Network security data management system and method

• US 7,499,937 B2
• Filed: 03/19/2004
• Issued: 03/03/2009
• Est. Priority Date: 11/22/1999
• Status: Expired due to Term

• Current Assignee: Diversified High Technologies Incorporated, Kathy J. Maida-Smith
• Original Assignee: Metasecure Corporation
• Inventors: Engle, Steven W., Maida-Smith, Kathy
• Primary Examiner(s): MIZRAHI, DIANE D
• Application Number:
  US10/804,775
• Publication Number:
  US 20040205356A1
• Time in Patent Office: 1,810 Days
• Field of Search: 707 1- 10, 707100-1041, 707200-206, 715/175, 726/4, 726/1, 726/26, 726/28, 709/223, 709/224, 709/204, 709/205, 714/38, 370/255, 717/103, 717/120, 717/127, 717/159, 717/178, 712/37, 711/101, 718/1, 706/47
• US Class Current: 1/1
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system for compiling security data from an information network includes at least two network components, each providing data. A data partner is coupled to the network components. The data parser has access to two parser scripts that correspond to the network'"'"'s component data. Categorized data can be produced by applying the parser scripts to the data received from the network components.

Claims

1. A method for compiling parser scripts each corresponding to the structure of security data received from a network component comprising the steps of:

a) when executed by a computer, identifying sets of data categories, each set corresponding to security data received from one of a plurality of network components;

b) when executed by a computer, constructing database record definitions, each defining a record subdivided in accordance with one of the sets of data categories;

c) writing parser scripts that receive security data from the network components and output records, each record corresponding to one of the record definitions;

d) storing said parser scripts;

e) determining the format of each category in said sets; and

f) formatting the subdivisions to match the formats of the categories of the set to which the definition corresponds; and

wherein each of the output records of step (c) correspond in format to one of the record definitions.

2. The method of claim 1 further comprising the steps of:

g) building database tables in a relational database each having the fields of one of the database record definitions; and

h) inserting output records received from the parser scripts into the tables.

3. The method of claim 1 further comprising the steps of:

i) building database tables in a relational database each having the fields and formats of one of the database record definitions; and

j) inserting output records received from the data interface operating per defined data constructs into the tables.

4. The method of claim 1 wherein:

at least one of the sets of data categories is identified, at least in part, from the product specifications of the network components.

5. The method of claim 1 wherein:

at least one of the sets of data categories is identified, at least in part, by applying a Management Information Base (MIB) integrator to a Management Information Base for the corresponding network component.

6. An information network security data compilation system, comprising:

a) a first network component;

b) a second network component;

c) a third network component; and

d) when executed by a computer, a data parser that is coupled to the first and second network components has access to a first parser script and a second parser script, the data parser is operable to produce categorized data from the data received from the first and second network components data interface operating with the first and second parser scripts, respectively;

b) when executed by a computer, a second data parser that is coupled to the third component has access to a third parser script, the second data parser operable to produce categorized data from the data received from the third network component with the third parser script; and

c) a relational database coupled to the first and second data parsers.

7. The data compilation system of claim 6 wherein:

a) the first network component is a firewall and

b) the second network component is an intrusion detection system.

8. The data compilation system of claim 6 further comprising:

a) a third network component and

b) a distributed data manager; and

wherein;

the data parser is coupled to the second and third network components through the distributed data manager which collects and compresses data from the second and third network components and forwards the compressed data to the data parser.

9. The data compilation system of claim 6 further comprising:

a) a display coupled to the data parser; and

b) a relational database coupled between the data parser and the display, and wherein;

the data parser transfers the categorized data to the relational database.

10. The data compilation system of claim 9 wherein:

the relational database receives a data query, and the display shows a portion of the categorized data, up to and including all the data, from the relational database, corresponding to the data query.

11. The data compilation system of claim 10 wherein:

the data queries are submitted and the portions are shown through a web browser interface.

12. The data compilation system of claim 6 further comprising:

a) an event detector coupled to the data parser and wherein;

the event detector compares the categorized data to a predetermined event definition and provides an event indication when a match is found.

13. The data compilation system of claim 6 further comprising:

a) an information technology agent and wherein;

the network component is programmed by software, the agent collects security data from the software, and the data provided from the first network component is the security data collected by the agent.

14. The data compilation system of claim 6 wherein:

the data parser produces formatted and categorized data.

15. The data compilation system of claim 6 wherein:

data from the first network component is security data and data from the second network component is security data.

16. The data compilation system of claim 6 wherein:

data from the first network component is encrypted and decrypted.