US6910135B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for an intruder detection reporting and response system
Assignee: Verizon Corporate Services Group Inc
•
Filing: 1999-07-07
•
Granted: 2005-06-21
•
Expires: 2019-07-07
Abstract
Abstract A method and apparatus is disclosed for improving the security of computer networks by providing a means operating passively on the network for detecting, reporting and responding to intruders. The system is comprised of a plurality of intruder sensor client computers and associated event correlation engines. Resident in the memory of the client computer and operating in the background is a Tactical Internet Device Protection (TIDP) component consisting of a passive intruder detector and a security Management Information Base (MIB). The passive intruder detector component of the TIDP passively monitors operations performed on the client computer and emits a Simple Network Management Protocol (SNMP) trap to an event correlation engine when it identifies a suspected intruder. The event correlation engine, through the use of a behavior model loaded in its memory, determines whether the user's activities are innocent or those of a perspective intruder. When the event correlation engine is unable to classify a user based on a single trap message, it can request historical information from the security MIB, a database of the operating history of the client computer including a chronology of the illegal operations performed on the client. Once the event correlation engine determines that an intruder is located at an associated client workstation, it generates a status message and transmits the message to all of its subscribers, informing them of the presence and location of a suspected intruder.
Inventors
- 👤 Steven Phillip Grainger
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-08 12:51
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/20; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/316; G06F21/50; G06F21/55; G06F21/552; H04L63/14; H04L63/1408; H04L63/1416
Claims Analysis
Total Claims: 53
Claim 1
Independent Claim
95 words
A method in an intruder detector system having a plurality of clients and an event correlation engine, the method comprising the steps of: receiving a trap message by the event correlation engine, said trap message indicating that a suspected intruder is accessing a first client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter; and transmitting a status change from said event correlation engine, said status change informing a second client of the location of said suspected intruder.
Claim 2
Independent Claim
95 words
A method in an intruder detector system having a plurality of clients and an event correlation engine, the method comprising the steps of: receiving a trap message by the event correlation engine, said trap message indicating that a suspected intruder is accessing a first client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter; and transmitting a status change from said event correlation engine, said status change informing a second client of the location of said suspected intruder.
Claim 3
Dependent Claim
29 words
The method of claim 1 , said step of receiving a trap message further comprising the step of extracting the source of the trap message from said trap message.
Claim 4
Dependent Claim
37 words
The method of claim 1 , said step of receiving a trap message by said event correlation engine further comprising the step of confirming that an operation performed on the first client is indicative of an intruder.
Claim 5
Dependent Claim
85 words
The method of claim 3 , said confirming step further comprising the steps of: accessing a behavior model database stored on said event correlation engine; comparing said trap message to at least one of a plurality of behavior model rules stored in said behavior model database; and declaring that an operation performed on the first client is indicative of an intruder operating on the client when said trap message exceeds a threshold level in said at least one of a plurality of behavior model rules.
Claim 6
Dependent Claim
55 words
The method of claim 4 , said declaring step further comprising the steps of: determining whether said trap message is at least a second identical occurrence of said trap message; and concluding that an operation is indicative of an intruder operating on the client when said trap message is at least a second identical occurrence.
Claim 7
Dependent Claim
56 words
The method of claim 4 , said confirming step further comprising the steps of: transmitting a request for additional information from said event correlation engine to the first client; retrieving information from a security Management Information Base (MIB) stored on the first client; and transmitting a response from the first client to said event correlation engine.
Claim 8
Independent Claim
114 words
A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and an intruder sensor operating on a client, said method comprising the steps of: monitoring a plurality of operations on the client by the intruder sensor; determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing the client; and transmitting a trap message to an event correlation engine, said trap message indicating that said suspected intruder is accessing the client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter.
Claim 9
Independent Claim
114 words
A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and an intruder sensor operating on a client, said method comprising the steps of: monitoring a plurality of operations on the client by the intruder sensor; determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing the client; and transmitting a trap message to an event correlation engine, said trap message indicating that said suspected intruder is accessing the client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter.
