Behavioral analysis apparatus and associated method that utilizes a system selected based on a level of data

• US 7,840,501 B1
• Filed: 07/12/2007
• Issued: 11/23/2010
• Est. Priority Date: 07/12/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sallam, Ahmed Said
• Primary Examiner(s): HOLMES, MICHAEL B
• Application Number:
  US11/777,222
• Time in Patent Office: 1,230 Days
• Field of Search: 706/10
• US Class Current: 706/10
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A behavioral analysis technique is provided that utilizes a system selected based on a level of data. In use, a level associated with data is identified. In addition, a behavioral analysis is performed on the data utilizing one of a plurality of systems that is selected based on the identified level.

Claims

1. A method, comprising:

identifying a level associated with data; and

performing a behavioral analysis on the data utilizing one of a plurality of systems that is selected based on the identified level;

wherein the level indicates a confidentiality of the data.

2. The method of claim 1, wherein the systems include a local system and a remote system.

3. The method of claim 1, wherein the systems include a local system, an enterprise system, and a global system.

4. The method of claim 1, wherein each of the systems includes a different set of behavioral analysis rules for performing the behavioral analysis.

5. The method of claim 1, wherein, if it is determined that a local system is selected, the behavioral analysis is performed utilizing the local system.

6. The method of claim 1, wherein, if it is determined that an enterprise system is selected, the data is transmitted from a local system to the enterprise system and the behavioral analysis is performed utilizing the enterprise system.

7. The method of claim 1, wherein, if it is determined that a global system is selected, at least a portion of the data is transmitted from an enterprise system to the global system and the behavioral analysis is performed utilizing the global system.

8. The method of claim 7, wherein the data is filtered before transmitting the portion of the data from the enterprise system to the global system.

9. The method of claim 1, wherein the data describes an event that occurred on a local system.

10. The method of claim 1, wherein behavioral analysis rules are generated utilizing a global system, based on the data collected from a plurality of other systems.

11. The method of claim 10, wherein the behavioral analysis rules are transmitted from the global system to another system.

12. The method of claim 11, wherein the behavioral analysis rules are transmitted from the global system to an enterprise systcm.

13. The method of claim 12, wherein at least a portion of the behavioral analysis rules are transmitted from the enterprise system to a local system.

14. The method of claim 10, wherein at least a portion of the behavioral analysis rules are transmitted from the global system to a local system.

15. The method of claim 14, wherein at least a portion of the behavioral analysis rules are transmitted from the global system to the local system, under the control of the enterprise system.

16. The method of claim 1, wherein the systems are hierarchical.

20. The method of claim 1, wherein the level associated with the data is identified based on predefined rules that indicate, for each level, characteristics associated with the data within the level.

21. The method of claim 1, wherein characteristics associated with the data are utilized for identifying the level associated with the data.

17. A computer program product embodied on a computer readable medium, comprising:

computer code for identifying a level associated with data; and

computer code for performing a behavioral analysis on the data utilizing one of a plurality of systems that is selected based on the identified level;

wherein the level indicates a confidentiality of the data.

18. An apparatus, comprising:

a processor for identifying a level associated with data, and performing a behavioral analysis on the data utilizing one of a plurality of systems that is selected based on the level associated with the data;

wherein the level indicates a confidentiality of the data.

19. The apparatus of claim 18, wherein the processor remains in communication with memory and a display via a bus.