SYSTEM FOR REGULATING HOST SECURITY CONFIGURATION

• US 20110252470A1
• Filed: 06/23/2011
• Published: 10/13/2011
• Est. Priority Date: 10/19/2007
• Status: Active Grant

• Current Assignee: Trend Micro Kabushiki Kaisha
• Original Assignee: Trend Micro Kabushiki Kaisha
• Inventors: Durie, Anthony Robert
• Granted Patent: US 8,225,398 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A recommendation engine coupled to a server computer in communication with a plurality of hosts is described. The recommendation engine includes computer readable intrusion-protection instructions stored in a memory device, which cause a processor of said server computer to determine a current host-protection configuration for a target host; detect discrepancy between said current host-protection configuration and a prior host-protection configuration; install said current host-protection configuration in said target host upon detecting said discrepancy; record successive host-reconfiguration periods, a host reconfiguration period being a difference between successive instants of time at which a current host-protection configuration differs from a prior host-protection configuration; determine a monitoring period according to a value of at least one of said successive host-reconfiguration periods; and a scheduler for activating said intrusion-protection instructions according to said monitoring period.

Claims

1. A recommendation engine coupled to a server computer in communication with a plurality of hosts, the recommendation engine comprising:

computer readable intrusion-protection instructions stored in a memory device, which cause a processor of said server computer to;

determine a current host-protection configuration for a target host;

detect discrepancy between said current host-protection configuration and a prior host-protection configuration;

install said current host-protection configuration in said target host upon detecting said discrepancy;

record successive host-reconfiguration periods, a host reconfiguration period being a difference between successive instants of time at which a current host-protection configuration differs from a prior host-protection configuration;

determine a monitoring period according to a value of at least one of said successive host-reconfiguration periods; and

a scheduler for activating said intrusion-protection instructions according to said monitoring period.

2. The recommendation engine of claim 1 further comprising a database having computer readable instructions and data stored in a memory, forming:

a set of queries for acquiring data elements from said target host; and

a set of rules executing expressions for determining said current host-protection configuration based on said data elements.

3. The recommendation engine of claim 2, wherein the data elements characterize a configuration of the target host and software processes executed within the target host.

4. The recommendation engine of claim 1 wherein said intrusion-protection instructions further cause said processor to determine said monitoring period as a function of a current host-reconfiguration period of said successive host-reconfiguration periods and a preceding monitoring period of said target host.

5. The recommendation engine of claim 4 wherein said intrusion-protection instructions further cause said processor to determine said monitoring period for each host of the plurality of hosts.

6. The recommendation engine of claim 4 wherein the function is an arithmetic mean value.

7. The recommendation engine of claim 4 wherein the function is an geometric mean value.

8. The recommendation engine of claim 1 wherein said intrusion-protection instructions further cause said processor to determine said monitoring period as a function of a predetermined number of host-reconfiguration periods of said successive host-reconfiguration periods.

9. The recommendation engine of claim 8 wherein said intrusion-protection instructions further cause said processor to determine said monitoring period for each host of the plurality of hosts.

10. The recommendation engine of claim 8 wherein the function is an arithmetic mean value.

11. The recommendation engine of claim 8 wherein the function is a geometric mean value.

12. The recommendation engine of claim 10 wherein said intrusion-protection instructions further cause said processor to determine said monitoring period as said arithmetic mean value minus a standard deviation of said predetermined number of host-reconfiguration periods subject to a condition that the monitoring period exceeds a predetermined lower bound.

13. The recommendation engine of claim 2 wherein said set of queries is being selected from a superset of queries, according to a current state of said target host, so that, for each query, starting with a root query, a subsequent query is determined according to a data element received from said target host in response to said each query, where a null subsequent query completes formation of said set of queries.

14. The recommendation engine of claim 2 wherein said intrusion-protection instructions further cause said processor to:

determine host-specific rules applicable to said target host;

determine a set of queries from a superset of queries according to a current state of said target host;

identify for each query within said set of queries specific rules among said host-specific rules which rely on said each query;

send said each query only once to said target host; and

apply a result of said query to each of said specific rules.

15. The recommendation engine of claim 2 wherein said intrusion-protection instructions further cause said processor to:

determine a set of host-specific rules applicable to said target host;

determine a set of host-specific descriptors applicable to said target host;

form a table identifying specific rules, from among said set of host-specific rules, corresponding to each descriptor within said set of host-specific descriptors;

send a query to said target host to acquire a value of said each descriptor; and

apply a result of said query to each of said specific rules.

16. The recommendation engine of claim 2 wherein said intrusion-protection instructions further cause said processor to:

define a superset of descriptors characterizing said target host;

classify hosts supported by said server into host classes;

divide said superset of descriptors into host-specific descriptor sets each host-specific descriptor applicable to each host within a respective host class;

divide each host-specific descriptor set into rule domains each rule domain being applicable to a respective rule and being independent of the state of said each host;

determine a subset of descriptors, of said each rule domain, which are dependent on a current state of said target host;

acquire data elements characterizing said target host corresponding to said subset of descriptors; and

execute said respective rule using said data elements.

17. The recommendation engine of claim 2 wherein said intrusion-protection instructions further cause said processor to:

identify a set of queries relevant to said target host;

identify a set of rules applicable to said target host where each rule within said set of rules relies on at least one data element characterizing said target host and acquired through at least one query within said set of queries;

send all queries of said set of queries to said target host to acquire corresponding data elements;

store said corresponding data element in a memory device of said server;

identify specific queries of said set of queries which return data elements differing from corresponding previously stored data elements;

identify specific rules, within said set of rules, each of which relying on at least one of said specific queries; and

execute said specific rules.

18. The recommendation engine of claim 1 wherein said intrusion-protection instructions further cause said processor to impose an upper bound of said monitoring period, the upper bound being specific to said target host.

19. The recommendation engine of claim 1 wherein said intrusion-protection instructions further cause said processor to impose a lower bound of said monitoring period, the lower bound being specific to said target host.

20. The recommendation engine of claim 1 wherein said intrusion-protection instructions further cause said processor to determine a global monitoring period during which each host in said plurality of hosts is selected at least once as said target host.