Interpreting categorized change information in order to build and maintain change catalogs

• US 9,741,017 B2
• Filed: 12/08/2009
• Issued: 08/22/2017
• Est. Priority Date: 12/08/2009
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Good, Tom, Kim, Gene, Whitlock, David
• Primary Examiner(s): Won, Michael Y
• Application Number:
  US12/633,734
• Publication Number:
  US 20110138038A1
• Time in Patent Office: 2,814 Days
• Field of Search: 709224
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/2358 Change logging, detection, and notification replication G06F16/27
• CPC Class Codes: G06F 16/24573 using data annotations, e.g. user-defined metadata
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

Methods, systems, and articles for receiving, by a monitor server, change data associated with a change captured on a target host, are described herein. In various embodiments, the target host may have provided the change data in response to detecting the change, and the change data may include one or more rules, settings, and/or parameters. Further, in some embodiments, the monitor server may then group the change data into clusters and may correlate the clusters with a change catalog in order to provide a possible reason or cause for the cluster of changes. Once the change data have been classified as clusters, a report may be generated providing classification or categorization and cluster information for the various changes. In various embodiments, the generating may comprise generating a report to the target host and/or to an administrative user. In various embodiments, a reason may be determined for causing a cluster of changes and the change catalog may updated with the reason.

Claims

1. A method comprising:

providing at least one change catalog;

receiving, by a monitor server, change data associated with a plurality of changes to a target host, the target host providing the change data in response to detecting the plurality of changes, wherein the change data includes a rule that generated the change, an identifier of the target host from which the change data was collected, a specific element name associated with the change, and element data associated with the change;

analyzing, by the monitor server, the change data in order to group the plurality of changes detected on the target host into clusters of changes based on the change data associated with the plurality of changes detected on the target host; and

correlating, by the monitor server, the clusters of changes with the at least one change catalog in order to classify a portion of the clusters of changes relating to at least one potential reason for the plurality of changes in order to categorize at least some of the clusters of related changes, wherein at least one of the clusters of changes is not correlated with information within the at least one change catalog, the at least one uncorrelated cluster being without a potential reason as to the cause of the change data;

after the analyzing and the correlating, determining, by the monitor server, for at least one of the uncorrelated clusters of related changes without a reason as to the cause of the change, at least one other potential reason for a portion of the plurality of changes captured on the target host in the at least one of the uncorrelated clusters; and

updating the at least one change catalog with the at least one other potential reason.

2. The method of claim 1, further comprising:

in response to receiving the change data, generating, by the monitor server, an event; and

performing said determining in response to the generated event.

3. The method of claim 1, further comprising filtering, by the compliance server, the received change data and conditionally performing the determining based on a result of the filtering.

4. The method of claim 1, further comprising generating a report to the target host or an administrative user, wherein the report relates to the correlation of the clusters of changes.

5. The method of claim 1, further comprising:

determining, by the monitor server, whether the one or more rules, settings, or parameters violate one or more compliance policies; and

generating, by the monitor server, one or more test results based at least on the results of the determining whether the one or more rules, settings, or parameters violate one or more compliance policies.

6. The method of claim 5, wherein each compliance policy includes one or more of a rule, a change name, one or more waivers from the policy, and an expression for evaluating element data of the change.

7. The method of claim 5, further comprising filtering, by the monitor server, the received change data and conditionally performing the determining at least one other reason based on a result of the filtering.

8. The method of claim 5, wherein the determining whether the one or more rules, settings or parameters violate one or more compliance policies comprises evaluating an expression of at least one of the compliance policies against element data specified in the change data.

9. The method of claim 5, further comprising:

analyzing, by the monitor server, the one or more test results in order to group the one or more test results into test result clusters; and

correlating, by the monitor server, the test result clusters with the at least one change catalog in order to classify the test result clusters relating to at least one potential reason for the plurality of changes in order to categorize at least some of the test result clusters.

10. The method of claim 9, further comprising generating, by the monitor server, a report to the target host or an administrative user, wherein the report relates to the correlation of the test result clusters.

