Method for Directing Audited Data Traffic to Specific Repositories

• US 20140165133A1
• Filed: 07/08/2013
• Published: 06/12/2014
• Est. Priority Date: 12/08/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Foley, Sean C., Segal, Ury, Shan, Shidong
• Granted Patent: US 9,106,682 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Data traffic is monitored on a network and data access elements thereof are collected. The collected data access elements are compared to security rules providing sets of predefined data access elements for identifying predefined data accesses. First audit data collections for data accesses are sent to a first repository. For a data access that matches one of the rules, a second audit data collection defined by the matching rule is sent to at least a second repository designated by the matching rule.

Claims

1. A computer-implemented method for auditing data traffic, the computer-implemented process comprising:

monitoring data traffic on a network and collecting data access elements thereof;

comparing the collected data access elements to security rules providing sets of predefined data access elements for identifying predefined data accesses; and

sending first audit data collections for data accesses to a first repository and, for a data access that matches one of the rules, sending a second audit data collection defined by the matching rule to at least a second repository designated by the matching rule.

2. The method of claim 1 comprising:

sending first audit data collections for data accesses to a first repository includes sending respective ones of the data access elements to respective databases of the first repository.

3. The method of claim 1, wherein the matching rule is a first rule and the method further comprises:

creating a second rule automatically in response to the data access matching the first rule, wherein the second rule is configured for sending predetermined elements of future data accesses that match the second rule to the second repository, so that even if all elements of the data access that matched the first rule are not present again, the computer-implemented process will still send audit data collections for future accesses that match the second rule to the second repository.

4. The method of claim 1, wherein the data access elements for the data accesses include data query components, and wherein the method comprises:

automatically configuring ones of the rules, responsive to rule input in an initialization mode, with structure based on data query structures, such that the rules have components corresponding to components of data queries.

5. The method of claim 1, wherein the data access elements include an IP address of a user.

6. The method of claim 1, wherein an authentication process is configured to recognize security clearance levels, wherein some ones of audit personnel have a lower clearance level than other audit personnel and the method further comprises:

limiting, automatically by the authentication process, accesses to audit data collections in the second repository, such that the audit data collections in the second repository are not accessible to audit personnel having the lower level of security clearance.

7. The method of claim 2, wherein the data access elements for the data accesses include data query components, the first repository includes databases having schema according to data query components, and sending respective ones of the data access elements to respective databases of the first repository comprises:

sending respective ones of the data query components to the respective databases having schema corresponding to the respective ones of the data query components.