Claim 10
Dependent Claim
21 words
The method of claim 7 , said monitoring step further comprising the step of detecting unsuccessful logon attempts to the client.
Claim 11
Dependent Claim
32 words
The method of claim 8 , said determining step further comprising the step of assessing the presence of an intruder when a number of detected unsuccessful logon attempts exceeds a threshold value.
Claim 12
Dependent Claim
22 words
The method of claim 7 , said monitoring step further comprising the step of detecting attempted user accesses to protected memory locations.
Claim 13
Dependent Claim
36 words
The method of claim 10 , said determining step further comprising the step of assessing the presence of an intruder when a number of detected attempted user accesses to protected memory locations exceeds a threshold value.
Claim 14
Dependent Claim
21 words
The method of claim 7 , said monitoring step further comprising the step of detecting attempted user accesses to restricted applications.
Claim 15
Dependent Claim
33 words
The method of claim 12 , said determining step further comprising the step of assessing the presence of an intruder when said detected attempted user accesses to protected memory exceeds a threshold value.
Claim 16
Dependent Claim
22 words
The method of claim 7 , said transmitting step further comprising the step of transmitting said trap message over a wireless network.
Claim 17
Dependent Claim
14 words
The method of claim 7 , said monitoring step is performed in the background.
Claim 18
Independent Claim
186 words
A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and a plurality of client computers with intruder sensors, said method comprising the steps of: monitoring a plurality of operations on at least one of said plurality of client computers; determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing at least one of said plurality of client computers; transmitting a trap message by the intruder sensor to an event correlation engine, said trap message indicating the presence of said suspected intruder on the client computer and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter; receiving the trap message by the event correlation engine; determining whether said suspected intruder is accessing the client computer; and if said suspected intruder is detected, transmitting a status change from said event correlation engine to said plurality of client computers, said status change informing said plurality of clients of the location of said suspected intruder.
Claim 19
Independent Claim
186 words
A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and a plurality of client computers with intruder sensors, said method comprising the steps of: monitoring a plurality of operations on at least one of said plurality of client computers; determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing at least one of said plurality of client computers; transmitting a trap message by the intruder sensor to an event correlation engine, said trap message indicating the presence of said suspected intruder on the client computer and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter; receiving the trap message by the event correlation engine; determining whether said suspected intruder is accessing the client computer; and if said suspected intruder is detected, transmitting a status change from said event correlation engine to said plurality of client computers, said status change informing said plurality of clients of the location of said suspected intruder.
Claim 20
Dependent Claim
16 words
The method of claim 16 wherein said status change is not transmitted to the suspected intruder.
Claim 21
Dependent Claim
31 words
The method of claim 17 , said step of transmitting a status change is comprised of the step of transmitting the status change over a wired and a wireless computer network.
Claim 22
Dependent Claim
131 words
A distributed system for passively detecting and reporting the presence of an intruder, comprising: an event correlation engine with a plurality of associated client computers; an associated server computer; and an intruder sensor operating in the background on said client computers that monitors a plurality of operations and transmitting a trap message to the associated server computer whenever said plurality of operations indicates the presence of a suspected intruder on the client, wherein said trap message includes client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter, said server computer including a component for transmitting a status change to said plurality of client computers for informing said plurality of clients of the location of said suspected intruder.
Claim 23
Dependent Claim
131 words
A distributed system for passively detecting and reporting the presence of an intruder, comprising: an event correlation engine with a plurality of associated client computers; an associated server computer; and an intruder sensor operating in the background on said client computers that monitors a plurality of operations and transmitting a trap message to the associated server computer whenever said plurality of operations indicates the presence of a suspected intruder on the client, wherein said trap message includes client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter, said server computer including a component for transmitting a status change to said plurality of client computers for informing said plurality of clients of the location of said suspected intruder.
Claim 24
Dependent Claim
17 words
The distributed system of claim 19 wherein said status change is not transmitted to the suspected intruder.
