System and method for tracking and filtering alerts in an enterprise and generating alert indications for analysis

• US 7,171,689 B2
• Filed: 02/25/2002
• Issued: 01/30/2007
• Est. Priority Date: 02/25/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Beavers, John B.
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): PATEL, NIRAV B
• Application Number:
  US10/080,574
• Publication Number:
  US 20030167406A1
• Time in Patent Office: 1,800 Days
• Field of Search: 713/201, 713/200, 713152-154, 709223-224, 709/225, 726 22- 25, 726 11- 13, 706/50, 706/45, 706/61
• US Class Current: 726/22
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3068 where the reporting involves data format conversion
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

A system and method for declaring alert indications that occur in an enterprise comprising translating a number of device outputs into a common format event using a number of translation files, and generating a number of knowledge-containing common format events based on matches between the common format events and knowledge base tables. A set of rules determines whether the knowledge base common format events rise to an alert indication for further automated correlation and analysis.

Claims

1. A method of producing at least one alert indication based on a number of events derived from an enterprise comprising:

providing a plurality of enterprise device outputs, at least a portion of the outputs having different formats, each output containing an event relating to an enterprise device;

translating each output into a common format event comprising;

matching data values in the device output with a signature specification for each enterprise device, the signature specification containing;

a number of signatures;

a first location identifier for each signature; and

a first key;

wherein the signature is a listing of names found in the device output, the first location identifier determines the method used to locate the name in the device output, and the first key determines where to locate the name in the device output;

identifying a message type from a plurality message types for each enterprise device based on the device output as part of the translated common format event;

adding knowledge to the common format event using knowledge base table files to generate a knowledge-containing common format event;

applying one or more rules from a set of rules to the knowledge-containing common format event to generate the alert indication; and

generating the alert indication, wherein the alert indication includes at least a text message describing the event contained in the output of the enterprise device.

2. The method of claim 1, wherein the common format event contains at least a generic description of a specific event occurring as part of each device output.

3. The method of claim 1, wherein generating the knowledge-containing common format event further comprises comparing the common format event for each network device to a number of knowledge base table entries contained in a knowledge base table, wherein knowledge is added from one or more of the knowledge base table entries when a match between the translated common format event and the entry in the knowledge base table is made.

4. The method of claim 1, wherein the enterprise devices are selected from the group consisting of a server, a firewall, a modem, a work station, a router, a remote machine, an intrusion detection system, an identification and authentication server, network monitoring and management systems, network components, and one or more combinations thereof.

5. The method of claim 1, wherein the translating step further comprises:

producing the remainder of the translated common format event in argument name and argument value pairs using an argument specification, the argument specification containing;

a listing of arguments;

a field type;

a second location identifier for each argument; and

a second key;

wherein each argument is a listing of argument names for inclusion in the translated common format event, the field type specifies the form of an argument value found in the device output, the second location identifier determines the location of each argument value, and the second key locates the argument value in the device output to be displayed with the argument name.

6. The method of claim 1, wherein the knowledge-containing common format event comprises one or more names selected from the group of a device alert, a generic alert, a threat severity, a benign explanation, a recommended action, a common vulnerabilities and exposure code, a conclusion, and a category code, and a corresponding value for each name.

7. The method of claim 1, wherein one or more rules determine when or whether the knowledge-containing common format event is generated, and final rule-based additions content of such generated events.

8. The method of claim 7, wherein the rule requires that the each output occur a number of times over a period of time before an alert indication is generated.

9. The method of claim 1, wherein the output is one of an unauthorized login, an unauthorized physical entry, and an attempt to bypass a firewall.

10. The method of claim 3, wherein the translating step further comprises:

producing the remainder of the translated common format event in argument name and argument value pairs using an argument specification, the argument specification containing;

a listing of arguments;

a field type;

a second location identifier for each argument; and

a second key;

wherein each argument is a listing of argument names for inclusion in the translated common format event, the field type specifies the form of an argument value found in the device output, the second location identifier determines the location of each argument value, and the second key locates the argument value in the device output to be displayed with the argument name.

11. The method of claim 10, wherein the rule determines when or whether the knowledge-containing common format event is generated.

12. The method of claim 11, wherein the rule requires that each output occur a number of times over a period of time before an alert indication is generated.

13. The method of claim 1, wherein a threat level is included as part of the alert indication.

20. The method of claim 7, wherein the rule adds information to the knowledge-containing common format event.

21. The method of claim 11, wherein the rule adds information to the knowledge-containing common format event.

14. A system for producing at least one alert indication based on a number of events derived from an enterprise comprising:

a plurality of enterprise devices, each device capable of producing an output;

a number of translation files, the translation files allowing the output to be translated into a common format event, the translation comprising;

matching data values in the device output with a signature specification for each enterprise device, the signature specification containing;

a number of signatures;

a first location identifier for each signature; and

a first key;

wherein the signature is a listing of names found in the device output, the first location identifier determines how to locate the name in the device output, and the first key determines where to locate the name in the device output;

identifying a message type from a plurality message types for each enterprise device based on the device output as part of the translated common format event;

a number of knowledge base table files, matching of the common format event with one or more of the knowledge base table files adding knowledge from the matched file to generate a knowledge-containing common format event;

a number of rule files, the rule files governing generation of the alert indication; and

a rules processor for generating the alert indication, wherein the alert indication includes at least a text message describing the event contained in the output of the enterprise device.

15. The system of claim 14, wherein the enterprise devices are selected from the group consisting of a server, a firewall, a modem, a work station, a router, a remote machine, an intrusion detection system, an identification and authentication server, network monitoring and management systems, network components, and one or more combinations thereof, or any generator of data streams on the computer network.

16. The system of claim 14, wherein the knowledge-containing common format event comprises one or more names selected from the group of a device alert, a generic alert, a threat severity, a benign explanation, a recommended action, a CVE, a conclusion, and a category code, and a corresponding value for each name.

17. The system of claim 14, wherein the common format event comprises a message, and a number of name and value pairs derived from the output of the enterprise device.

18. The system of claim 16, wherein the rule files govern at least the frequency of the generation of the alert indication.

19. The system of claim 18, wherein the common format event comprises a message, and a number of name and value pairs derived from the output of the enterprise device.