Directing Audited Data Traffic to Specific Repositories

• US 20180139243A1
• Filed: 12/20/2017
• Published: 05/17/2018
• Est. Priority Date: 12/08/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Foley, Sean C., Segal, Ury, Shan, Shidong
• Granted Patent: US 10,397,279 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Data traffic is monitored on a network with data access elements thereof collected and compared to security rules. An audit data collection is sent to a repository responsive to data access elements matching a condition of the security rules, where security rules having the condition designate the audit data collection and repository. A tag to data traffic is applied responsive to the matching condition. Comparing of collected data access elements to the corresponding security rules having the matching condition is discontinued responsive to applying the tag. The tag indicates a repository and the data traffic includes a connection and session. An audit data collection is sent to the repository indicated by the tag for a data access responsive to the tag in the tagged data traffic. The method continues sending audit data for future data accesses in the tagged data traffic without comparing to the corresponding security rules again.

Claims

1. A computer-implemented method for auditing data traffic, the computer-implemented process comprising:

monitoring data traffic on a network and collecting data access elements thereof;

comparing the collected data access elements to security rules;

sending a first audit data collection to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules, wherein the one of the security rules having the first condition designates the first audit data collection and the first repository; and

sending a second audit data collection to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules, wherein the one of the security rules having the second condition designates the second audit data collection and the second repository.

2. The method of claim 1, comprising:

applying, in response to the matching first condition, a tag to data traffic of the first data access and discontinuing, responsive to applying the tag, the comparing of collected data access elements to the corresponding one of the security rules having the matching first condition, wherein the tag indicates a repository and the data traffic includes at least one of a connection and session; and

sending, in response to the tag in the tagged data traffic, an audit data collection to the repository indicated by the tag for a data access, wherein the computer-implemented process continues sending audit data for future data accesses that are in the tagged data traffic without the comparing to the corresponding one of the security rules again.

3. The method of claim 1, wherein one or more data access elements for the first condition indicate a less suspicious data access than one or more data access elements for the second condition and wherein the first repository has a lower audit priority than the second repository, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a less suspicious data access and is sent to a lower audit priority repository and in the sending of the second audit data collection to the second repository the second audit data collection is for a more suspicious data access and is sent to a higher audit priority repository.

4. The method of claim 1, wherein one or more data access elements for the first condition define a first data identity and one or more data access elements for the second condition define a second data identity, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a data access matching the first data identity and in the sending of the second audit data collection to the second repository the second audit data collection is for a data access matching the second data identity.

5. The method of claim 4, wherein the first data identity and the second data identity each includes an identity of one or more of a table, field, database name, database type, text string, XML pattern or SQL pattern.

6. The method of claim 4, wherein the first data identity is for data having a sensitivity level and the second data identity is for data having a higher data sensitivity level, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a less sensitive data access and in the sending of the second audit data collection to the second repository the second audit data collection is for a more sensitive data access.

7. The method of claim 1, wherein a data access element for the first condition defines an amount of data accessed and a data access element for the second condition defines a larger amount of data accessed, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a smaller data access and in the sending of the second audit data collection to the second repository the second audit data collection is for a larger data access.

8. A system comprising:

at least one computing processor; and

a computer-readable storage media connected to the at least one computing processor, wherein the computer-readable storage media has stored thereon a data-traffic auditing program for controlling the at least one computing processor, and wherein the at least one computing processor is operative with the program to execute the program to;

monitor data traffic on a network and collecting data access elements thereof;

compare the collected data access elements to security rules;

send a first audit data collection to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules, wherein the one of the security rules having the first condition designates the first audit data collection and the first repository; and

send a second audit data collection to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules, wherein the one of the security rules having the second condition designates the second audit data collection and the second repository.

