Security intrusion mitigation system and method

• US 7,519,996 B2
• Filed: 08/25/2003
• Issued: 04/14/2009
• Est. Priority Date: 08/25/2003
• Status: Active Grant

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Cain, Stuart
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Wyszynski; Aubrey H
• Application Number:
  US10/648,555
• Publication Number:
  US 20050050351A1
• Time in Patent Office: 2,059 Days
• Field of Search: 726/23
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A security intrusion mitigation system and method are presented. In one embodiment a security intrusion mitigation method includes utilizing network spanning tree configuration information to determine an action for mitigating diffusion of intrusive attacks. The spanning tree information can include an indication of an internal diffusion risks. An action for mitigating diffusion of intrusive attacks is automatically performed. The action for mitigating diffusion of the intrusive attacks includes compensation for functional support of prioritized applications.

Claims

1. A security intrusion mitigation method comprising:

utilizing network spanning tree configuration information to determine an action for mitigating diffusion of intrusive attacks between components associated with a network, wherein said spanning tree information includes an indication of a first internal diffusion risk and a second internal diffusion risk, wherein said first internal diffusion risk is a risk of a first attack diffusing from a first component associated with said network to a second component associated with said network and said second internal diffusion risk is a risk of a second attack diffusing from a third component associated with said network to said second component;

using said internal diffusion risks to determine that there is a higher risk of said first attack diffusing from said first component to said second component than said second attack diffusing from said third component to said second component; and

using said network spanning tree configuration information to perform said action for mitigating diffusion of intrusive attacks automatically at least in part by mitigating said first attack before mitigating said second attack, wherein said action for mitigating includes compensation for functional support of an application associated with said second component that has priority over another application.

2. A security intrusion mitigation method of claim 1 further comprising utilizing said internal diffusion risks to determine components forming a path in said spanning tree configuration with a highest cumulative diffusion impact risk.

3. A security intrusion mitigation method of claim 1 wherein said internal diffusion risk includes an asset value factor.

4. A security intrusion mitigation method of claim 3 wherein said asset value corresponds to an economic impact of a disruption to functionality provided by a particular component.

5. A security intrusion mitigation method of claim 1 wherein said internal diffusion risk includes an exposure rating factor.

6. A security intrusion mitigation method of claim 5 wherein said exposure rating defines a threshold value corresponding to connectivity of particular component with other components.

7. A security intrusion mitigation method of claim 5 wherein said particular component is assigned an exposure rating value based upon a connectivity distance from a root node.

8. A security intrusion mitigation method of claim 5 wherein said action is implemented in accordance with a highest risk algorithm.

9. A security intrusion mitigation method of claim 5 wherein said network spanning tree configuration information includes information associated with components included in a utility data center and said action is implemented in said utility data center.

10. A security intrusion mitigation system comprising:

a means for communicating information;

a means for processing information including instructions for determining a highest risk path that has the highest risk of an attack spreading between network components included in said highest risk path in comparison to risks of attacks spreading between network components associated with other risk paths and automatically mitigating said attack from spreading between said network components included in said highest risk path; and

a means for storing said information, including instructions for storing information describing said highest risk path.

11. A security intrusion mitigation system of claim 10 wherein said instructions include security management instructions implemented on a network application management platform.

12. A security intrusion mitigation system of claim 10 further comprising a means for interfacing with a network application management platform.

13. A security intrusion mitigation system of claim 10 wherein said instructions include attack spread risk determination instructions.

14. A security intrusion mitigation system of claim 10 further comprising a means for centrally controlling a utility data center operations.

15. A computer usable storage medium having computer readable program code embodied therein for causing a computer system to implement security intrusion mitigation instructions comprising:

a component risk determination module for determining that a first risk of a first attack spreading from a first component to a second component is higher than a second risk of a second attack spreading from a third component to a fourth component, wherein said first, second, third and fourth components are included in a network; and

an attack spreading response module for responding to said first risk before responding to said second risk.

16. A computer usable storage medium of claim 15 wherein said first risk is biased based upon an economic value of functions said second component performs.

17. A computer usable storage medium of claim 15 said first risk is biased based upon connectivity of said second component to said first component in said network.

18. A computer usable storage medium of claim 17 wherein said responding includes reducing traffic communication to said second component.

19. A computer usable storage medium of claim 15 wherein said responding includes turning off an interface of said second component to said network.

20. A computer readable medium of claim 19 wherein said responding is performed in accordance with a highest risk analysis.