Security Monitoring Tool for Computer Network

• US 20080060071A1
• Filed: 09/01/2006
• Published: 03/06/2008
• Est. Priority Date: 09/01/2006
• Status: Active Grant

• Current Assignee: John G. Roane, Robert John Hennan
• Original Assignee: John G. Roane, Robert John Hennan
• Inventors: Hennan, Robert John, Roane, John G.
• Granted Patent: US 7,904,456 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A security monitoring tool and method for a computer network receives data and determines whether the data is associated with a host already stored in a database. Based on the determination, the tool stores the data as a new host or associates it with an existing host. The tool also uses the received data to improve how previously stored data is associated with hosts. In one aspect, the tool determines whether the received data indicates that data currently associated with a stored host represents data for at least two hosts. If so, the tool splits the data into two hosts and associates the received data to the appropriate host. In another aspect, the tool determines whether the received data indicates that data currently associated with two or more hosts represent data for only one host. If so, the tool merges the data into one host and associates the received data with that host.

Claims

1. A computer security monitoring method, comprising;

storing information about a plurality of known hosts, each of the known hosts being an entity of a computer network;

receiving data from one or more sources;

associating and storing at least some of the data and at least some information about a first of the known hosts with at least two hosts if it is determined that, based on the data, the information associated with the first known host is more accurately associated with the at least two hosts; and

associating and storing at least some of the data and at least some information about at least two of the known hosts with a single host if it is determined that, based on the data, the information associated with the at least two known hosts is more accurately associated with the single host.

2. The method of claim 1, wherein the act of storing information about a plurality of known hosts comprises assigning each of the known hosts with a unique host key.

3. The method of claim 1, further comprising associating and storing at least some of the data with a new host if it is determined that the at least some of the data is not associated with information about one of the known hosts.

4. The method of claim 1, further comprising associating and storing at least some of the data with at least one of the known hosts if it is determined that the at least some of the data is associated with information about the at least one known host.

5. The method of claim 4, wherein the data includes at least one identifier, and wherein to determine that at least some of the data is associated with information about the at least one known host, the method comprises:

retrieving information about the at least one known host, wherein the at least one known host has the same identifier as the data;

determining whether a conflict exists between at least a portion of the data with the retrieved information; and

associating the data with the at least one known host based on whether the conflict exists.

6. The method of claim 5, wherein—

the at least one identifier comprises a Network Basic Input/Output System name, and

the act of determining whether a conflict exists comprises determining if a Media Access Control address or a Domain Name System name in the data conflicts with a Media Access Control address or a Domain Name System name in the retrieved information.

7. The method of claim 5, wherein—

the at least one identifier comprises a Media Access Control address, and

the act of determining whether a conflict exists comprises determining if a Domain Name System name in the data conflicts with a Domain Name System name in the retrieved information.

8. The method of claim 5, wherein—

the at least one identifier comprises a Domain Name System name, and

the act of determining whether a conflict exists comprises determining if a Media Access Control address in the data conflicts with a Media Access Control address in the retrieved information.

9. The method of claim 5, wherein—

the at least one identifier comprises an Internet Protocol address, and

the act of determining whether a conflict exists comprises determining if a Network Basic Input/Output System name in the data conflicts with a Network Basic Input/Output System name in the retrieved information.

10. The method of claim 1, wherein the data comprises a first identifier and a second identifier, and wherein to determine that, based on the data, the information associated with the first known host is more accurately associated with the at least two hosts, the method comprises:

retrieving first information about the first known host, wherein the first information includes a first date that is older than a date of the data;

retrieving second information about the first known host, wherein the second information has a second date older than the first date; and

associating the first information to a new host and associating the data and the second information to the first known host if the first information has a different first identifier than in the data and if the second information has a same first identifier as the data.

11. The method of claim 10, wherein the first identifier comprises a Network Basic Input/Output System name, and wherein the second identifier comprises a Media Access Control address.

12. The method of claim 1, wherein the data comprises first, second, and third identifiers, and wherein to determine that, based on the data, the information associated with the at least two known hosts is more accurately associated with the single host, the method comprises:

associating the data with first information about a first known host based on a comparison of the data with the first information;

retrieving second information about at least one second known host not associated with the first known host but having the same first identifier as the data; and

associating the data, the first information, and the second information with the single host if the second information has the same second and third identifiers as the data.

13. The method of claim 12, wherein the first identifier comprises an Internet Protocol address, wherein the second identifier comprises a Network Basic Input/Output System name, and wherein the third identifier comprises a Media Access Control address.

14. The method of claim 1, wherein the data comprises first and second identifiers, and wherein to determine that, based on the data, the information associated with the at least two known hosts is more accurately associated with the single host, the method comprises:

associating the data with first information about a first known host based on a comparison of the data with the first information;

retrieving second information about at least one second known host not associated with the first known host but having the same first identifier as the data; and

associating the data, the first information, and the second information with the single host if the second information has the same second identifier as the data.

15. The method of claim 14, wherein the first identifier comprises a Media Access Control address, and wherein the second identifier comprises a Network Basic Input/Output System name.