11. A monitor server comprising:

a processor;

a change database for storing change data associated with a plurality of changes captured on a target host, the target host providing the change data in response to detecting the plurality of changes by applying collection policies of rules to changes that are captured or detected on the target host, wherein the change data includes an identification of the target host for which the changes were captured or detected, an identification of the rule or collection policy responsible, a name of the data element for which the changes were detected, and the element data of the element for which the changes were detected, and wherein the change catalog is configured to store expected changes, expected rule violations, expected parameter changes, and expected setting changes; and

logic communicatively coupled to the change database and configured to be operated by the processor to;

receive the change data associated with the plurality of changes on the target host;

store the change data in the change database;

analyze the change data in order to group the plurality of changes detected on the target host into clusters of changes, wherein the analyzing comprises looking up one or more compliance policies that match collection policies or rules specified in the change data;

correlate the clusters of changes with at least one of the expected changes, rule violations, parameter changes, or settings stored in the change catalog in order to classify at least a portion of the clusters of changes as relating to at least one potential reason for the plurality of changes, wherein at least one of the clusters of changes is not correlated with a potential reason as to the cause of the change data;

after analyzing the change data and correlating the cluster of changes, determine, for at least one of the clusters of changes not correlated with a potential reason as to the cause of the change data, at least one other possible reason for a portion of the plurality of changes captured on the target host in the at least one of the uncorrelated clusters; and

update the at least one change catalog with the at least one other possible reason.

12. The monitor server of claim 11, wherein the change catalog is located within the change database.

13. The monitor server of claim 12, wherein the logic is further configured to:

classify the clusters of changes relating to a potential reason for the plurality of changes by inferring a categorization for at least some of the clusters of changes based upon at least one known enterprise change.

14. The monitor server of claim 12, wherein the logic is further configured to:

in response to receiving the change data, generate an event; and

perform said determine in response to the generated event.

15. The monitor server of claim 11, wherein the logic is further configured to:

determine whether the one or more rules, settings, or parameters violate one or more compliance policies; and

generate one or more test results based at least on the results of the determining whether the one or more rules, settings or parameters violate one or more compliance policies.

16. The monitor server of claim 15, wherein the compliance policies ensure that the target host is in compliance with one or more standards.

17. The monitor server of claim 15, wherein the logic is further configured to:

filter the received change data and conditionally perform the determining at least one other reason based on a result of the filtering.

18. The monitor server of claim 15, wherein the logic is further configured to:

evaluate an expression of at least one of the compliance policies against element data specified in the change data.

19. The monitor server of claim 15, wherein the logic is further configured to:

analyze the one or more test results in order to group the one or more test results into test result clusters; and

correlate the test result clusters with at least one change catalog in order to classify the test result clusters relating to at least one potential reason for the plurality of changes in order to categorize at least some of the test result clusters.

20. The monitor server of claim 19, wherein the logic is further configured to:

generate a report to the target host or an administrative user, wherein the report relates to the correlation of the test result clusters.

21. An article of manufacture comprising:

a computer-readable storage device; and

a plurality of programming instructions or statements stored on the storage device and configured to program a monitor server to;

receive change data associated with a plurality of changes to a target host and captured on the target host, the target host providing the change data in response to detecting the plurality of changes, wherein the change data includes a rule that generated the change;

analyze the change data in order to group the plurality of changes detected on the target host into clusters of changes based on the change data by evaluating an expression of at least one compliance policy against element data specified in the change data;

based upon inference techniques, correlate the clusters of changes with at least one change catalog in order to classify at least a portion of the clusters of changes as relating to at least one potential reason for the plurality of changes, wherein at least one of the clusters of changes is not correlated with information within the at least one change catalog, the at least one uncorrelated cluster being without a potential reason as to the cause of the change data, and wherein the change catalog includes at least one or more of the following;

expected changes, expected rule violations, expected parameter changes, or expected setting changes;

determine, for the at least one uncorrelated cluster of changes without a reason as to the cause of the change data, at least one other potential reason for a portion of the plurality of changes that are in the at least one uncorrelated cluster and that were captured on the target host; and

update the at least one change catalog with the at least one other potential reason.