System, method, and computer program product for reporting an occurrence in different manners
First Claim
1. A computer program product embodied on a non-transitory computer readable medium, comprising:
- code for identifying at least one of an operating system and an application associated with at least one of a plurality of devices;
code for accessing a data storage describing a plurality of mitigation techniques that mitigate at least one attack that takes advantage of a plurality of vulnerabilities;
code for presenting a plurality of first options in connection with the plurality of mitigation techniques that each correspond with at least one of a subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device, the plurality of first options relating to an intrusion detection or prevention mitigation technique and a firewall mitigation technique that both each correspond with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device;
code for receiving first user input selecting the intrusion detection or prevention mitigation technique that corresponds with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device;
code for receiving second user input selecting the firewall mitigation technique that corresponds with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device;
code for, based on the first user input, deploying the selected intrusion detection or prevention mitigation technique that corresponds with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device;
code for, based on the second user input, deploying the selected firewall mitigation technique that corresponds with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device;
code for identifying an occurrence including one or more packets communicated to the at least one device;
code for determining whether the occurrence is capable of taking advantage of at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device; and
code for preventing the occurrence from taking advantage of at least one of the subset of the plurality of the vulnerabilities, utilizing the selected intrusion detection or prevention mitigation technique based on the first input and utilizing the firewall mitigation technique based on the second input, by at least one of dropping or blocking the one or more packets of the occurrence that are communicated to the at least one device, and rejecting a connection request in connection with the at least one device;
said computer program product operable such that the plurality of first options are presented and at least one of the first user input selecting the intrusion detection or prevention mitigation technique and the second user input selecting the firewall mitigation technique is received before the identification of the occurrence such that at least one of the intrusion detection or prevention mitigation technique and the firewall mitigation technique is deployed for preventing the occurrence from taking advantage of at least one of the subset of the plurality of the vulnerabilities, in response to the determination that the occurrence is capable of taking advantage of at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device;
said computer program product operable such that at least one of a plurality of second options is presented and at least one of a user input selecting a post-occurrence intrusion detection or prevention mitigation technique, a user input selecting a post-occurrence firewall mitigation technique, and a user input selecting a post-occurrence other mitigation technique is received after the identification of the occurrence such that at least one of the post-occurrence intrusion detection or prevention mitigation technique, the post-occurrence firewall mitigation technique, and the post-occurrence other mitigation technique is utilized, in response to at least one of the user input selecting the post-occurrence intrusion detection or prevention mitigation technique, the user input selecting the post-occurrence firewall mitigation technique, and the user input selecting the post-occurrence other mitigation technique.
0 Assignments
0 Petitions
Accused Products
Abstract
A system, method, and computer program product are provided for identifying operating system information associated with at least one of a plurality of networked devices, and an occurrence in connection with the at least one of the networked device. It is also determined whether at least one vulnerability capable being exploited by the occurrence is relevant to the at least one networked device based on the operating system information. To this send, the occurrence is reported in a first manner, if it is determined that the at least one vulnerability capable being exploited by the occurrence is relevant to the at least one networked device based on the operating system information. Further, the occurrence is reported in a second manner different from the first manner, if it is determined that the at least one vulnerability capable being exploited by the occurrence is not relevant to the at least one networked device based on the operating system information.
