Modular system for detecting, filtering and providing notice about attack events associated with network security

• US 7,152,242 B2
• Filed: 09/11/2002
• Issued: 12/19/2006
• Est. Priority Date: 09/11/2002
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Enterasys Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Douglas, Kevin
• Primary Examiner(s): Barron, Gilberto
• Assistant Examiner(s): Nobahar, Abdulhakim
• Application Number:
  US10/241,145
• Publication Number:
  US 20040049693A1
• Time in Patent Office: 1,560 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A host-based intrusion detection system (HIDS) sensor that monitors system logs for evidence of malicious or suspicious application activity running in real time and monitors key system files for evidence of tampering. This system detects attacks targeted at the host system on which it is installed and monitors output to the system and audit logs. It is signature-based and identifies and analyzes system and audit messages for signs of system misuse or attack. The system monitors the logs of applications running on the host, including mail servers, web servers and FTP servers. The system also monitors system files and notifies the system administrator when key system and security files have been accessed, modified or even deleted.

Claims

1. A computer-readable medium having computer-executable instructions for performing intrusion detection of a computer network having at least one host computer coupled thereto, said computer-readable medium being loadable on the at least one host computer, said computer-readable medium comprising:

an array of event processing means wherein each one of said event processing means runs concurrently without impeding each other'"'"'s performance, said array of event processing means monitoring resources on the at least one host computer or monitoring activity forwarded to the at least one host computer via the computer network and generating event data corresponding to said monitoring;

an event filter engine for filtering all event data from said array of event processing means, said event filter engine either altering the contents of the event data to form filtered event data or discarding the event data, said event filter engine altering the contents of the event data by altering an event data name based on a source network address related to said event data, said event filter engine comprising a plurality of configured modules and wherein said event filter engine passes all event data through said configured modules serially; and

an event alerting engine for generating alerts based on said filtered event data or forwarding said filtered event data to a destination, and wherein said event alerting engine comprises a second plurality of configured modules and wherein each of said second plurality of configured modules receives all of said filtered event data.

2. The computer-readable medium of claim 1 wherein each of said second plurality of configured modules comprises a dynamically-linked module.

3. The computer-readable medium of claim 1 wherein any one of said second plurality of configured modules comprises simple scripts.

4. The computer-readable medium of claim 1 wherein one of said second plurality of configured modules is a ring buffer alert module for providing an event flow processor with said filtered data to report said filtered event data.

5. The computer-readable medium of claim 1 wherein one of said second plurality of configured modules is a replication agent alerting module for providing an event flow processor with said filtered data to report said filtered event data.

6. The computer-readable medium of claim 1 wherein one of said second plurality of configured modules is a database alerting module for recording said filtered event data in an intrusion system database.

7. The computer-readable medium of claim 1 wherein one of said second plurality of configured modules is an export log alerting module for generating a local export log of said filtered event data.

8. The computer-readable medium of claim 1 wherein one of said second plurality of configured modules is an SNMP trap alerting module for generating alerts based on events that are detected.

9. The computer-readable medium of claim 1 wherein one of said second plurality of configured modules is a hex dump alerting module for displaying events on a monitor as the events occur.

10. A method for efficiently managing and reporting intrusion, or attempted intrusion, events of a computer network, said method comprising the steps of:

(a) providing an array of event processing means on a host computer, coupled to the computer network, that operate concurrently without impeding each other'"'"'s performance, each of said event processing means detecting a corresponding event related to intrusion, or intrusion attempts, to form event data;

(b) passing said event data to a plurality of configured modules on the host computer, in serial fashion, that alter the contents of said event data that is to be reported to form filtered event data or that discard said event data not considered of value to report; and

(c) passing all of said filtered event data to a second plurality of configured modules for providing notification of the intrusion or intrusion attempts.

11. The method of claim 10 wherein said step of providing an array of event processing means comprises monitoring an MD5 checksum of files.

12. The method of claim 10 wherein said step of providing an array of event processing means comprises monitoring file attributes.

13. The method of claim 10 wherein said step of providing an array of event processing means comprises monitoring signature patterns in the content of file logs.

14. The method of claim 10 wherein said step of providing an array of event processing means comprises monitoring SNMP traps using signatures.

15. The method of claim 10 wherein the host computer comprises an operating system and wherein said step of providing an array of event processing means comprises monitoring TCP/IP service requests that interact with the operating system.

16. The method of claim 10 wherein the host computer comprises an operating system and wherein said step of providing an array of event processing means comprises monitoring the kernel of the operating system.

17. The method of claim 10 wherein the host computer comprises an operating system and wherein said step of providing an array of event processing means comprises monitoring the event log using signatures.

18. The method of claim 10 wherein the host computer comprises an operating system and wherein said step of providing an array of event processing means comprises monitoring the event registry.

19. The method of claim 10 wherein said step of altering the contents of said event data that is to be reported to form filtered event data comprises altering the name of event data based on a source network address related to said event data.

20. The method of claim 10 wherein said step of passing all of said filtered event data to a second plurality of configured modules comprises providing notification providing an event flow processor with said filtered data to report said filtered event data.

21. The method of claim 10 wherein said step of passing all of said filtered event data to a second plurality of configured modules comprises recording said filtered event data in an intrusion system database.

22. The method of claim 10 wherein said step of passing all of said filtered event data to a second plurality of configured modules comprises generating a local export log of said filtered event data.

23. The method of claim 10 wherein said step of passing all of said filtered event data to a second plurality of configured modules comprises generating alerts based on events that are detected.

24. The method of claim 10 wherein said step of passing all of said filtered event data to a second plurality of configured modules comprises displaying events on a monitor as the events occur.