Integrated monitoring system

• US 7,296,070 B2
• Filed: 12/22/2000
• Issued: 11/13/2007
• Est. Priority Date: 12/22/2000
• Status: Expired due to Term

• Current Assignee: Tier-3 Pty Limited
• Original Assignee: Tier-3 Pty Limited
• Inventors: Sim, Timothy Kek Ming, Cullen, Michael Anthony, Sweeney, Geoffrey George
• Primary Examiner(s): Donaghue; Larry D.
• Application Number:
  US09/746,604
• Publication Number:
  US 20020083168A1
• Time in Patent Office: 2,517 Days
• Field of Search: 709/201, 709/202, 709/224, 709/225, 709/226, 713/166, 713/177, 726/3, 707/7
• US Class Current: 709/224
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method for monitoring events generated on at least one computer system, said method comprising the steps of:

• • (a) monitoring a set of event data generated on said at least one system;
  • (b) recording said set of event data in a database;
  • (c) interrogating said database to thereby select alert event data from said set of event data according to a predefined set of rules; and
  • (d) reading said alert event data and issuing an appropriate action due to said generated event, said action issued according to said predefined set of rules.

Claims

1. A method for monitoring events generated on at least one computer system, said method comprising the steps of:

(a) monitoring a set of event data generated on said at least one system;

(b) recording said set of event data in a database;

(c) interrogating said database to thereby select alert event data from said set of event data according to a predefined set of rules;

(d) reading said alert event data; and

(e) issuing an appropriate action due to said generated event, said action issued according to said predefined set of rules and including;

(i) raising an alert if a weighting assigned to said event exceeds a predetermined threshold; and

(ii) applying a heuristic, if said weighting is below said predetermined threshold, to determine if said event is statistically significant in a historical context of previously generated events to determine said action response.

2. A method as claimed in claim 1, wherein said action response occurs in real-time as a user interacts with said computer system.

3. A method as claimed in claim 2, wherein said method further comprises the step of:

(f) issuing said action response to said at least one computer system to prevent further interaction of said user with said computer system.

4. A method as claimed in claim 1, wherein said set of event data is monitored from the interaction of one or more users interaction with one or more computers on a network.

5. A method as claimed in claim 4, wherein said monitored set of event data is monitored from a number of sources on said computer network, including any one or more of the following network components:

the application program layer;

the transport layer;

security layer;

operating system.

6. A method as claimed in claim 5, wherein said application program layer includes any one or more the following:

customer relationship management, enterprise resource planning;

customer billing.

7. A method as claimed in claim 5, wherein said operating system includes any one or more but not limited to the following:

database application server;

LAN;

router;

PABX;

telephone network;

network server.

8. A method as claimed in claim 5, wherein said security layer includes any one or more but not limited to the following:

firewalls;

card-swipe facility access;

close-circuit security television.

9. A method as claimed in claim 1, wherein said method further includes the step of:

(g) permitting an authorised user to interactively define said set of rules in step (c).

10. A method as claimed in claim 9, wherein said authorised user can interactively define and/or amend said set of rules in step (c) using a user graphical interface.

11. A method as claimed in claim 10, wherein said graphical interface is a web browser.

12. A method as claimed in claim 1, wherein one or more agent programs are provided on at least one computer of said computer system to thereby monitor said set of event data.

13. A method as claimed in claim 1, wherein said event data is recorded in a relational database.

14. A method as claimed in claim 13, wherein said event data is assigned a unique log identifier in said database to identify the record of each event.

15. A method as claimed in claim 14, wherein said unique log identifier is used to correlated as a single event, a multiplicity of events generated on one or more computer systems.

16. A method as claimed in claim 1, wherein a report is generated to report said recorded said set of event data.

17. A method as claimed claim 1, wherein said appropriate action is a message sent to a network administrator.

18. A method as claimed in claim 17, wherein said appropriate action is a message sent to an authorised person.

19. A method as claimed in claim 18, wherein said message is any one or more of the following message types:

electronic mail;

SMS text massaging;

audio signal;

telephone call;

pagers;

WAP appliances.

