Interoperability of vulnerability and intrusion detection systems

• US 7,509,681 B2
• Filed: 01/08/2007
• Issued: 03/24/2009
• Est. Priority Date: 01/10/2000
• Status: Expired due to Term

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: nCircle Network Security, Inc. (Belden Inc.)
• Inventors: Flowers, John S., Stracener, Thomas C.
• Primary Examiner(s): Revak; Christopher A
• Assistant Examiner(s): Moorthy; Aravind K
• Application Number:
  US11/621,027
• Publication Number:
  US 20070113285A1
• Time in Patent Office: 806 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system in accordance with an embodiment of the invention includes a vulnerability detection system (VDS) and an intrusion detection system (IDS). The intrusion detection system leverages off of information gathered about a network, such as vulnerabilities, so that it only examines and alerts the user to potential intrusions that could actually affect the particular network. In addition, both the VDS and IDS may use rules in performing their respective analyses that are query-based and that are easy to construct. In particular, these rules may be based on a set of templates, which represent various entities or processes on the network.

Claims

1. A computer-implemented method for protecting a network, the method comprising:

gathering information about the network;

using the gathered information to determine vulnerabilities of one or more hosts on the network;

examining network traffic to determine intrusions on the network; and

correlating the determined vulnerabilities of the hosts with the detected intrusions to identify network traffic indicative of an exploitation of one or more of the determined vulnerabilities.

2. The method of claim 1, wherein gathering the information comprises:

sending data to one or more hosts on the network; and

receiving responsive data from the hosts.

3. The method of claim 1, wherein gathering the information comprises:

receiving data automatically provided by the hosts on the network.

4. The method of claim 1, further comprising:

storing rules to describe vulnerabilities of the plurality of hosts,

wherein the vulnerabilities are determined at least in part by analyzing the gathered information with the rules.

5. The method of claim 4, wherein the vulnerabilities are determined at least in part by analyzing the gathered information with the rules to identify operating systems on the plurality of hosts.

6. The method of claim 4, wherein the vulnerabilities are determined at least in part by analyzing gathered information with the rules to identify open ports on the plurality of hosts.

7. The method of claim 4, wherein the vulnerabilities are determined at least in part by comparing gathered information against the rules to identify applications on the plurality of hosts.

8. The method of claim 1, wherein the correlating identifies network traffic indicative of exploitations of only the determined vulnerabilities.

9. The method of claim 1, wherein the correlating identifies network traffic indicative of exploitations of the determined vulnerabilities and of other non-verified vulnerabilities.

10. The method of claim 1, further comprising:

updating the determined vulnerabilities; and

repeating the correlating using the updated vulnerabilities.

11. The method of claim 10, wherein the updating is performed automatically in response to a change in the network.

12. The method of claim 1, further comprising:

forwarding the network traffic indicative of an exploitation of a vulnerability for a host.

13. The method of claim 1, further comprising:

forwarding the network traffic indicative of an exploitation of a vulnerability for a host, but is not directed to the host.

14. A computer-implemented method for protecting a network by a vulnerability detection system in cooperation with an intrusion detection system, the method comprising:

gathering information about the network;

using the gathered information to determine vulnerabilities of one or more hosts on the network; and

communicating the determined vulnerabilities to an intrusion detection system that is configured to examine network traffic to determine intrusions in the network and correlate the determined vulnerabilities of the hosts with the detected intrusions to identify potentially threatening malicious activity.

15. The method of claim 14, wherein gathering the information comprises:

sending data to one or more hosts on the network; and

receiving responsive data from the hosts.

16. The method of claim 14, wherein gathering the information comprises:

receiving data automatically provided by the hosts on the network.

17. The method of claim 14, further comprising:

storing rules to describe vulnerabilities of the plurality of hosts,

wherein the vulnerabilities are determined at least in part by analyzing the gathered information with the rules.

18. The method of claim 17, wherein the vulnerabilities are determined at least in part by analyzing the gathered information with the rules to identify operating systems on the plurality of hosts.

19. The method of claim 17, wherein the vulnerabilities are determined at least in part by analyzing gathered information with the rules to identify open ports on the plurality of hosts.

20. The method of claim 17, wherein the vulnerabilities are determined at least in part by comparing gathered information against the rules to identify applications on the plurality of hosts.

21. The method of claim 14, wherein the correlating identifies network traffic indicative of exploitations of only the determined vulnerabilities.

