Mechanism to augment IPS/SIEM evidence information with process history snapshot and application window capture history

• US 9,906,548 B2
• Filed: 10/12/2016
• Issued: 02/27/2018
• Est. Priority Date: 03/19/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lee, Chien Pang, Mahadevan, Hariharan
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): TAYLOR, SAKINAH W
• Application Number:
  US15/291,107
• Publication Number:
  US 20170034202A1
• Time in Patent Office: 503 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 16/71 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 3/0487 using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method to augment a plurality of IPS or SIEM evidence information is provided. The method may include monitoring a plurality of processes associated with a computer system. The method may also include identifying a plurality of processes that have network activity. The method may further include capturing the identified plurality of processes that have network activity. The method may also include storing the identified captured plurality of processes that have network activity. The method may include monitoring a plurality of selected programs associated with an operating system of the computer system. The method may also include identifying a plurality of selected programs that have network activity. The method may further include capturing a plurality of screen capture images associated with the identified plurality of selected programs. The method may include storing, by the second component the captured plurality of system process activity.

Claims

1. A method comprising:

responsive to detecting network activity on an operating system (OS) process actively operating on a computer system, identifying, by the one or more computer processors, the OS process;

responsive to identifying the OS process, capturing, by the one or more computer processors, one or more graphical representations of each graphical user interface (GUI) window of the OS process;

responsive to identifying the OS process, recording, by the one or more computer processors, process activity of the OS process;

calculating, by the one or more computer processors, a weight for the OS process, wherein the weight for the OS process quantitatively indicates a risk level for network attacks on the OS process;

storing, by the one or more computer processors, a first file including a sequence of the one or more graphical representations of each GUI window of the OS process;

storing, by the one or more computer processors, a second file including the process activity of the OS process, wherein the first file and the second file are video files retrieved by an intrusion prevention software/security information and event management software (IPS/SIEM), and wherein the packet information is a packet capture dump and event information is IPS/SIEM event information, and wherein the steps of storing the first file and the second file comprise;

allocating, by the one or more computer processors, a number of storage resources in a storage repository to store the first file, based on the calculated weight for the OS process whereby a first OS process having a greater calculated weight is allocated a greater number of storage resources in the storage repository to store the first file compared to a second OS process having a lesser calculated weight; and

allocating, by the one or more computer processors, a number of storage resources in the storage repository to store the second file, based on the calculated weight for the OS process, whereby the first OS process having the greater calculated weight is allocated a greater number of storage resources in the storage repository to store the second file compared to the second OS process having the lesser calculated weight;

responsive to detecting a network attack, retrieving, by the one or more computer processors, the first file and the second file;

attaching, by the one or more computer processors, the first file and the second file together with packet information and event information into a single Binary Large OBject (BLOB), wherein the single BLOB is a collection of binary data stored as a single entity in a database management system; and

sending, by the one or more computer processors, an electronic notification of the single BLOB to a management console associated with the computer system.

2. The method of claim 1, wherein the one or more graphical representations of each GUI window of the OS process is a screen capture of each GUI window of the OS process, including one or more delta algorithms describing changes between each GUI window.

3. The method of claim 1, wherein the step of calculating the weight for the OS process comprises:

determining, by the one or more computer processors, process parameters for the OS process, wherein one of the process parameters for the OS process indicates a number of network sockets opened for OS process; and

calculating, by the one or more computer processors, the weight for the OS process based on the process parameters for the OS process.

4. The method of claim 3, wherein one of the process parameters of the OS process includes an indication whether the OS process receives a user input.