-
Citations
20 Claims
-
1. A computer program product embodied on a non-transitory computer readable medium, comprising:
-
code for identifying at least one of an operating system and an application associated with at least one of a plurality of devices; code for accessing a data storage describing a plurality of mitigation techniques that mitigate at least one attack that takes advantage of a plurality of vulnerabilities; code for presenting a plurality of first options in connection with the plurality of mitigation techniques that each correspond with at least one of a subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device, the plurality of first options relating to an intrusion detection or prevention mitigation technique and a firewall mitigation technique that both each correspond with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device; code for receiving first user input selecting the intrusion detection or prevention mitigation technique that corresponds with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device; code for receiving second user input selecting the firewall mitigation technique that corresponds with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device; code for, based on the first user input, deploying the selected intrusion detection or prevention mitigation technique that corresponds with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device; code for, based on the second user input, deploying the selected firewall mitigation technique that corresponds with at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device; code for identifying an occurrence including one or more packets communicated to the at least one device; code for determining whether the occurrence is capable of taking advantage of at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device; and code for preventing the occurrence from taking advantage of at least one of the subset of the plurality of the vulnerabilities, utilizing the selected intrusion detection or prevention mitigation technique based on the first input and utilizing the firewall mitigation technique based on the second input, by at least one of dropping or blocking the one or more packets of the occurrence that are communicated to the at least one device, and rejecting a connection request in connection with the at least one device; said computer program product operable such that the plurality of first options are presented and at least one of the first user input selecting the intrusion detection or prevention mitigation technique and the second user input selecting the firewall mitigation technique is received before the identification of the occurrence such that at least one of the intrusion detection or prevention mitigation technique and the firewall mitigation technique is deployed for preventing the occurrence from taking advantage of at least one of the subset of the plurality of the vulnerabilities, in response to the determination that the occurrence is capable of taking advantage of at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application associated with the at least one device; said computer program product operable such that at least one of a plurality of second options is presented and at least one of a user input selecting a post-occurrence intrusion detection or prevention mitigation technique, a user input selecting a post-occurrence firewall mitigation technique, and a user input selecting a post-occurrence other mitigation technique is received after the identification of the occurrence such that at least one of the post-occurrence intrusion detection or prevention mitigation technique, the post-occurrence firewall mitigation technique, and the post-occurrence other mitigation technique is utilized, in response to at least one of the user input selecting the post-occurrence intrusion detection or prevention mitigation technique, the user input selecting the post-occurrence firewall mitigation technique, and the user input selecting the post-occurrence other mitigation technique. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A computer program product embodied on a non-transitory computer readable medium, comprising:
-
code for retrieving a plurality of first options from a data storage describing a plurality of mitigation techniques that mitigate at least one attack that takes advantage of a plurality of vulnerabilities; code for presenting the plurality of first options which relate to the plurality of mitigation techniques in connection with a subset of a plurality of the vulnerabilities posed by at least one of an operating system and an application of at least one device, the plurality of first options relating to an intrusion detection or prevention mitigation technique and a firewall mitigation technique; code for receiving first user input in connection with one of the first options that relates to the intrusion detection or prevention mitigation technique in connection with at least one of the subset of the plurality of the vulnerabilities posed by at least one of the operating system and the application of at least one device; code for receiving second user input in connection with one of the first options that relates to the firewall mitigation technique in connection with at least one of the subset of the plurality of the vulnerabilities posed by at least one of the operating system and the application of at least one device; code for, if the first user input is received, deploying the one of the first options that relates to the intrusion detection or prevention mitigation technique in connection with at least one of the subset of the plurality of the vulnerabilities posed by at least one of the operating system and the application of at least one device; code for, if the second user input is received, deploying the one of the first options that relates to the firewall mitigation technique in connection with at least one of the subset of the plurality of the vulnerabilities posed by at least one of the operating system and the application of at least one device; code for identifying an occurrence including one or more packets communicated to the at least one device; code for determining whether the occurrence is capable of taking advantage of at least one of the subset of the plurality of the vulnerabilities posed by the at least one of the operating system and the application of the at least one device; and code for preventing the occurrence from taking advantage of at least one of the subset of the plurality of the vulnerabilities, utilizing the intrusion detection or prevention mitigation technique if the one of the first options that relates to the intrusion detection or prevention mitigation technique is deployed and utilizing the firewall mitigation technique if the one of the first options that relates to the firewall mitigation technique is deployed, by at least one of dropping or blocking the one or more packets of the occurrence that are communicated to the at least one device, and rejecting a connection request in connection with the at least one device; said computer program product is configured for presenting the plurality of first options and receiving at least one of the first user input in connection with the one of the first options that relates to the intrusion detection or prevention mitigation technique and the second user input in connection with the one of the first options that relates to the firewall mitigation technique, before the identification of the occurrence such that at least one of;
