Intrusion management system and method for providing dynamically scaled confidence level of attack detection

• US 8,020,208 B2
• Filed: 07/12/2005
• Issued: 09/13/2011
• Est. Priority Date: 07/12/2004
• Status: Expired due to Fees

• Current Assignee: Check Point Software Technologies Incorporated (Check Point Software Technologies Limited)
• Original Assignee: NFR Security, Inc. (Check Point Software Technologies Limited)
• Inventors: Yee, Andre, Frantzen, Michael T.
• Primary Examiner(s): Shiferaw; Eleni
• Assistant Examiner(s): WILLIAMS, JEFFERY L
• Application Number:
  US11/178,585
• Publication Number:
  US 20060037078A1
• Time in Patent Office: 2,254 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An Intrusion Management System detects computer attacks and automatically adjusts confidence that an attack was correctly detected. When the Intrusion Management System detects the attack against a computer system, it does not represent an accuracy of detection as an immutable confidence value. Instead, the Intrusion Management System tabulates information indirectly related to the attack and dynamically scales the confidence in the attack detection accordingly.

Claims

1. A method for dynamically scaling a confidence level of a detected attack on a computer system, the detected attack being detected by an intrusion management system in a communication with the computer system, the method comprising:

(a) assigning an initial confidence level to the detected attack;

(b) detecting, in the communication, at least one scalar selected from the group consisting of (i) a first scalar indicating packet loss in the communication, (ii) a second scalar indicating whether the intrusion management system has observed the communication from a beginning of the communication, and (iii) a third scalar indicating whether the communication includes any information not understood by the intrusion management system; and

(c) scaling the initial confidence level in accordance with the at least one scalar detected in step (b) to provide a scaled confidence level.

2. The method of claim 1, wherein step (c) comprises scaling the initial confidence level further in accordance with a manual input.

3. The method of claim 1, wherein:

step (b) comprises detecting at least two of said scalars selected from said group; and

step (c) comprises scaling the initial confidence level in accordance with said at least two scalars.

4. The method of claim 3, wherein:

step (b) comprises detecting all three of said scalars selected from said group; and

step (c) comprises scaling the initial confidence level in accordance with said all three scalars.

5. The method of claim 3, wherein said at least two scalars comprise said third scalar.

6. The method of claim 5, wherein:

said third scalar comprises a number of times the intrusion management system does not understand the information in the communication; and

step (c) comprises scaling the initial confidence level in accordance with said number of times.

7. The method of claim 1, wherein said detected attack is received from the Internet.

8. The method of claim 1, wherein the intrusion management system is connected in a passive configuration to the computer system, such that the communication does not pass through the intrusion management system.

9. An intrusion management system for dynamically scaling a confidence level of a detected attack on a computer system, the detected attack being detected by the intrusion management system in a communication with the computer system, the intrusion management system comprising:

a connection to the computer system to monitor the communication; and

a processor for;

(a) assigning an initial confidence level to the detected attack;

(b) detecting, in the communication, at least one scalar selected from the group consisting of (i) a first scalar indicating packet loss in the communication, (ii) a second scalar indicating whether the intrusion management system has observed the communication from a beginning of the communication, and (iii) a third scalar indicating whether the communication includes any information not understood by the intrusion management system; and

(c) scaling the initial confidence level in accordance with the at least one scalar detected in step (b) to provide a scaled confidence level.

10. The intrusion management system of claim 9, wherein the processor performs step (c) by scaling the initial confidence level further in accordance with a manual input.

11. The intrusion management system of claim 9, wherein:

the processor performs step (b) by detecting at least two of said scalars selected from said group; and

the processor performs step (c) by scaling the initial confidence level in accordance with said at least two scalars.

12. The intrusion management system of claim 11, wherein:

the processor performs step (b) by detecting all three of said scalars selected from said group; and

the processor performs step (c) by scaling the initial confidence level in accordance with said all three scalars.

13. The intrusion management system of claim 11, wherein said at least two scalars comprise said third scalar.

14. The intrusion management system of claim 13, wherein:

said third scalar comprises a number of times the intrusion management system does not understand the information in the communication; and

the processor performs step (c) by scaling the initial confidence level in accordance with said number of times.