Event sequence detection

• US 7,234,166 B2
• Filed: 11/07/2002
• Issued: 06/19/2007
• Est. Priority Date: 11/07/2002
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Stonesoft Corporation
• Inventors: Nurmela, Kari
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Tran; Ellen C.
• Application Number:
  US10/289,449
• Publication Number:
  US 20040093510A1
• Time in Patent Office: 1,685 Days
• Field of Search: 726/23, 726/22, 714/39
• US Class Current: 726/23
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

The invention relates to event sequence detection suitable for an intrusion detection system (IDS), for example. An event sequence including two or more stages in order, each of the stages including one or more events, is defined. Also defined is a filtering function for each of the stages, each filtering function providing a TRUE indication, when one of the events belonging to the respective event is received, and a FALSE indication otherwise. Still further at least one binding function for each of the stages is defined such that a pair of binding functions in two successive stages links the events in these two successive stages. Received event data is continuously evaluated with the filtering functions. When the evaluation results in a TRUE indication from one of the filter functions, at least one key value is derived from the received event data by the corresponding at least one binding function. Finally, it is determined that that the sequence has been detected, when a TRUE indication has been obtained in each stage in a timely order and the derived key values link the detected events in the successive stages.

Claims

1. An event sequence detection method, comprising

defining a sequence including two or more stages in order, each of the stages including one or more events,

defining a filtering function for each of said stages, each filtering function providing a TRUE indication, when one of the events belonging to the respective event is received, and a FALSE indication otherwise,

defining at least one binding function for each of the stages such that a pair of binding functions in two successive stages links the events in these two successive stages,

continuously receiving event data,

continuously evaluating the received event data with the filtering functions,

when the evaluation results in a TRUE indication from one of the filter functions, deriving at least one key value from the received event data by the corresponding at least one binding function,

determining that said sequence has been detected, when a TRUE indication has been obtained in each stage in a timely order and the derived key values link the detected events in the successive stages.

2. The method as claimed in claim 1, wherein said determining comprises determining that said sequence has been detected, when a TRUE indication has been obtained in each stage in a timely order and the derived key values link the detected events in the successive stages within a time window.

3. The method as claimed in claim 1 or 2, wherein said determining comprises

when the filter function that provided the TRUE indication is the filter function for the first stage, registering or updating the current event with the derived key value in said first stage,

when the filter function that provided the TRUE indication is the filter function for other than the first stage and a last stage in order in said sequence and there is a registration with one of the at least one derived key value in the previous stage in order in said sequence, registering or updating the current event or events with the at least one derived key value,

when the filter function that provided the TRUE indication is the filter function for the last stage in order in said sequence and there is a registration with one of the at least one derived key value in the previous stage in order in said sequence, determining that said event sequence has been detected.

4. The method as claimed in claim 2, comprising cancelling registered event and key value older than the time window based on time information or a time stamp.

5. The method as claimed in claim 4, wherein said updating comprises updating the time information or the time stamp of an already registered event and the associated at least one key value.

6. A computer readable storage medium comprising a computer program that carries out the method of claim 1 when executed by a computer.

7. A computer program that carries out the method of claim 1 when executed by a computer.

8. An event sequence detection method, comprising

defining a sequence including two or more stages in order, each of the stages including one or more events,

defining a filtering function for each of said stages, each filtering function providing a TRUE indication, when one of the events belonging to the respective event is received, and a FALSE indication otherwise,

evaluating the filtering functions with the event data,

if the filtering function of the one of the stages evaluates to TRUE, a binding function associated with the respective stage is evaluated for extracting a first key from the event data,

if the stage, which evaluates to TRUE, is the first stage, it is checked whether the event and the first key already exist in a table associated with the first stage, and the if checking result is negative, the event and the first key are added to the table,

if the stage, which evaluates to TRUE, is some other than the first stage, it is checked, whether there is an entry with the first key in the table of the previous stage, if the checking result is

negative, nothing is done, and if the checking result is confirmative, another binding function associated with the current stage is evaluated for extracting a second key from the event data and the table associated with the current stage is checked for whether the event and the second key do exist in the table, and if the latter checking result is negative, the event and the second key are added to the table,

if the stage, which evaluates to TRUE, is the last stage, it is checked, whether there is an entry with the first key in the table of the previous stage, and if the checking result is negative, nothing is done, and if the checking result is confirmative, it is determined that a sequence of events has been detected.

9. The method according to claim 8, comprising

providing the events in the tables with time information or time stamps,

updating the time information or the time stamp of the event, if the event to be added to a table already exists in the table,

cancelling an entry that is older than a time window.

