Method of operating an intrusion detection system according to a set of business rules

• US 7,036,148 B2
• Filed: 05/08/2001
• Issued: 04/25/2006
• Est. Priority Date: 05/08/2001
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Brook, Ashley Anderson, Kim, Nathaniel Wook, Lingafelt, Charles Steven
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US09/851,286
• Publication Number:
  US 20020169982A1
• Time in Patent Office: 1,813 Days
• Field of Search: 713/201, 713/182
• US Class Current: 726/25
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

An intrusion detection system checks a list of business rules at predetermined update times, and determines whether any provision of the business rules has become newly operative since the last update time. Provisions of the business rules prescribe alterations to intrusion signatures, thresholds, actions, or weights that are appropriate to broader circumstances evident at the update time. Whenever a new provision is found to be operative, the effected signatures, thresholds, actions, or weights are altered accordingly.

Claims

1. A method of operating an intrusion detection system for detecting an intrusion of a protected network attachment according to at least one business rule, said method comprising the steps of:

awaiting an occurrence of a next update time of the intrusion detection system, said next update time being a time at which at least one validity condition of the at least one business rule is checked;

responsive to the occurrence of the next update time, checking the at least one validity condition of the at least one business rule to determine whether a provision of any business rule of the at least one business rule is a newly operative provision that has first become operative or gone into effect since an occurrence of a last previous update time at which the at least one validity condition of the at least one business rule was checked, said newly operative provision prescribing an alteration of an intrusion set that the provision applies to;

if the checked provision is the newly operative provision that applies to the intrusion set, then altering the intrusion set according to the newly operative provision.

2. The method of claim 1, wherein the validity condition is a temporal validity condition.

3. The method of claim 1, wherein the validity condition is a network validity condition.

4. The method of claim 1, wherein the validity condition includes a multiple temporal specification, a multiple network-descriptive specification, or a multiple temporal specification and a multiple network-descriptive specification.

13. The method of claim 1, wherein the at least one business rule consists of exactly one business rule.

14. The method of claim 1, wherein the at least one business rule consists of a plurality of business rules.

15. The method of claim 1, wherein the protected network attachment comprises a computer, a server, a workstation, or a combination thereof.

16. The method of claim 1, wherein the next update time is a scheduled time.

17. The method of claim 1, wherein the next update time is one update time of a plurality of update times that occur substantially periodically.

18. The method of claim 1, wherein the next update time is a computed update time.

19. The method of claim 1, wherein the step of altering the intrusion set includes the step of altering a signature of the intrusion set.

20. The method of claim 1, wherein the step of altering the intrusion set includes the step of altering a threshold of the intrusion set.

21. The method of claim 1, wherein the step of altering the intrusion set includes the step of altering an action of the intrusion set.

22. The method of claim 1, wherein the step of altering the intrusion set includes the step of altering a weight of the intrusion set.

5. A method of operating an intrusion detection system according to a set of business rules, comprising the steps of:

awaiting an update time of the intrusion detection system;

responsive to occurrence of an update time, checking validity conditions of the set of business rules to determine whether a provision of any of the set of business rules is a newly operative provision;

for each newly operative provision, checking an intrusion set to determine whether the newly operative provision applies to the intrusion set; and

if the new provision applies to the intrusion set, altering the intrusion set according to the newly operative provision.

6. The method of claim 5, wherein the step of altering the intrusion set includes the step of altering a signature of the intrusion set.

7. The method of claim 5, wherein the step of altering the intrusion set includes the step of altering a threshold of the intrusion set.

8. The method of claim 5, wherein the step of altering the intrusion set includes the step of altering an action of the intrusion set.

9. The method of claim 5, wherein the step of altering the intrusion set includes the step of altering a weight of the intrusion set.

10. The method of claim 5, wherein the update time is a scheduled time.

11. The method of claim 5, wherein the update time is one of a plurality of update times that occur substantially periodically.

12. The method of claim 5, wherein the update time is a computed update time.