprising:

a, a plurality of environmental analysis adapters, for mapping the DSNA environment; and

b. a DSNA environment profiler, for profiling the DSNA environment.

29. A system of claim 28 wherein said environment analysis adapters are operative:

i. to gather raw information related to DS actions, usage and traffic to and from the DS for each of a plurality of entities that are capable of accessing the DS via the DSNA environment;

ii. to convert said raw information into profiling information for said DSNA environment profiler; and

iii. to store said profiling information for use by said DSNA environment profiler.

30. A system of claim 29 wherein said environmental analysis adapters include BotMaps.

31. A system of claim 29, wherein said DSNA environment profiler is operative:

i. to profile said entities based on said profiling information, from said environment analysis adapters;

ii. to analyze DSNA traffic, between said entities and the DS, using a DSNA traffic analyzer;

iii. to create a plurality of filters, based on said profiling of said entities, and said analyzing of said DSNA traffic between said entities and the DS.

32. A system of claim 31, further comprising:

c. a message falterer, for filtering said DSNA traffic between said entities and the DS.