22. The method of claim 14, wherein the correlating identifies network traffic indicative of exploitations of the determined vulnerabilities and of other non-verified vulnerabilities.

23. The method of claim 14, further comprising:

updating the determined vulnerabilities; and

repeating the correlating using the updated vulnerabilities.

24. The method of claim 23, wherein the updating is performed automatically in response to a change in the network.

25. A computer program product for protecting a network, the computer program product comprising a computer-readable medium containing computer program code for:

gathering information about the network;

using the gathered information to determine vulnerabilities of one or more hosts on the network;

examining network traffic to determine intrusions on the network; and

correlating the determined vulnerabilities of the hosts with the detected intrusions to identify network traffic indicative of an exploitation of one or more of the determined vulnerabilities.

26. The computer program product of claim 25, wherein gathering the information comprises:

sending data to one or more hosts on the network; and

receiving responsive data from the hosts.

27. The computer program product of claim 25, wherein gathering the information comprises:

receiving data automatically provided by the hosts on the network.

28. The computer program product of claim 25, further comprising a computer-readable medium containing computer program code for:

storing rules to describe vulnerabilities of the plurality of hosts,

wherein the vulnerabilities are determined at least in part by analyzing the gathered information with the rules.

29. The computer program product of claim 28, wherein the vulnerabilities are determined at least in part by analyzing the gathered information with the rules to identify operating systems on the plurality of hosts.

30. The computer program product of claim 28, wherein the vulnerabilities are determined at least in part by analyzing gathered information with the rules to identify open ports on the plurality of hosts.

31. The computer program product of claim 28, wherein the vulnerabilities are determined at least in part by comparing gathered information against the rules to identify applications on the plurality of hosts.

32. The computer program product of claim 25, wherein the correlating identifies network traffic indicative of exploitations of only the determined vulnerabilities.

33. The computer program product of claim 25, wherein the correlating identifies network traffic indicative of exploitations of the determined vulnerabilities and of other non-verified vulnerabilities.

34. The computer program product of claim 25, further comprising a computer-readable medium containing computer program code for:

updating the determined vulnerabilities; and

repeating the correlating using the updated vulnerabilities.

35. The computer program product of claim 34, wherein the updating is performed automatically in response to a change in the network.

36. The computer program product of claim 25, further comprising a computer-readable medium containing computer program code for:

forwarding the network traffic indicative of an exploitation of a vulnerability for a host.

37. The computer program product of claim 25, further comprising a computer-readable medium containing computer program code for:

forwarding the network traffic indicative of an exploitation of a vulnerability for a host, but is not directed to the host.

38. A computer program product for protecting a network by a vulnerability detection system in cooperation with an intrusion detection system, the computer program product comprising a computer-readable medium containing computer program code for:

gathering information about the network;

using the gathered information to determine vulnerabilities of one or more hosts on the network; and

communicating the determined vulnerabilities to an intrusion detection system that is configured to examine network traffic to determine intrusions in the network and correlate the determined vulnerabilities of the hosts with the detected intrusions to identify potentially threatening malicious activity.

39. The computer program product of claim 38, wherein gathering the information comprises:

sending data to one or more hosts on the network; and

receiving responsive data from the hosts.

40. The computer program product of claim 38, wherein gathering the information comprises:

receiving data automatically provided by the hosts on the network.

41. The computer program product of claim 38, further comprising a computer-readable medium containing computer program code for:

storing rules to describe vulnerabilities of the plurality of hosts,

wherein the vulnerabilities are determined at least in part by analyzing the gathered information with the rules.

42. The computer program product of claim 41, wherein the vulnerabilities are determined at least in part by analyzing the gathered information with the rules to identify operating systems on the plurality of hosts.

43. The computer program product of claim 41, wherein the vulnerabilities are determined at least in part by analyzing gathered information with the rules to identify open ports on the plurality of hosts.

44. The computer program product of claim 41, wherein the vulnerabilities are determined at least in part by comparing gathered information against the rules to identify applications on the plurality of hosts.

45. The computer program product of claim 38, wherein the correlating identifies network traffic indicative of exploitations of only the determined vulnerabilities.

46. The computer program product of claim 38, wherein the correlating identifies network traffic indicative of exploitations of the determined vulnerabilities and of other non-verified vulnerabilities.

47. The computer program product of claim 38, further comprising a computer-readable medium containing computer program code for:

updating the determined vulnerabilities; and

repeating the correlating using the updated vulnerabilities.

48. The computer program product of claim 47, wherein the updating is performed automatically in response to a change in the network.