DETECTION OF NON-VOLATILE CHANGES TO A RESOURCE

• US 20140283042A1
• Filed: 03/14/2014
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: NetIQ Corporation (Open Text Corporation)
• Original Assignee: NetIQ Corporation (Open Text Corporation)
• Inventors: Huebner, Roger Glenn, Littlejohn, David Henry, Kemp, Stuart Richard
• Granted Patent: US 9,779,237 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control

Abstract

Policies are communicated to a kernel service of an Operating System (OS) that define resource identifiers and events. When an event is received (from the kernel service) for a resource, the event is noted. Subsequent events received (from the kernel service) are: tracked, evaluated, and a determination is made whether a near real-time or real-time notification is to be sent.

Claims

1. A method, comprising:

configuring, by a resource change manager executing on one or more processors, a kernel service for identifying resources;

receiving, by the resource change manager, events associated with the resources from the kernel service; and

determining, by the resource change manager, whether to report event information relevant to one or more of the resources and based on the events.

2. The method of claim 1, wherein configuring further includes receiving user-defined definitions from a user that define how to identify the resources.

3. The method of claim 2, wherein receiving further includes obtaining at least some definitions as expressions that are dynamically evaluated by the kernel service.

4. The method of claim 1, wherein receiving further includes receiving the events during an evaluation period.

5. The method of claim 4, wherein receiving further includes receiving each of the events for non-volatile or non-memory changes made on the resource.

6. The method of claim 1, wherein determining further includes evaluating, in real time, policy conditions to determine whether to report.

7. The method of claim 1, wherein determining further includes evaluating at least one policy condition as a pattern of activity on the resource during an evaluation period.

8. The method of claim 1, wherein determining further includes logging, in real time, the events based on resource identifiers for the resources.

9. The method of claim 1, wherein determining further includes raising, in real time, different events to report, the different events monitored by other services.

10. The method of claim 1, wherein determining further includes filtering out noise activity occurring on the resource from the events.

11. The method of claim 1, wherein determining further includes aggregating the events for the resource at the conclusion of an evaluation period.

12. A method, comprising:

organizing, by an event manager executing on one or more processors, events based on event information included with each event, the events received in real time from a kernel service based on actions occurring on the resources;

evaluating, by the event manager, the events based on patterns in the actions; and

reporting, by the event manager, relevant event information based on the evaluation.

13. The method of claim 12, wherein organizing further includes dynamically populating a cache with base line versions of the resources when each resource is first identified in the event information.

14. The method of claim 12, wherein organizing further includes consolidating the events at a conclusion of an evaluation period.

15. The method of claim 12, wherein organizing further includes capturing the events as non-volatile changes to the resource.

16. The method of claim 12, wherein evaluating further includes dynamically evaluating user-defined policy conditions in view of each received and assigned event.

17. The method of claim 12, wherein reporting further includes raising a different event associated with at least one resource based on the evaluation, the different event handled by a service.

18. The method of claim 12, wherein reporting further includes sending a real-time notification to an administrative service based on the evaluation.

19. A system, comprising:

a processing environment; and

a real-time resource monitor adapted and configured to;

i) execute on one or more processors of the processing environment, ii) categorize real time events generated by resources and received from a kernel service of an operating system for the processing environment, iii) evaluate each event, in real time, at the conclusion of an evaluation period, and iv) determine, in real time, whether to raise an administrative event based on the evaluation.

20. The system of claim 19, wherein the real-time resource monitor is further operable to v) filter noise events out for the evaluation.