Method and system for responding to a computer intrusion

• US 20040111637A1
• Filed: 12/05/2002
• Published: 06/10/2004
• Est. Priority Date: 12/05/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Stading, Tyron Jerrod, Gilfix, Michael, Garrison, John Michael, Baffes, Paul T., Hsu, Allan
• Granted Patent: US 7,941,854 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A method and system for managing an intrusion on a computer by graphically representing an intrusion pattern of a known past intrusion, and then comparing the intrusion pattern of the known intrusion with a current intrusion. The intrusion pattern may either be based on intrusion events, which are the effects of the intrusion or activities that provide a signature of the type of intrusion, or the intrusion pattern may be based on hardware topology that is affected by the intrusion. The intrusion pattern is graphically displayed with scripted responses, which in a preferred embodiment are presented in pop-up windows associated with each node in the intrusion pattern. Alternatively, the response to the intrusion maybe automatic, based on a pre-determined percentage of common features in the intrusion pattern of the known past intrusion and the current intrusion.

Claims

1. A method for managing an intrusion on a computer, the method comprising:

graphically representing an intrusion path of a known intrusion, the graphical representation including a scripted response at a node in the intrusion path;

matching a current intrusion of the computer to the graphical representation of the known intrusion according to at least one common feature in the intrusion path of the known intrusion and the current intrusion; and

responsive to the matching of the known intrusion and the current intrusion, initiating the scripted response, which is capable of responding to the current intrusion.

2. The method of claim 1, wherein the intrusion pattern is based on intrusion events.

3. The method of claim 1, wherein the intrusion pattern is based hardware topology affected by the known intrusion.

4. The method of claim 1, wherein the known intrusion and the current intrusion are the same, and wherein the scripted response for the current intrusion is based on historical data for the known intrusion.

5. The method of claim 1, wherein the known intrusion and the current intrusion are different, and wherein the scripted response for the current intrusion is based on historical data for the known intrusion.

6. The method of claim 1, further comprising:

associating a list of suggested scripted responses with each node in the intrusion path graphical representation; and

selecting one of the suggested scripted responses for each node in the intrusion path graphical representation.

7. The method of claim 6, further comprising selecting a highest suggested scripted response for each node in the intrusion path graphical representation.

8. The method of claim 7, further comprising selecting contemporaneously the highest suggested response for all nodes in the intrusion path graphical representation.

9. The method of claim 7, further comprising:

automatically performing the method described in claim 7 based on an historical pattern of selecting all highest suggested responses for all nodes in the intrusion path graphical representation.

10. The method of claim 1, further comprising:

automatically performing the method described in claim 1 according to an expected response time for manually initiating the scripted response.

11. The method of claim 1, further comprising:

automatically performing the method described in claim 1 based on a severity of the current intrusion, wherein the scripted response is at a severity level appropriate to the severity of the current intrusion.

12. The method of claim 1, further comprising:

automatically performing the method described in claim 1 based on a type classification of the current intrusion.

13. The method of claim 1, further comprising:

notifying a remote receiver of the current intrusion; and

remotely initiating the scripted response in response to the remote notification of the current intrusion.

14. The method of claim 13, wherein the remote receiver is a wireless device.

15. A system for managing an intrusion on a computer, the system comprising:

means for graphically representing an intrusion pattern of a known intrusion, the graphical representation including a scripted response at a node in the intrusion path;

means for matching a current intrusion of the computer to the graphical representation of the known intrusion according to at least one common feature in the intrusion path of the known intrusion and the current intrusion; and

means for initiating a scripted response for the current intrusion according to the matching of the known intrusion and the current intrusion.

16. The system of claim 15, wherein the intrusion pattern is based on intrusion events.

17. The system of claim 15, wherein the intrusion pattern is based on a hardware topology affected by the known intrusion.

18. The system of claim 15, wherein the known intrusion and the current intrusion are essentially the same, and wherein the scripted response for the current intrusion is based on historical data for the known intrusion.

19. The system of claim 15, wherein the known intrusion and the current intrusion are different, and wherein the scripted response for the current intrusion is based on historical data for the known intrusion.

20. The system of claim 15, further comprising:

means for associating a list of suggested scripted responses with each node in the intrusion path; and

means for selecting one of the suggested scripted responses for each node.

21. The system of claim 20, further comprising means for selecting a highest suggested scripted response for each node.

22. The system of claim 21, further comprising means for selecting contemporaneously the highest suggested response for all nodes.

23. The system of claim 20, further comprising:

means for automatically performing the method described in claim 20 based on an historical pattern of selecting all highest suggested responses for all nodes.

24. The system of claim 15, further comprising:

means for automatically performing the method described in claim 15 according to an expected response time for manually initiating the scripted response.

25. The system of claim 15, further comprising:

means for automatically performing the method described in claim 15 based on a severity of the current intrusion, wherein the scripted response is at a severity level appropriate to the severity of the current intrusion.

26. The system of claim 15, further comprising:

means for automatically performing the method described in claim 15 based on a type classification of the current intrusion.

27. The system of claim 15, further comprising:

means for notifying a remote receiver of the current intrusion; and

means for remotely initiating the scripted response in response to the remote notification of the current intrusion.

28. The system of claim 27, wherein the remote receiver is a wireless device.

29. A computer usable medium for managing an intrusion on a computer, the computer usable medium comprising:

computer program code for graphically representing an intrusion pattern of a known intrusion, the graphical representation including a scripted response at a node in the intrusion path;

computer program code for matching a current intrusion of the computer to the graphical representation of the known intrusion according to at least one common feature in the intrusion path of the known intrusion and the current intrusion; and

computer program code for initiating a scripted response for the current intrusion according to the matching of the known intrusion and the current intrusion.

30. The computer usable medium of claim 29, wherein the intrusion pattern is based on intrusion events.

31. The computer usable medium of claim 29, wherein the intrusion pattern is based on a hardware topology affected by the known intrusion.

32. The computer usable medium of claim 29, wherein the known intrusion and the current intrusion are essentially the same, and wherein the scripted response for the current intrusion is based on historical data for the known intrusion.

33. The computer usable medium of claim 29, wherein the known intrusion and the current intrusion are different, and wherein the scripted response for the current intrusion is based on historical data for the known intrusion.

34. The computer usable medium of claim 29, further comprising:

computer program code for associating a list of suggested scripted responses with each node in the intrusion path; and

computer program code for selecting one of the suggested scripted responses for each node.

35. The computer usable medium of claim 34, further comprising computer program code for selecting a highest suggested scripted response for each node.

36. The computer usable medium of claim 35, further comprising computer program code for selecting contemporaneously the highest suggested response for all nodes.

37. The computer usable medium of claim 36, further comprising:

computer program code for automatically performing the computer usable medium described in claim 36 based on an historical pattern of selecting all highest suggested responses for all nodes.

38. The computer usable medium of claim 29, further comprising:

computer program code for automatically performing the computer usable medium described in claim 29 according to an expected response time for manually initiating the scripted response.

39. The computer usable medium of claim 29, further comprising:

computer program code for automatically performing the computer usable medium described in claim 29 based on a severity of the current intrusion, wherein the scripted response is at a severity level appropriate to the severity of the current intrusion.

40. The computer usable medium of claim 29, further comprising:

computer program code for automatically performing the computer usable medium described in claim 29 based on a type classification of the current intrusion.

41. The computer usable medium of claim 29, further comprising:

computer program code for notifying a remote receiver of the current intrusion; and

computer program code for remotely initiating the scripted response in response to the remote notification of the current intrusion.

42. The computer usable medium of claim 41, wherein the remote receiver is a wireless device.