ANALYTICS ENGINE

• US 20090199265A1
• Filed: 06/18/2008
• Published: 08/06/2009
• Est. Priority Date: 02/04/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Zangi, Eyal, Weisberg, Tomer, Sapir, Moshe, Hudis, Efim, Helman, Yair, Arzi, Lior, Rubin, Shai Aharon, Dinerstein, Yosef
• Granted Patent: US 8,990,947 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Aspects of the subject matter described herein relate to a mechanism for assessing security. In aspects, an analytics engine is provided that manages execution, information storage, and data passing between various components of a security system. When data is available for analysis, the analytics engine determines which security components to execute and the order in which to execute the security components, where in some instances two or more components may be executed in parallel. The analytics engine then executes the components in the order determined and passes output from component to component as dictated by dependencies between the components. This is repeated until a security assessment is generated or updated. The analytics engine simplifies the work of creating and integrating various security components.

Claims

1. A method implemented at least in part by a computer, the method comprising:

receiving an indication that input data related to security has been received at a sensor;

executing the sensor, the sensor producing output data based on the input data;

providing the output data to a rule; and

evaluating the rule to produce a candidate assessment regarding security of a computer-related asset.

2. The method of claim 1, wherein the input data is provided by another sensor that creates the input data by actions comprising examining other input data.

3. The method of claim 2, wherein the other input data comprises an assessment.

4. The method of claim 2, wherein the other input data comprises a log of a security component.

5. The method of claim 1, further comprising storing the candidate assessment in a store, the candidate assessment including an expiration time, a severity, and a fidelity.

6. The method of claim 1, further comprising providing a set of candidate assessments related to the asset to a consolidator and producing a public assessment based thereon, the set of candidate assessments including the candidate assessment produced by evaluating the rule.

7. The method of claim 6, wherein the sensor, the rule, and the consolidator maintain no state with respect to previous security assessments.

8. The method of claim 1, further comprising updating an assessment store with the public assessment, the public assessment including an expiration time, a severity, and a fidelity.

9. A computer storage medium having computer-executable instructions, which when executed perform actions, comprising:

receiving dependency data that indicates dependencies among security components, a security component having a dependency on another security component if the security component uses output data generated by the other security component;

receiving an indication that one of the security components has received data;

based at least in part on the dependency data, determining a set of the security components to execute and an order in which to execute the security components of the set; and

providing output data from a first security component of the set to one or more other security components of the set that depend on the first security component.

10. The computer storage medium of claim 9, wherein the order comprises having two of the security components execute in parallel, the two security components not depending on each other either directly or indirectly.

11. The computer storage medium of claim 9, wherein the order comprises having a security component that depends on another security component execute after the other security component executes.

12. The computer storage medium of claim 9, wherein each security component generates output data based solely on input data and logic included in the security component.

13. The computer storage medium of claim 9, further comprising waiting to execute a second security component until all security components upon which the second security component depends have completed execution.

14. The computer storage medium of claim 9, further comprising executing the last security component of the order to generate a security assessment that is affected at least in part, directly or indirectly, by the data received by the one of the security components.

15. In a computing environment, an apparatus, comprising:

a sensor operable to receive input data related to computer security and to provide output data in response thereto;

a rule component operable to receive the output data and to generate a candidate assessment based at least in part on the output data;

a consolidator operable to determine a second assessment based at least in part on the candidate assessment; and

a realizer operable to publish the public assessment to an assessments store.

16. The apparatus of claim 15, wherein the sensor receives the input data from a device remote from the apparatus.

17. The apparatus of claim 15, wherein the sensor receives the input data from another sensor.

18. the apparatus of claim 15, wherein the sensor receives the input data from the assessments store.

19. The apparatus of claim 15, wherein the sensor generates the output data using solely the input data and logic included in or associated with the sensor.

20. The apparatus of claim 15, wherein the apparatus further comprises an engine that is operable to perform actions, comprising:

receiving the output data from the sensor;

providing the output data from the sensor to the rule component;

storing the candidate assessment in a candidate assessment store;

providing the candidate assessment to the consolidator;

providing the second assessment to the realizer; and

storing the second assessment in the assessments store.