Claim 25
Independent Claim
186 words
A system for passively detecting and reporting the presence of an intruder on a computer network containing an event correlation engine and a plurality of client computers with intruder sensors, the system comprising: means for monitoring a plurality of operations on at least one of said plurality of client computers; means for determining whether at least one of said plurality of operations indicates that an intruder is accessing at least one of said plurality of client computers; means for transmitting a trap message by the intruder sensor to an event correlation engine, said trap message indicating the presence of a suspected intruder on the client computer and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter; means for receiving the trap message by the event correlation engine; means for determining that an intruder is accessing the client computer; and means for transmitting a status change from said event correlation engine to said plurality of client computers, said status change informing said plurality of clients of the location of said intruder.
Claim 26
Independent Claim
186 words
A system for passively detecting and reporting the presence of an intruder on a computer network containing an event correlation engine and a plurality of client computers with intruder sensors, the system comprising: means for monitoring a plurality of operations on at least one of said plurality of client computers; means for determining whether at least one of said plurality of operations indicates that an intruder is accessing at least one of said plurality of client computers; means for transmitting a trap message by the intruder sensor to an event correlation engine, said trap message indicating the presence of a suspected intruder on the client computer and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter; means for receiving the trap message by the event correlation engine; means for determining that an intruder is accessing the client computer; and means for transmitting a status change from said event correlation engine to said plurality of client computers, said status change informing said plurality of clients of the location of said intruder.
Claim 27
Dependent Claim
114 words
An intruder sensor software system for detecting and reporting the presence of an intruder on a computer network comprising a plurality of interconnected clients and servers, said software system comprising: an event correlation engine operating on at least one of said servers; a Tactical Internet Device Protection (TIDP) component operating on a client computer, said TIDP component passively monitoring operations on said client computer and transmitting a trap message to said event correlation engine in the event that an intruder is suspected on the client, wherein said trap message includes client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter.
Claim 28
Dependent Claim
114 words
An intruder sensor software system for detecting and reporting the presence of an intruder on a computer network comprising a plurality of interconnected clients and servers, said software system comprising: an event correlation engine operating on at least one of said servers; a Tactical Internet Device Protection (TIDP) component operating on a client computer, said TIDP component passively monitoring operations on said client computer and transmitting a trap message to said event correlation engine in the event that an intruder is suspected on the client, wherein said trap message includes client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter.
Claim 29
Dependent Claim
31 words
An intruder sensor software system according to claim 22 , said event correlation engine further comprises a behavior model database for confirming the presence of an intruder on said client computer.
Claim 30
Dependent Claim
27 words
An intruder sensor software system according to claim 23 , said behavior model database further comprises a plurality of rules for determining the presence of an intruder.
Claim 31
Dependent Claim
29 words
An intruder sensor software system according to claim 22 , said event correlation engine further comprises a means for transmitting a request for additional information to said TIDP component.
Claim 32
Dependent Claim
34 words
An intruder sensor software system according to claim 22 , said event correlation engine further comprises a Wide Area Information Distribution component for transmitting a status change to said plurality of clients and servers.
Claim 33
Dependent Claim
32 words
An intruder sensor software system according to claim 22 , said TIDP component further comprises a security MIB for storing additional information that fully describes the operating history of a client computer.
Claim 34
Dependent Claim
22 words
An intruder sensor software system according to claim 22 , said trap message further comprises an object identifier and a data portion.
Claim 35
Dependent Claim
18 words
An intruder sensor software system according to claim 22 , said trap message is a SNMP trap message.
Claim 36
Dependent Claim
22 words
An intruder sensor software system according to claim 22 wherein each of said clients and servers are comprised of a CORBA interface.
Claim 37
Independent Claim
96 words
A method in a passive intruder detector system having a plurality of clients and an event correlation engine, the method comprising the steps of: receiving a trap message by the event correlation engine, said trap message indicating that a suspected intruder is accessing a first client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter; and transmitting a status change from said event correlation engine, said status change informing a second client of the location of said suspected intruder.