the one of the first options that relates to the intrusion detection or prevention mitigation technique and the one of the first options that relates to the firewall mitigation technique is deployed for preventing the occurrence from taking advantage of at least one of the subset of the plurality of the vulnerabilities, in response to the determination that the occurrence is capable of taking advantage of at least one of the subset of the plurality of the vulnerabilities posed by the identified at least one of the operating system and the application of the at least one device;said computer program product is configured for presenting at least one of a plurality of second options and receiving at least one of a user input associated with an intrusion detection or prevention mitigation action, a user input associated with a firewall mitigation action, and a user input associated with an other mitigation action, after the identification of the occurrence such that at least one of the intrusion detection or prevention mitigation action, the firewall mitigation action, and the other mitigation action is utilized, in response to at least one of the user input associated with the intrusion detection or prevention mitigation action, the user input associated with the firewall mitigation action, and the user input associated with the other mitigation action. - View Dependent Claims (10, 11, 12, 13)
-
-
14. A computer program product embodied on a non-transitory computer readable medium, comprising:
-
code for receiving actual vulnerability information from at least one first data storage that is generated utilizing potential vulnerability information from at least one second data storage that is capable of being used to identify a plurality of potential vulnerabilities, by including; at least one first potential vulnerability, and at least one second potential vulnerability; said actual vulnerability information being generated utilizing the potential vulnerability information by; identifying at least one configuration associated with at least one of a plurality of networked devices, the at least one configuration relating to at least one of an operating system and an application of the at least one networked device, and determining that the at least one networked device is actually vulnerable to at least one actual vulnerability based on the identified at least one configuration, utilizing the potential vulnerability information that is capable of being used to identify the plurality of potential vulnerabilities; said actual vulnerability information from the at least one first data storage capable of identifying the at least one actual vulnerability to which the at least one networked device is actually vulnerable; code for identifying an attack involving one or more packets communicated to the at least one networked device; code for determining whether the attack is capable of taking advantage of the at least one actual vulnerability to which the at least one networked device is actually vulnerable; and code for causing different attack mitigation actions of diverse attack mitigation types, including a firewall-based attack mitigation type and an intrusion prevention system-based attack mitigation type, for preventing the attack from taking advantage of the at least one actual vulnerability of the at least one networked device by at least one of dropping or blocking the one or more packets of the attack that are communicated to the at least one networked device and rejecting a connection request in connection with the at least one networked device, based on the determination whether the attack is capable of taking advantage of the at least one actual vulnerability to which the at least one networked device is actually vulnerable, the at least one actual vulnerability being determined as a function of the at least one of the operating system and the application of the at least one networked device and the different attack mitigation actions being specific to the at least one actual vulnerability, thereby resulting in one or more relevant attack mitigation actions of the diverse attack mitigation types being caused based on the determination whether the attack is capable of taking advantage of the at least one actual vulnerability to which the at least one networked device is actually vulnerable; said computer program product operable such that a plurality of first options are presented and at least one of a first user input in connection with the firewall-based attack mitigation type and a second user input in connection with the intrusion prevention system-based attack mitigation type is received before the determination whether the attack is capable of taking advantage of the at least one actual vulnerability to which the at least one networked device is actually vulnerable, for preventing the attack from taking advantage of the at least one actual vulnerability of the at least one networked device, in response to the determination whether the attack is capable of taking advantage of the at least one actual vulnerability to which the at least one networked device is actually vulnerable; said computer program product operable such that at least one of a plurality of second options is presented and at least one of a user input selecting an intrusion prevention system action, a user input selecting a firewall action, and a user input selecting an other mitigation action is received after the determination whether the attack is capable of taking advantage of the at least one actual vulnerability to which the at least one networked device is actually vulnerable such that at least one of the intrusion prevention system action, the firewall action, and the other mitigation action is utilized, in response to at least one of the user input selecting the intrusion prevention system action, the user input selecting the firewall action, and the user input selecting the other mitigation action. - View Dependent Claims (15, 16, 17, 18, 19, 20)
-
Specification