Hierarchical architecture in a network security system

• US 8,015,604 B1
• Filed: 10/10/2003
• Issued: 09/06/2011
• Est. Priority Date: 10/10/2003
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Arcsight Incorporated (HP Inc.)
• Inventors: Kothari, Pravin S., Tidwell, Kenny, Beedgen, Christian, Njemanze, Hugh S.
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US10/683,221
• Time in Patent Office: 2,888 Days
• Field of Search: 726/23, 726/2, 726/22, 726/26
• US Class Current: 726/22
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

A network security system having a hierarchical configuration is provided. In one embodiment the present invention includes a plurality of subsystems, where each subsystem includes a plurality of distributed software agents configured to collect security events from monitor devices, and a local manager module coupled to the plurality of distributed software agents to generate correlated events by correlating the security events. Each of the subsystems can report the correlated events to a global manager module coupled to the plurality of subsystems, and the global manager module can correlate the correlated events from each manager module.

Claims

1. A network security system comprising:

a plurality of subsystems, each subsystem comprising;

a plurality of distributed software agents, each agent configured;

to collect a security event from a monitor device; and

to transmit the security event;

a local manager module coupled to the plurality of distributed software agents, configured;

to receive, from each agent, the security event;

to generate one or more correlated events by correlating the received security events, wherein a correlated event comprises a conclusion drawn from the received security events; and

to transmit the one or more correlated events; and

a local manager agent coupled to the local manager module, configured;

to receive, from the local manager module, the one or more correlated events;

to process the one or more correlated events; and

to transmit the processed correlated events; and

a global manager module coupled to the plurality of subsystems, each subsystem comprising a local network security system, the global manager module configured;

to receive, from each subsystem, the processed correlated events; and

to correlate the received processed correlated events.

2. The network security system of claim 1, wherein each subsystem further comprises a filter coupled to the local manager module, configured:

to receive, from the local manager module, the one or more correlated events;

to select correlated events; and

to transmit the selected correlated events.

3. The network security system of claim 2, wherein the filter can be automatically programmed by the global manager module.

4. The network security system of claim 1, further comprising a back-channel between the global manager module and the local manager module configured to request a security event related to a specific correlated event received by the global manager module.

5. The network security system of claim 4, wherein the back-channel is further configured to transmit the requested security event to the global manager module.

6. The network security system of claim 1, wherein the local network security system monitors a network associated with a site.

7. A method for monitoring a plurality of local networks, the method comprising:

for each local network;

collecting security events;

generating local correlated events by correlating the collected security events at a local network security system monitoring the local network, wherein a local correlated event comprises a conclusion drawn from the collected security events; and

processing the local correlated events;

collecting, from each local network, the processed local correlated events; and

generating global correlated events by correlating the collected processed local correlated events.

8. The method of claim 7, further comprising filtering the processed local correlated events generated by each local network to determine which processed local correlated events to collect.

9. The method of claim 7, wherein the security events are collected by a plurality of distributed software agents.

10. The method of claim 7, wherein the processed local correlated events are collected by a distributed software agent associated with the local network security system.

11. The method of claim 7, wherein the global correlated events are generated by a global manager module.

12. A machine-readable medium having stored thereon data representing instructions that, when executed by a processor, causes the processor to perform operations comprising:

for each local network of a plurality of local networks;

collecting security events;

generating local correlated events by correlating the collected security events at a local network security system monitoring the local network, wherein a local correlated event comprises a conclusion drawn from the collected security events; and

processing the local correlated events;

collecting, from each local network, the processed local correlated events; and

generating global correlated events by correlating the collected processed local correlated events.

13. The machine-readable medium of claim 12, wherein the instructions further cause the processor to perform operations comprising filtering the processed local correlated events generated by each local network to determine which processed local correlated events to collect.

14. The machine-readable medium of claim 12, wherein the security events are collected by a plurality of distributed software agents.

15. The machine-readable medium of claim 12, wherein the processed local correlated events are collected by a distributed software agent associated with the local network security system.

16. The machine-readable medium of claim 12, wherein the global correlated events are generated by a global manager module.