9. The system of claim 8, wherein the at least one computing processor is operative with the program to execute the program to:

apply, in response to the matching first condition, a tag to data traffic of the first data access and discontinuing, responsive to applying the tag, the comparing of collected data access elements to the corresponding one of the security rules having the matching first condition, wherein the tag indicates a repository and the data traffic includes at least one of a connection and session; and

send, in response to the tag in the tagged data traffic, an audit data collection to the repository indicated by the tag for a data access, wherein the computer-implemented process continues sending audit data for future data accesses that are in the tagged data traffic without the comparing to the corresponding one of the security rules again.

10. The system of claim 8, wherein one or more data access elements for the first condition indicate a less suspicious data access than one or more data access elements for the second condition and wherein the first repository has a lower audit priority than the second repository, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a less suspicious data access and is sent to a lower audit priority repository and in the sending of the second audit data collection to the second repository the second audit data collection is for a more suspicious data access and is sent to a higher audit priority repository.

11. The system of claim 8, wherein one or more data access elements for the first condition define a first data identity and one or more data access elements for the second condition define a second data identity, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a data access matching the first data identity and in the sending of the second audit data collection to the second repository the second audit data collection is for a data access matching the second data identity.

12. The system of claim 11, wherein the first data identity and the second data identity each includes an identity of one or more of a table, field, database name, database type, text string, XML pattern or SQL pattern.

13. The system of claim 11, wherein the first data identity is for data having a sensitivity level and the second data identity is for data having a higher data sensitivity level, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a less sensitive data access and in the sending of the second audit data collection to the second repository the second audit data collection is for a more sensitive data access.

14. The system of claim 8, wherein a data access element for the first condition defines an amount of data accessed and a data access element for the second condition defines a larger amount of data accessed, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a smaller data access and in the sending of the second audit data collection to the second repository the second audit data collection is for a larger data access.

15. A computer program product for auditing data traffic, the computer program product comprising:

a computer-readable storage medium; and

computer-readable program code embodied in the computer-readable storage medium, wherein the computer-readable program code is configured to cause at least one computing processor to;

monitor data traffic on a network and collecting data access elements thereof;

compare the collected data access elements to security rules;

send a first audit data collection to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules, wherein the one of the security rules having the first condition designates the first audit data collection and the first repository; and

send a second audit data collection to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules, wherein the one of the security rules having the second condition designates the second audit data collection and the second repository.

16. The computer program product of claim 15, wherein the computer-readable program code is configured to cause at least one computing processor to:

apply, in response to the matching first condition, a tag to data traffic of the first data access and discontinuing, responsive to applying the tag, the comparing of collected data access elements to the corresponding one of the security rules having the matching first condition, wherein the tag indicates a repository and the data traffic includes at least one of a connection and session; and

send, in response to the tag in the tagged data traffic, an audit data collection to the repository indicated by the tag for a data access, wherein the computer-implemented process continues sending audit data for future data accesses that are in the tagged data traffic without the comparing to the corresponding one of the security rules again.

17. The computer program product of claim 15, wherein one or more data access elements for the first condition indicate a less suspicious data access than one or more data access elements for the second condition and wherein the first repository has a lower audit priority than the second repository, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a less suspicious data access and is sent to a lower audit priority repository and in the sending of the second audit data collection to the second repository the second audit data collection is for a more suspicious data access and is sent to a higher audit priority repository.

18. The computer program product of claim 15, wherein one or more data access elements for the first condition define a first data identity and one or more data access elements for the second condition define a second data identity, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a data access matching the first data identity and in the sending of the second audit data collection to the second repository the second audit data collection is for a data access matching the second data identity.

19. The computer program product of claim 18, wherein the first data identity and the second data identity each includes an identity of one or more of a table, field, database name, database type, text string, XML pattern or SQL pattern.

20. The computer program product of claim 18, wherein the first data identity is for data having a sensitivity level and the second data identity is for data having a higher data sensitivity level, wherein in the sending of the first audit data collection to the first repository the first audit data collection is for a less sensitive data access and in the sending of the second audit data collection to the second repository the second audit data collection is for a more sensitive data access.