Method of managing utilization of network intrusion detection systems in a dynamic data center

• US 20050022022A1
• Filed: 07/25/2003
• Published: 01/27/2005
• Est. Priority Date: 07/25/2003
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Raikar, Amit, Mendonca, John
• Granted Patent: US 8,296,847 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of managing utilization of network intrusion detection systems in a dynamic data center is provided. A plurality of network intrusion detection systems are provided, each being networked so that utilization of each network intrusion detection system can be based on demand for the network intrusion detection systems in the dynamic data center. A monitoring policy and a plurality of monitoring points to be monitored on a network with any of the network intrusion detection systems are received. Further, the monitoring of the monitoring points is automatically arranged using the network intrusion detection systems and the monitoring policy.

Claims

1. A method of managing utilization of network intrusion detection systems in a dynamic data center, said method comprising:

providing a plurality of network intrusion detection systems, each being networked so that utilization of each network intrusion detection system can be based on demand for said network intrusion detection systems in said dynamic data center;

receiving a monitoring policy and a plurality of monitoring points to be monitored on a network with any of said network intrusion detection systems; and

automatically arranging the monitoring of said monitoring points using said network intrusion detection systems and said monitoring policy.

2. The method as recited in claim 1 wherein said automatically arranging the monitoring of said monitoring points includes:

automatically configuring a plurality of network resources to provide network communication data from said monitoring points to a plurality of available network intrusion detection systems from said network intrusion detection systems; and

automatically configuring said available network intrusion detection systems to receive said network communication data based on said monitoring policy.

3. The method as recited in claim 2 wherein said automatically arranging the monitoring of said monitoring points further includes:

automatically increasing a number of particular network intrusion detection systems receiving said network communication data from a particular monitoring point by selecting additional available network intrusion detection systems if said network communication data exceeds a capacity of said particular network intrusion detection systems.

4. The method as recited in claim 2 wherein said automatically arranging the monitoring of said monitoring points further includes:

automatically decreasing a number of particular network intrusion detection systems receiving said network communication data from a particular monitoring point by releasing any of said particular network intrusion detection systems to said available network intrusion detection systems if said network communication data is below a predetermined threshold of a capacity of said particular network intrusion detection systems.

5. The method as recited in claim 2 wherein said network resources include one of a firewall, a gateway system, a network switch, and a network router.

6. The method as recited in claim 1 wherein said receiving a monitoring policy and a plurality of monitoring points to be monitored includes:

providing a graphical user interface to receive said monitoring policy and said plurality of monitoring points to be monitored.

7. The method as recited in claim 1 wherein said dynamic data center is a utility data center.

8. A computer-readable medium comprising computer-executable instructions stored therein for performing a method of managing utilization of network intrusion detection systems in a dynamic data center, said method comprising:

providing a plurality of network intrusion detection systems, each being networked so that utilization of each network intrusion detection system can be based on demand for said network intrusion detection systems in said dynamic data center;

receiving a monitoring policy and a plurality of monitoring points to be monitored on a network with any of said network intrusion detection systems; and

automatically arranging the monitoring of said monitoring points using said network intrusion detection systems and said monitoring policy.

9. The computer-readable medium as recited in claim 8 wherein said automatically arranging the monitoring of said monitoring points includes:

automatically configuring a plurality of network resources to provide network communication data from said monitoring points to a plurality of available network intrusion detection systems from said network intrusion detection systems; and

automatically configuring said available network intrusion detection systems to receive said network communication data based on said monitoring policy.

10. The computer-readable medium as recited in claim 9 wherein said automatically arranging the monitoring of said monitoring points further includes:

automatically increasing a number of particular network intrusion detection systems receiving said network communication data from a particular monitoring point by selecting additional available network intrusion detection systems if said network communication data exceeds a capacity of said particular network intrusion detection systems.

11. The computer-readable medium as recited in claim 9 wherein said automatically arranging the monitoring of said monitoring points further includes:

automatically decreasing a number of particular network intrusion detection systems receiving said network communication data from a particular monitoring point by releasing any of said particular network intrusion detection systems to said available network intrusion detection systems if said network communication data is below a predetermined threshold of a capacity of said particular network intrusion detection systems.

12. The computer-readable medium as recited in claim 9 wherein said network resources include one of a firewall, a gateway system, a network switch, and a network router.

13. The computer-readable medium as recited in claim 8 wherein said receiving a monitoring policy and a plurality of monitoring points to be monitored includes:

providing a graphical user interface to receive said monitoring policy and said plurality of monitoring points to be monitored.

14. The computer-readable medium as recited in claim 8 wherein said dynamic data center is a utility data center.

15. A system comprising:

a dynamic data center including;

a plurality of network resources;

a plurality of network intrusion detection systems, each being networked so that utilization of each network intrusion detection system can be based on demand for said network intrusion detection systems in said dynamic data center;

a graphical user interface for receiving a monitoring policy and a plurality of monitoring points to be monitored on a network with any of said network intrusion detection systems; and

a controller for controlling said network resources and said network intrusion detection systems and for automatically arranging the monitoring of said monitoring points using said network intrusion detection systems and said monitoring policy.

16. The system as recited in claim 15 wherein said controller automatically configures said network resources to provide network communication data from said monitoring points to a plurality of available network intrusion detection systems from said network intrusion detection systems, and wherein said controller automatically configures said available network intrusion detection systems to receive said network communication data based on said monitoring policy.

17. The system as recited in claim 16 wherein said controller automatically increases a number of particular network intrusion detection systems receiving said network communication data from a particular monitoring point by selecting additional available network intrusion detection systems if said network communication data exceeds a capacity of said particular network intrusion detection systems.

18. The system as recited in claim 16 wherein said controller automatically decreases a number of particular network intrusion detection systems receiving said network communication data from a particular monitoring point by releasing any of said particular network intrusion detection systems to said available network intrusion detection systems if said network communication data is below a predetermined threshold of a capacity of said particular network intrusion detection systems.

19. The system as recited in claim 15 wherein said network resources include one of a firewall, a gateway system, a network switch, and a network router.

20. The system as recited in claim 15 wherein said dynamic data center is a utility data center.