Claim 38
Independent Claim
96 words
A method in a passive intruder detector system having a plurality of clients and an event correlation engine, the method comprising the steps of: receiving a trap message by the event correlation engine, said trap message indicating that a suspected intruder is accessing a first client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter; and transmitting a status change from said event correlation engine, said status change informing a second client of the location of said suspected intruder.
Claim 39
Dependent Claim
29 words
The method of claim 31 , said step of receiving a trap message further comprising the step of extracting the source of the trap message from said trap message.
Claim 40
Dependent Claim
37 words
The method of claim 31 , said step of receiving a trap message by said event correlation engine further comprising the step of confirming that an operation performed on the first client is indicative of an intruder.
Claim 41
Dependent Claim
85 words
The method of claim 33 , said confirming step further comprising the steps of: accessing a behavior model database stored on said event correlation engine; comparing said trap message to at least one of a plurality of behavior model rules stored in said behavior model database; and declaring that an operation performed on the first client is indicative of an intruder operating on the client when said trap message exceeds a threshold level in said at least one of a plurality of behavior model rules.
Claim 42
Dependent Claim
55 words
The method of claim 33 , said confirming step further comprising the steps of: determining whether said trap message is at least a second identical occurrence of said trap message; and declaring that an operation is indicative of an intruder operating on the client when said trap message is at least a second identical occurrence.
Claim 43
Dependent Claim
56 words
The method of claim 33 , said confirming step further comprising the steps of: transmitting a request for additional information from said event correlation engine to the first client; retrieving information from a security Management Information Base (MIB) stored on the first client; and transmitting a response from the first client to said event correlation engine.
Claim 44
Independent Claim
114 words
A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and an intruder sensor operating on a client, said method comprising the steps of: monitoring a plurality of operations on the client by the intruder sensor; determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing the client; and transmitting a trap message to an event correlation engine, said trap message indicating that said suspected intruder is accessing the client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter.
Claim 45
Independent Claim
114 words
A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and an intruder sensor operating on a client, said method comprising the steps of: monitoring a plurality of operations on the client by the intruder sensor; determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing the client; and transmitting a trap message to an event correlation engine, said trap message indicating that said suspected intruder is accessing the client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter.
Claim 46
Dependent Claim
21 words
The method of claim 37 , said monitoring step further comprising the step of detecting unsuccessful logon attempts to the client.
Claim 47
Dependent Claim
32 words
The method of claim 38 , said determining step further comprising the step of assessing the presence of an intruder when a number of detected unsuccessful logon attempts exceeds a threshold value.
Claim 48
Dependent Claim
22 words
The method of claim 37 , said monitoring step further comprising the step of detecting attempted user accesses to protected memory locations.
Claim 49
Dependent Claim
36 words
The method of claim 40 , said determining step further comprising the step of assessing the presence of an intruder when a number of detected attempted user accesses to protected memory locations exceeds a threshold value.
Claim 50
Dependent Claim
21 words
The method of claim 37 , said monitoring step further comprising the step of detecting attempted user accesses to restricted applications.
Claim 51
Dependent Claim
33 words
The method of claim 42 , said determining step further comprising the step of assessing the presence of an intruder when said detected attempted user accesses to protected memory exceeds a threshold value.
Claim 52
Dependent Claim
22 words
The method of claim 37 , said transmitting step further comprising the step of transmitting said trap message over a wireless network.
Claim 53
Dependent Claim
14 words
The method of claim 37 , said monitoring step is performed in the background.
References Cited (Backward Citations)
US5621889A
Cited
US5414833A
Cited
US5557742A
Cited
US6125390A
Cited
US5561769A
Cited
US6249755B1
Cited
US5905859A
Cited
US6088804A
Cited
US6408391B1
Cited
US6553403B1
Cited
US6347374B1
Cited
US6530024B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2008-06-20 | 2008-12-20 | 2009-06-21 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2012-06-20 | 2012-12-20 | 2013-06-21 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2016-06-20 | 2016-12-20 | 2017-06-21 | $7700.00 | Window Closed / Lapsed |