20. A computer memory storing thereon an application program for controlling the execution of a processor to monitor events generated on at least one computer system, the computer program controlling the processor to:

monitor a set of event data generated on at least one computer system;

record said set of event data in a database;

interrogate said database to thereby select alert event data from said set of event data according to a predefined set of rules;

read said alert event data and issue an appropriate action due to said generated event on said computer system, said action issued according to said predefined set of rules;

raise an alert if a weighting assigned to said event exceeds a predetermined threshold; and

apply a heuristic, if said weighting is below said predetermined threshold, to determine if said event is statistically significant in a historical context of previously generated event to determine said action response.

21. A computer memory as claimed in claim 20, wherein said action response occurs in real-time.

22. A computer memory as claimed in claim 20, wherein the computer program further controls the processor to issue said action response to said at least one computer system to prevent further interaction a user of said computer.

23. A computer memory as claimed in claim 20, wherein said set of event data is monitored from events generated by one or more computers on a network.

24. A computer memory as claimed in claim 23, wherein said monitored set of event data is monitored from a number of sources on said computer network, including any one or more of the following network components:

the application program layer;

the transport layer;

security layer;

operating system.

25. A computer memory as claimed in claim 24, wherein said application program layer includes any one or more of the following customer relationship management, enterprise resource planning;

customer billing.

26. A computer memory as claimed in claim 24, wherein said operating system includes any one or more of the following:

database application server;

LAN;

router;

PABX;

telephone network;

network server.

27. A computer memory as claimed in claim 24, wherein said security layer includes any one or more of the following firewalls;

card-swipe facility access;

close-circuit security television.

28. A computer memory as claimed in claim 20, wherein said computer program further controls the processor to permit an authorised user to interactively define said set of rules.

29. A computer memory as claimed in claim 28, wherein said authorised user can define and/or amend said set of rules in step using a user graphical interface.

30. A computer memory as claimed in claim 29, wherein said graphical interface is a web browser.

31. A computer memory as claimed in claim 20, wherein one or more agent programs are provided on each computer system to monitor said set of event data.

32. A computer memory as claimed in claim 20, wherein said event data is recorded in a relational database.

33. A computer memory as claimed in claim 32, wherein said event data is assigned a unique log identifier in said database to identify the record of each event.

34. A computer memory as claimed in claim 33, wherein said unique log identifier is used to correlated as a single event, a multiplicity of events generated on one or more computer systems.

35. A computer memory as claimed in claim 20, wherein a report is generated to report said recorded set of event data.

36. A computer memory as claimed claim 20, wherein said appropriate action is a message sent to a network administrator.

37. A computer memory as claimed in claim 36, wherein said appropriate action is a message sent to an authorised person.

38. A computer memory as claimed in claim 37, wherein said message is any one or more of the following message types:

electronic mail;

SMS text massaging;

audio signal;

telephone call;

pagers;

WAP appliances.

39. A monitoring system for monitoring events generated on at least one computer system, said monitoring system comprising:

one or more agent programs for monitoring a set of event data generated on said at least one computer system;

a database for recording said set of event data in a database, said database adapted to be interrogated to thereby select alert event data from said set of event data according to a predefined set of rules; and

action generation means for reading said alert event data and issuing an appropriate action to said generated event on said computer system, said action being issued according to said predefined set of rules and wherein the action is determined based upon said pre-defined set of rules and if a weighting assigned to said event exceeds a predetermined threshold. raising an alert and, if said weighting is below said predetermined threshold applying a heuristic, to determine if said event is statistically significant in a historical context of previously generated event to determine said action response.

40. A monitoring system as claimed in claim 39, wherein said action generation means issues said action response to said at least one computer system to prevent interaction of a user with said computer.

41. A monitoring system as claimed in claim 39, wherein an authorised user is able to define said set of rules.

42. A method for monitoring events generated on at least one computer system, said method comprising the steps of:

(a) monitoring a set of event data generated on said at least one system;

(b) recording said set of event data in a database;

(c) interrogating said database to thereby select alert event data from said set of event data according to a predefined set of rules;

(d) reading said alert event data and issuing an appropriate action due to said generated event, said action issued according to said predefined set of rules; and

(e) determining an action response based upon;

(i) said predefined set of rules associated with said event; and

(ii) a comparison of said event with other monitored events recorded in said database to determine if the event is a historically statistically significant event relative to the other events recorded in said database.