10. A computer readable storage medium comprising a computer program that carries out the method of claim 8 when executed by a computer.

11. An event sequence detection method, comprising

defining a sequence including two or more events,

defining a filtering function and an associated binding function for each event, each filtering function providing a TRUE indication, when the respective event is received, and a FALSE indication otherwise,

continuously receiving event data,

continuously evaluating the received event data with the filtering functions,

each time when the evaluation results in a TRUE indication from one of the filter functions, registering the corresponding event and a key value derived from the received event data by the corresponding binding function,

determining the sequence as detected, if all events of the event sequence with mutually matching key values are registered within a time window.

12. A computer readable storage medium comprising a computer program that carries out the method of claim 11 when executed by a computer.

13. An event sequence detection method, comprising

defining a sequence including two or more stages, each of the stages including one or more events,

defining a filtering function for each of said stages, each filtering function providing a TRUE indication, when one of the events belonging to the respective event is received, and a FALSE indication otherwise,

evaluating the filtering functions with the event data,

if the filtering function of the one of the stages evaluates to TRUE, a binding function associated with the respective stage is evaluated for extracting a key from the event data,

checking whether the key already exists in a table associated with the set of stages,

if the key is not found in the table, the event with the key is added to the table,

if the key is found in the table, it is checked whether an event for the current stage is already recorded for the key,

if no event for the current stage is already recorded for the key, the event is added to the table in connection with the key and the current stage,

checking whether the key has an event recorded for each stage, and

if the key has an event recorded for each stage, determining that the sequence has been detected.

14. The method as claimed in claim 13, wherein said determining comprises determining that said sequence has been detected, when the key an event has an event recorded for each stage within a time window.

15. A computer readable storage medium comprising a computer program that carries out the method of claim 13 when executed by a computer.

16. An event sequence detection method, comprising

defining a sequence including two or more stages , each of the stages including one or more events,

defining a filtering function for each of said stages, each filtering function providing a TRUE indication, when one of the events belonging to the respective event is received, and a FALSE indication otherwise,

evaluating the filtering functions with the event data,

if the filtering function of the one of the stages evaluates to TRUE, a binding function associated with the respective stage is evaluated for extracting a key from the event data,

checking whether the key already exists in a table associated with the set of stages,

if the key is not found in the table, the event with the key is added to the table,

if the key is found in the table, it is checked whether an event for the current stage is already recorded for the key,

if no event for the current stage is already recorded for the key, the event is added to the table in connection with the key and the current stage,

if an event for the current stage is already recorded for the key, incrementing the number of events with this key and stage,

checking whether the key has a predetermined number of events recorded for each stage, and

if the key has a predetermined number of events recorded for each stage, determining that the event sequence has been detected.

17. A computer readable storage medium comprising a computer program that carries out the method of claim 16 when executed by a computer.

18. An event sequence detector block for execution by a processor in a data communications network environment, comprising:

a computer readable memory, and

a routine stored on the computer readable memory and adapted to be implemented on the processor, wherein the routine;

has a predefined sequence including two or more stages in order, each of the stages including one or more events,

has a predefined filtering function for each of said stages, each filtering function providing a TRUE indication, when one of the events belonging to the respective event is received, and a FALSE indication otherwise,

has at least one predefined binding function for each of the stages such that a pair of binding functions in two successive stages links the events in these two successive stages,

continuously receives event data,

continuously evaluates the received event data with the filtering functions,

when the evaluation results in a TRUE indication from one of the filter functions, derives at least one key value from the received event data by the corresponding at least one binding function,

determines that said sequence has been detected, when a TRUE indication has been obtained in each stage in a timely order and the derived key values link the detected events in the successive stages.

19. An event sequence detector block as claimed in claim 18, wherein said routine determines that said sequence has been detected, when a TRUE indication has been obtained in each stage in a timely order and the derived key values link the detected events in the successive stages within a time window.

20. An event sequence detector block as claimed in claim 18, wherein said routine determines the event sequence as detected, if all events of the event sequence with mutually matching key values are registered within a time window.

21. An event sequence detector block for execution by a processor in a data communications network environment, comprising:

a computer readable memory, and

a routine stored on the computer readable memory and adapted to be implemented on the processor, wherein the routine;

has a predefined event sequence including two or more events,

has a predefined filtering function and an associated binding function for each event, each filtering function providing a TRUE indication, when the respective event is received, and a FALSE indication otherwise,

continuously receives event data,

continuously evaluates the received event data with the filtering functions,

each time when the evaluation results in a TRUE indication from one of the filter functions, registers the corresponding event and a key value derived from the received event data by the corresponding binding function,

determines the sequence as detected, if all events of the sequence with mutually matching key values are registered.