Integrated intrusion detection system and method

• US 7,712,133 B2
• Filed: 06/20/2003
• Issued: 05/04/2010
• Est. Priority Date: 06/20/2003
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Mendonca, John, Stephenson, Bryan, Raikar, Amit
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US10/600,113
• Publication Number:
  US 20040260945A1
• Time in Patent Office: 2,510 Days
• Field of Search: 726/23, 726/1, 726/11
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

A present invention integrated intrusion detection method integrates intrusion detection information. In one embodiment, intrusion detection information is gathered from a plurality of different types of intrusion detection sensors. The information is processed in a manner that provides a consolidated correlation of the information. A response is assigned to the information and the response is implemented.

Claims

1. An integrated intrusion detection method comprising:

gathering information from a plurality of different types of intrusion detection sensors;

processing said information, wherein said processing provides a consolidated correlation of said information;

assigning a severity to said information based on an enterprise wide security policy;

assigning a response corresponding to said information and corresponding to said severity; and

implementing said response according to said severity.

2. An integrated intrusion detection method of claim 1 wherein said information includes intrusion detection alerts.

3. An integrated intrusion detection method of claim 2 further comprising centrally tracking information associated with intrusion detection alerts from said plurality of different types of intrusion detection sensors.

4. An integrated intrusion detection method of claim 3 wherein said tracking information associated with intrusion detection includes assigning severity assignments standardized across said plurality of different types of intrusion detection sensors.

5. An integrated intrusion detection method of claim 2 wherein said intrusion detection alerts are correlated based upon various alert attributes.

6. An integrated intrusion detection method of claim 2 wherein said response conforms to an enterprise wide strategy.

7. An integrated intrusion detection method of claim 1 further comprising managing said intrusion detection sensors.

8. A computer usable storage medium having computer readable program code embodied therein for causing a computer system to implement intrusion detection instructions comprising:

a data collection module for receiving information from a plurality of different types of intrusion detection sensors, wherein said information indicates potential security issues;

an information severity determination module for assigning a severity to said information based on an enterprise wide security policy;

an integration module for integrating said information in a network application management platform;

a reaction determination module for determining appropriate response to indication of said potential security issues according to said severity; and

a reaction direction module for directing said response according to said severity.

9. A computer usable storage medium of claim 8 wherein said information includes intrusion detection system alert data.

10. A computer usable storage medium of claim 8 wherein said integration module selects a hook in an intrusion detection system.

11. A computer usable storage medium of claim 8 wherein said data collection module logs alerts from said plurality of different types of intrusion detection sensors.

12. A computer usable storage medium of claim 8 wherein said alerts are provided by a simple network management protocol (SNMP), a system log and an application program interface.

13. A computer usable storage medium of claim 8 wherein said integration module includes analyzing a plurality of manners in which an alert can be provided and selecting the manner that is the most secure with the least dependencies in a communication path.

14. A computer usable storage medium of claim 8 wherein said integration module utilizes a network application management platform to log information.

15. A computer usable storage medium of claim 14 wherein:

an open view operation simple network management protocol trap is utilized to handle simple network management protocol trap based alerts;

an open view operation log file encapsulator handles system log based alerts; and

an open view message interceptor handles application program interface propagated alerts with the help of an operation message mechanism.

16. A computer usable medium of claim 14 wherein a secure open view template configuration is utilized to log information and the one message group is configured for handling intrusion detection system alerts and another message group is configured for handling intrusion detection system errors.