Network-based alert management system

• US 7,694,115 B1
• Filed: 08/01/2000
• Issued: 04/06/2010
• Est. Priority Date: 11/09/1998
• Status: Expired due to Fees

• Current Assignee: SRI International, Inc.
• Original Assignee: SRI International, Inc.
• Inventors: Porras, Phillip Andrew, Fong, Martin Wayne
• Primary Examiner(s): Du, Thuan N
• Application Number:
  US09/629,510
• Time in Patent Office: 3,535 Days
• Field of Search: 713/200, 713/201, 713/1, 709/224, 709/227, 709/223, 709/229, 714/47, 714/48, 340/426.24, 340/426.25, 340/3.1, 340/506, 340/286.02, 726/22, 726/23
• US Class Current: 713/1
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A system for managing network alerts including data connections adapted to receive alerts from network sensors, alert processing logic coupled to the data connections and further including alert integration logic operable to integrate the alerts, report generation logic coupled to the alert integration logic, distribution logic coupled to the report generation logic and a remote management unit coupled to the alert processing logic and being operable to dynamically modify the alert processing logic.

Claims

1. A system for managing network alerts comprising:

data connections configured to receive network alerts from network sensors;

alert processing logic coupled to the data connections and further comprising;

alert integration logic configured to integrate the network alerts, the alert integration logic comprising a consolidation component that is configured to identify multiple received alerts as indicative of a common incident and consolidate the multiple received alerts into a consolidated incident report that is indicative of the incident;

report generation logic coupled to the alert integration logic;

distribution logic coupled to the report generation logic; and

a remote management unit coupled to the alert processing logic and being configured to dynamically modify the alert processing logic.

2. The system of claim 1 wherein the data connections are secure electronic communication lines.

3. The system of claim 1 wherein the data connections are dynamically configurable through the remote management unit.

4. The system of claim 1 wherein the network sensors include heterogeneous sensors, and further comprising an alert formatting component that is configured to convert an alert to a common format, the common format being used by the alert processing logic.

5. The system of claim 1 wherein the alert integration logic comprises an alert formatting component configured to convert alerts to a common format used by the alert processing logic, wherein the alert formatting component is configurable through the remote management unit to update an operational characteristic of the alert formatting component.

6. The system of claim 1 wherein the alert integration logic comprises a filtering component that is configurable through the remote management unit.

7. The system of claim 1 wherein the alert integration logic comprises a prioritizing component that is configured to assign an indication of importance to an alert based on a characteristic of the alert, the remote management unit being configured to alter the prioritizing component such that a different indication of importance will be assigned to the alert based on the characteristic.

8. The system of claim 1 wherein the alert integration logic comprises a relevancy component that is configured to assign an indication of a relevance of an alert to a sensor generating the alert, the relevancy component being configurable through the remote management unit to update the relevancy component according to a characteristic of the sensor.

9. The system of claim 1 wherein the alert consolidation component is configured to consolidate multiple alerts produced from a single network sensor.

10. The system of claim 1 wherein the alert consolidation component is configured to consolidate alerts received from multiple network sensors.

11. The system of claim 1 wherein the report generation logic is configured to generate formatted reports for each of one or more subscribers, and wherein the distribution logic comprises:

subscriber logic configured to establish a communication link to each of the subscribers; and

communication logic configured to send the corresponding formatted report to each of the subscribers.

12. The system of claim 1 wherein the distribution logic is adjustable through the remote management unit.

13. The system of claim 12 wherein the distribution logic is dynamically modifiable so as to add subscribers and remove subscribers.

14. The system of claim 1 wherein the remote management unit comprises an interactive control user interface hosted at a remote processing center, and a configuration engine hosted locally with the alert processing logic.

15. The system of claim 1 being hierarchical, wherein the data connections are further configured to receive the output from one or more alert management systems, and wherein the alert integration logic is further configured to integrate the output.

16. An apparatus for managing network alerts comprising:

alert integration logic configured to integrate network alerts received from network sensors, the alert integration logic comprising a consolidation component that is configured to identify multiple received alerts as indicative of a common incident and consolidate the multiple received alerts into a consolidated incident report that is indicative of the incident;

output generation logic coupled to the alert integration logic and configured to generate output reflecting the integrated network alerts; and

a dynamic configuration engine configured to receive and to execute remote requests for modification of the alert integration logic.

17. The apparatus of claim 16 wherein the alert integration logic comprises one or more alert analysis components selected from the following group:

an alert filtering component configured to identify alerts matching predetermined criteria, an alert prioritizing component configured to assign an indication of importance to an alert, and an alert relevancy component configured to assign an indication of a relevance of an alert to a sensor generating the alert.

18. The apparatus of claim 16 wherein the remote requests are received by the configuration engine from a remote management unit.

19. The apparatus of claim 16 wherein the configuration engine comprises a run-time command interpreter.

20. The apparatus of claim 16 wherein the network sensors include heterogeneous sensors.

21. An apparatus for managing network alerts comprising:

alert integration logic configured to integrate network alerts received from network sensors, the alert integration logic comprising a consolidation component that is configured to identify multiple received alerts as indicative of a common incident and consolidate the multiple received alerts into a consolidated incident report that is indicative of the incident;

output generation logic coupled to the alert integration logic and configured to generate output reflecting the integrated network alerts; and

a dynamic configuration engine configured to receive and to execute remote requests for modification of the output generation logic.

22. The apparatus of claim 21 wherein the output generation logic is further configured to distribute the output to one or more remote subscribers.

23. The apparatus of claim 21 wherein the remote requests are received by the configuration engine from a remote management unit having an interactive user interface.

24. The apparatus of claim 21 wherein the configuration engine comprises a run-time command interpreter.

25. The apparatus of claim 21 wherein the network sensors include heterogeneous sensors, and further comprising an alert formatting component that is configured to convert an alert to a common format, the common format being used by the alert integration logic.