Method of managing utilization of network intrusion detection systems in a dynamic data center

• US 8,296,847 B2
• Filed: 07/25/2003
• Issued: 10/23/2012
• Est. Priority Date: 07/25/2003
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Mendonca, John, Raikar, Amit
• Primary Examiner(s): Parthasarathy, Pramila
• Application Number:
  US10/627,017
• Publication Number:
  US 20050022022A1
• Time in Patent Office: 3,378 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of managing utilization of network intrusion detection systems in a dynamic data center is provided. A plurality of network intrusion detection systems are provided, each being networked so that utilization of each network intrusion detection system can be based on demand for the network intrusion detection systems in the dynamic data center. A monitoring policy and a plurality of monitoring points to be monitored on a network with any of the network intrusion detection systems are received. Further, the monitoring of the monitoring points is automatically arranged using the network intrusion detection systems and the monitoring policy.

Claims

1. A method of managing utilization of network intrusion detection systems in a dynamic data center, said method comprising:

automatically providing a plurality of network intrusion detection systems, each being networked so that utilization of each network intrusion detection system can be based on demand for said network intrusion detection systems in said dynamic data center wherein said dynamic data center automatically provides said plurality of network intrusion detection systems by automatically provisioning said plurality of network intrusion detection systems from a pool of available network intrusion detection systems enabling automatic modification of a number of provided network intrusion detection systems based on the demand, wherein the automatic modification of the number is selected from increasing the number of provided network intrusion detection systems and decreasing the number of provided network intrusion detection systems;

automatically configuring said provided network intrusion detection systems, at least in part by,

receiving a monitoring policy and a plurality of monitoring points to be monitored on a network with any of said network intrusion detection systems; and

automatically arranging the monitoring of said monitoring points using said network intrusion detection systems and said monitoring policy.

2. The method as recited in claim 1 wherein said automatically arranging the monitoring of said monitoring points includes:

automatically configuring a plurality of network resources to provide network communication data from said monitoring points to a plurality of available network intrusion detection systems from said network intrusion detection systems; and

automatically configuring said available network intrusion detection systems to receive said network communication data based on said monitoring policy.

3. The method as recited in claim 2 wherein said automatically arranging the monitoring of said monitoring points further includes:

automatically increasing the number of network intrusion detection systems receiving said network communication data from a particular monitoring point by selecting additional available network intrusion detection systems if said network communication data exceeds a capacity of said particular network intrusion detection systems.

4. The method as recited in claim 2 wherein said automatically arranging the monitoring of said monitoring points further includes:

automatically decreasing the number of network intrusion detection systems receiving said network communication data from a particular monitoring point by releasing any of said particular network intrusion detection systems to said available network intrusion detection systems if said network communication data is below a predetermined threshold of a capacity of said particular network intrusion detection systems.

5. The method as recited in claim 2 wherein said network resources include one of a firewall, a gateway system, a network switch, and a network router.

6. The method as recited in claim 1 wherein said receiving a monitoring policy and a plurality of monitoring points to be monitored includes:

providing a graphical user interface to receive said monitoring policy and said plurality of monitoring points to be monitored.

7. The method as recited in claim 1 wherein said dynamic data center is a utility data center.

8. A non-transitory computer-readable medium comprising computer-executable instructions stored therein for performing a method of managing utilization of network intrusion detection systems in a dynamic data center, said method comprising:

automatically providing a plurality of network intrusion detection systems, each being networked so that utilization of each network intrusion detection system can be based on demand for said network intrusion detection systems in said dynamic data center wherein said dynamic data center automatically provides said plurality of network intrusion detection systems by automatically provisioning said plurality of network intrusion detection systems from a pool of available network intrusion detection systems enabling automatic modification of a number of provided network intrusion detection systems based on the demand, wherein the automatic modification of the number is selected from increasing the number of provided network intrusion detection systems and decreasing the number of provided network intrusion detection systems;

automatically configuring said provided network intrusion detection systems, at least in part by,

receiving a monitoring policy and a plurality of monitoring points to be monitored on a network with any of said network intrusion detection systems; and

automatically arranging the monitoring of said monitoring points using said network intrusion detection systems and said monitoring policy.