16. The method of claim 1, further comprising receiving a definition of an incident concerning the computer network, and automatically associating information about one or more of the known hosts with the incident based on the definition.

17. The method of claim 16, further comprising tracking whether a user update has been made to the one or more known hosts associated with the incident;

and providing the one or more known hosts associated with the incident that have not been updated to a user for updating.

18. The method of claim 1, further comprising receiving at least one search criterion, and returning a search result for one of the known hosts based on the at least one search criterion, the search result having a clustered set of interfaces between the one known host and the computer network.

19. A programmable storage device having program instructions stored thereon for causing a programmable control device to perform a method according to any one of claims 1 through 18.

20. A computer security monitoring tool, comprising:

a database storing information on a plurality of known hosts, each known host being an entity of a computer network;

an interface module receiving data from one or more sources; and

a program module associating the data with hosts and storing the data in the

database, the program module configured to—

split the information currently associated with one of the known hosts into at least two hosts if it is determined that, based on the data, the information currently associated with the one known host is more accurately associated with the at least two hosts; and

merge the information currently associated with at least two known hosts into a single host if it is determined that, based on the data, the information currently associated with the at least two hosts is more accurately associated with the single host.

21. The tool of claim 20, further comprising a loader assigned to one of the sources, the loader obtaining data from the source and making the obtained data available to the interface module.

22. The tool of claim 21, wherein the loader is selected from the group consisting of a script, a sniffer, an external application, and a passive operating system fingerprinting mechanism.

23. The security tool of claim 21, wherein the source is selected from the group consisting of a log file, a text log, a system log, a syslog stream, a Domain Controller log, an Active Directory log, a Firewall log, a database, an intrusion detection system database, a configuration management database, a Web Registration Database, a patch management database, a network scan, an Nmap scan, an NBTscan, an Internet security system vulnerability scan, an external application, a security system, an incident detection system, and a passive operating system fingerprinting mechanism.

24. The tool of claim 20, further comprising a graphical user interface module operatively coupled to the database and the program module and accessible by a user via a browser.

25. The tool of claim 24, where in the graphical user interface module is configured to receive a definition of an incident concerning the computer network from the user, and wherein the program module is configured to automatically associate information about one or more of the known hosts with the incident based on the definition.

26. The tool of claim 25, wherein the program module is configured to track whether an update has been made by a user to the one or more known hosts associated with the incident, and wherein the graphical user interface is configured to provide the one or more known hosts associated with the incident that have not been updated to a user for updating.

27. The tool of claim 24, wherein the graphical user interface module is configured to receive at least one search criterion and to return a search result for one of the known hosts based on the at least one search criterion, the search result having a clustered set of interfaces between the one known host and the computer network.

28. The tool of claim 20, wherein the database comprises a plurality of host records storing host information, the host records comprising one or more of a unique key to identify the host, a NetBIOS name, a NetBIOS domain, a date the host was last seen on the computer network, a date the host record was last updated, a date host related information was last collected, a location of the host, an operating system of the host, a serial number of the host, and an asset tag of the host.

29. The tool of claim 20, wherein the database comprises a plurality of interface records storing interface information related to the hosts interfacing with the computer network, the interface records comprising one or more of a time value for when the host connected with the computer network, an Internet Protocol address, a MAC address, a Domain Name System name, a NetBIOS name, a NetBIOS domain, a switch, a switch port, a jack number, a Network Interface Card, and a unique key to identify the host.

30. The tool of claim 20, wherein to associate the data with hosts, the program module is configured to associate the data from the interface module with a new host if it is determined that the data from the interface module is not associated with the information about one of the known hosts already stored in the database.

31. The tool of claim 20, wherein to associate the data with hosts, the program module is configured to associate the data from the interface module with one of the known hosts already stored in the database if it is determined that the data is associated with the information about the one known host.

32. The tool of claim 20, wherein to split the information currently associated with one of the known host into at least two hosts, the program module is configured to:

retrieve first information about a first known host stored in the database, wherein the first information includes a first date that is older than a date of the data from the interface module;

retrieve second information about the first known host, wherein the second information has a second date older than the first date; and

associate the first information to a new host and associate the second information along with the data to the first known host if;

(a) the first information has a different Network Basic Input/Output System name than the data, and

(b) the second information has a same Media Access Control address as the data.

33. The tool of claim 20, wherein to merge the information currently associated with at least two known hosts into a single host, the program module is configured to:

associate the data with first information about a first known host based on a comparison of the data with the first information;

retrieve second information about at least one second known host not associated with the first known host but having a same Internet Protocol address as the data; and

associate the data, the first information, and the second information with the single host if;

(a) the second information has a same Network Basic Input/Output System name as the data, and

(b) the second information has a same Media Access Control address as the data.

34. The tool of claim 20, wherein to merge the information currently associated with at least two hosts into a single host, the program module is configured to:

associate the data with first information about a first known host based on a comparison of the data with the first information;

retrieve second information about at least one second known host not associated with the first known host but having a same Media Access Control address as the data; and

associate the data, the first information, and the second information with the single host if the second information has a same Network Basic Input/Output System name as the data.