SHARING INFORMATION

• US 20150373040A1
• Filed: 01/31/2013
• Published: 12/24/2015
• Est. Priority Date: 01/31/2013
• Status: Abandoned Application

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Rao, Prasad V., Rajagopalan, Siva Raj, Moor, Daniel L., Viswanathan, Krishnamurthy, Sander, Tomas, Horne, William G., Pramanik, Suranjan
• Application Number:
  US14/764,596
• Publication Number:
  US 20150373040A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Sharing information can include identifying, utilizing a threat exchange server, a security occurrence associated with a participant within a threat exchange community. Sharing information can also include determining what participant-related information to share with the threat exchange server in response to the identified security occurrence, and receiving, at the threat exchange server, information associated with the determined participant-related information via communication links within the threat exchange community.

Claims

1. A method for sharing information, the method comprising:

identifying, utilizing a threat exchange server, a security occurrence associated with a participant within a threat exchange community;

determining what participant-related information to share with the threat exchange server in response to the identified security occurrence; and

receiving, at the threat exchange server, information associated with the determined participant-related information via communication links within the threat exchange community.

2. The method of claim 1, wherein determining what participant-related information to share includes determining with what granularity to share the participant-related information with the threat exchange server.

3. The method of claim 1, wherein determining what participant-related information to share with the threat exchange server includes dynamically determining what participant-related information to share with the threat exchange server based on a number of security occurrences.

4. The method of claim 1, wherein identifying the security occurrence includes identifying the security occurrence utilizing information from global parameters and individual parameters.

5. The method of claim 4, wherein the information from global parameters and individual parameters includes an expiration date, and the information is deleted upon reaching the expiration date.

6. The method of claim 1, further including the threat exchange server suggesting a security occurrence mitigation strategy to the participant based on the security occurrence and the received information.

7. The method of claim 1, wherein the method is performed iteratively.

8. A non-transitory computer-readable medium storing a set of instructions executable by a processor to cause a computer to:

continuously identify, utilizing a threat exchange server, individual security occurrences affecting a participant within a threat exchange community and global security occurrences affecting the threat exchange community utilizing shared information tables;

dynamically request participant-related information from the participant based on the individual security occurrences and the global security occurrences;

in response to a change in at least one of the individual security occurrences and the global security occurrences, dynamically adjust a granularity of the participant-related information requested; and

receive, at the threat exchange server, information associated with at least one of the individual security occurrences and the global security occurrences from the participant.

9. The non-transitory computer-readable medium of claim 8, wherein the instructions executable by the processor to dynamically request participant-related information from the first participant include instructions executable by the processor to dynamically request participant-related information from a number of different participants within the threat exchange community.

10. The non-transitory computer-readable medium of claim 8, storing a set of instructions executable by the processor to identify benign participant-related information received at the threat exchange server and instruct the participant to stop sharing the benign information.

11. A system for sharing information, the system comprising a processing resource in communication with a non-transitory computer-readable medium, wherein the non-transitory computer-readable medium includes a set of instructions and wherein the processing resource is designed to carry out the set of instructions to:

continuously identify community security occurrences associated with a threat exchange community based on a number of global parameters associated with the community;

continuously identify individual security occurrences for each of the number of participants based on a number of local parameters associated with each of the number of participants;

dynamically determine an amount and a granularity of participant-related information of each of the number of participants to share with at least one of a threat exchange server within the threat exchange community and the number of participants based on the community security occurrences and each of the individual security occurrences; and

receive, via a communication link, the determined participant-related information at the at least one of the threat exchange server and the number of participants.

14. The system of claim 11, wherein the instructions to dynamically determine the amount and the granularity of participant-related information include instructions to dynamically increase an information granularity level for a first participant within the number of participants in response to an individual security occurrence associated with the first participant including a security threat.

15. The system of claim 14, wherein the instructions to dynamically determine the amount and the granularity of participant-related information include instructions to dynamically decrease an amount of information and an information granularity level for the first participant in response to the security threat subsiding.

12. The system of claim 12, wherein the instructions to dynamically determine the amount and the granularity of participant-related information include instructions to dynamically increase an amount of information and an information granularity level for each of the number of participants in response to a number of the community security occurrences including a security threat.

13. The system of claim 12, wherein the instructions to dynamically determine the amount and the granularity of participant-related information include instructions to dynamically decrease an amount of information and an information granularity level for each of the number of participants in response to the security threat subsiding.