9. The non-transitory computer-readable medium as recited in claim 8 wherein said automatically arranging the monitoring of said monitoring points includes:

automatically configuring a plurality of network resources to provide network communication data from said monitoring points to a plurality of available network intrusion detection systems from said network intrusion detection systems; and

automatically configuring said available network intrusion detection systems to receive said network communication data based on said monitoring policy.

10. The non-transitory computer-readable medium as recited in claim 9 wherein said automatically arranging the monitoring of said monitoring points further includes:

automatically increasing the number of network intrusion detection systems receiving said network communication data from a particular monitoring point by selecting additional available network intrusion detection systems if said network communication data exceeds a capacity of said particular network intrusion detection systems.

11. The non-transitory computer-readable medium as recited in claim 9 wherein said automatically arranging the monitoring of said monitoring points further includes:

automatically decreasing the number of network intrusion detection systems receiving said network communication data from a particular monitoring point by releasing any of said particular network intrusion detection systems to said available network intrusion detection systems if said network communication data is below a predetermined threshold of a capacity of said particular network intrusion detection systems.

12. The non-transitory computer-readable medium as recited in claim 9 wherein said network resources include one of a firewall, a gateway system, a network switch, and a network router.

13. The non-transitory computer-readable medium as recited in claim 8 wherein said receiving a monitoring policy and a plurality of monitoring points to be monitored includes:

providing a graphical user interface to receive said monitoring policy and said plurality of monitoring points to be monitored.

14. The non-transitory computer-readable medium as recited in claim 8 wherein said dynamic data center is a utility data center.

15. A system comprising:

a dynamic data center including;

a plurality of network resources;

a plurality of network intrusion detection systems, each being networked so that utilization of each network intrusion detection system can be based on demand for said network intrusion detection systems in said dynamic data center wherein said dynamic data center automatically provides said plurality of network intrusion detection systems by automatically provisioning said plurality of network intrusion detection systems from a pool of available network intrusion detection systems enabling automatic modification of a number of provided network intrusion detection systems based on the demand, wherein the automatic modification of the number is selected from increasing the number of provided network intrusion detection systems and decreasing the number of provided network intrusion detection systems;

a graphical user interface for receiving a monitoring policy and a plurality of monitoring points to be monitored on a network with any of said network intrusion detection systems; and

a controller for controlling said network resources and said network intrusion detection systems and for automatically arranging the monitoring of said monitoring points using said network intrusion detection systems and said monitoring policy, wherein said graphical user interface and said controller provide at least in part automatic configuring of said provided network intrusion detection systems.

16. The system as recited in claim 15 wherein said controller automatically configures said network resources to provide network communication data from said monitoring points to a plurality of available network intrusion detection systems from said network intrusion detection systems, and wherein said controller automatically configures said available network intrusion detection systems to receive said network communication data based on said monitoring policy.

17. The system as recited in claim 16 wherein said controller automatically increases the number of network intrusion detection systems receiving said network communication data from a particular monitoring point by selecting additional available network intrusion detection systems if said network communication data exceeds a capacity of said particular network intrusion detection systems.

18. The system as recited in claim 16 wherein said controller automatically decreases the number of network intrusion detection systems receiving said network communication data from a particular monitoring point by releasing any of said particular network intrusion detection systems to said available network intrusion detection systems if said network communication data is below a predetermined threshold of a capacity of said particular network intrusion detection systems.

19. The system as recited in claim 15 wherein said network resources include one of a firewall, a gateway system, a network switch, and a network router.

20. The system as recited in claim 15 wherein said dynamic data center is a utility data center.