Data structure for policy-based remediation selection

• US 8,336,103 B2
• Filed: 06/21/2010
• Issued: 12/18/2012
• Est. Priority Date: 09/03/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Bezilla, Daniel Bailey, Immordino, John Leonard, Le Ogura, James, Ojha, Sachchida Nand
• Primary Examiner(s): Revak, Christopher
• Application Number:
  US12/819,891
• Publication Number:
  US 20100257585A1
• Time in Patent Office: 911 Days
• Field of Search: None
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A machine-actionable memory may include: one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID); and at least one POL_ID field, the contents of which denotes an ID of at least one policy (POL_ID), the at-least-one policy respectively defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device.

Claims

1. A non-transitory machine-actionable memory comprising:

one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID);

at least one POL_ID field, the contents of which denotes an ID of at least one policy (POL_ID), the at-least-one policy respectively defining a condition violation of which is potentially indicative of unauthorized activity or manipulation of the device; and

wherein;

each of the at least one POL_ID field is an index to identify at least one R_ID respectively corresponding thereto; and

the data structure for at least one of the one-or-more machine-actionable records includes;

two or more POL_ID fields, the contents of which denote two or more POL_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

two or more SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively;

two or more CE_ID fields, the contents of which denote two or more CE_ID fields; and

at least one of the following;

at least two P-55 links between the two or more POL ID_fields, respectively, and the two or more subsets,

at least two R-P links between the at-least-one R_ID field and the two or more POL_ID fields, respectively,

at least two R-SS links between the at-least-one R_ID field and the two or more subsets, respectively, and

at least two R-AS links between the at-least-one R_ID field and the two or more CE_ID fields, respectively.

2. The non-transitory machine-actionable memory of claim 1, wherein the data structure further includes:

one or more parameter fields, the contents of which denote present and one or more previous values of one or more parameters associated with the at-least-one policy.

3. The non-transitory machine-actionable memory of claim 1, wherein the data structure further includes:

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID).

4. The non-transitory machine-actionable memory of claim 1, wherein:

excursion of one or more parameter values outside of the boundaries of the at least one policy denoted by the at least one POL_ID field may be cause for invoking the remediation; and

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation.

5. The non-transitory machine-actionable memory of claim 1, wherein:

excursion of one or more parameter values outside of the boundaries of the at least one policy denoted by the at least one POL_ID field may be cause for invoking the remediation;

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation; and

implementation of the remediation upon the at least one asset denoted by the contents of the at least one CE_ID field mitigates against a future excursion of the one or more parameter values outside the boundaries of the at least one policy.

6. A non-transitory machine-actionable memory comprising:

one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID); and

at least one POL_ID field, the contents of which denotes an ID of at least one policy (POL_ID), the at-least-one policy respectively defining a condition violation of which is potentially indicative of unauthorized activity or manipulation of the device;

wherein each of the at least one POL_ID field is an index to identify at least one R_ID respectively corresponding thereto; and

wherein the data structure for at least one of the one-or-more machine-actionable records includes;

two or more POL_ID fields, the contents of which denote two or more POL_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

at least two SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively; and

at least one of the following;

at least two P-SS links between the two or more POL_ID fields, respectively, and the two or more subsets,

at least two R-P links between the at-least-one R_ID field and the two or more POL_ID fields, respectively,

at least two R-55 links between the at-least-one R_ID field and the two or more subsets, respectively.