Patent US6347374B1 successfully refreshed from Google Patents.
US6347374B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Event detection
Assignee: Intrusion Inc
•
Filing: 1998-06-05
•
Granted: 2002-02-12
•
Expires: 2018-06-05
Abstract
Abstract A system for event detection employs a collector that collects raw audit data made up of raw audit data records at an audit source; a database; an inserter at a downstream processing location that inserts Virtual Records into the database, including both a first type of Virtual Record generated in response to a raw audit data record, and a second type of Virtual Record generated in response to a detected audit event; the inserter; a parser; coupled to the collector, that converts raw audit data records in the raw audit data into Virtual Records; a detector that detects audit events in response to the Virtual Records generated by the parser, and generates the second type of Virtual Record in the event an audit event is detected.
Inventors
- 👤 David L. Drake
- 👤 David J. Webster
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 14:31
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/14; H04L63/1408; H04L63/1416; G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/554; H04L41/00; H04L41/06; H04L41/0631; H04L43/00; H04L43/08; H04L43/0805; H04L43/0811; H04L63/1425; G06F2221/00; G06F2221/21; G06F2221/2101; H04L41/0654; H04L41/16
Claims Analysis
Total Claims: 48
Claim 1
Independent Claim
298 words
A system for event detection comprising: a collector operable to collect raw audit data comprising raw audit data records, the collector being at a first audit source having a first type of operating system; a database; an inserter, in communication with the database, operable to insert Virtual Records into the database, including both a first type of Virtual Record generated in response to a raw audit data record, and a second type of Virtual Record generated in response to a detected audit event; a parser, in communication with the collector and the inserter, operable to convert raw audit data records in the raw audit data into Virtual Records of the first type, wherein the Virtual Records of the first type are generated in a normalized format, the normalized format having a plurality of data fields, each data field corresponding to a different category of data associated with a potential audit event, the parser converting the raw audit data records into Virtual Records of the first type by parsing the raw audit data records to identify the different categories of data for storage within the data fields; and a detector, in communication with the parser and the inserter, operable to detect audit events in response to analyzing data arranged according to the normalized format in the Virtual Records of the first type, the detector operable to generate the second type of Virtual Record in the event one of the audit events is detected, the detector further operable to detect audit events in response to analyzing data arranged according to the normalized format in additional Virtual Records of the first type, the additional Virtual Records being converted from additional raw audit data records collected at a second audit source, the second audit source having a second type of operating system.
Claim 2
Independent Claim
298 words
A system for event detection comprising: a collector operable to collect raw audit data comprising raw audit data records, the collector being at a first audit source having a first type of operating system; a database; an inserter, in communication with the database, operable to insert Virtual Records into the database, including both a first type of Virtual Record generated in response to a raw audit data record, and a second type of Virtual Record generated in response to a detected audit event; a parser, in communication with the collector and the inserter, operable to convert raw audit data records in the raw audit data into Virtual Records of the first type, wherein the Virtual Records of the first type are generated in a normalized format, the normalized format having a plurality of data fields, each data field corresponding to a different category of data associated with a potential audit event, the parser converting the raw audit data records into Virtual Records of the first type by parsing the raw audit data records to identify the different categories of data for storage within the data fields; and a detector, in communication with the parser and the inserter, operable to detect audit events in response to analyzing data arranged according to the normalized format in the Virtual Records of the first type, the detector operable to generate the second type of Virtual Record in the event one of the audit events is detected, the detector further operable to detect audit events in response to analyzing data arranged according to the normalized format in additional Virtual Records of the first type, the additional Virtual Records being converted from additional raw audit data records collected at a second audit source, the second audit source having a second type of operating system.
Claim 3
Dependent Claim
46 words
The system of claim 1 further comprising: a sender in communication with at least one of the collector, the parser, and the detector, the sender operable to send output data from the at least one of the collector, the parser, and the detector to the inserter.
Claim 4
Dependent Claim
37 words
The system of claim 2 wherein said sender includes an encryptor for encrypting output data from said at least one of the collector, the parser, and the detector before said output data is sent to the inserter.
Claim 5
Dependent Claim
44 words
The system of claim 2 wherein the sender is coupled to the collector, at the first audit source, and is operable to send Virtual Records of the first type from the collector to the parser, the parser being located, at a downstream process location.
Claim 6
Dependent Claim
44 words
The system of claim 2 wherein the sender is coupled to the parser, at the first audit source, and is operable to send Virtual Records of the first type from the parser to the detector, the detector being located at the downstream process location.
Claim 7
Dependent Claim
28 words
The system of claim 2 wherein the sender is coupled to the detector, at the audit source, and wherein the inserter is located at the downstream process location.
Claim 8
Dependent Claim
51 words
The system of claim 1 wherein an input of said detector is coupled to an output of said parser, and wherein the detector detects audit events in response to the Virtual Records of the first type generated by the parser and generates Virtual Records of the second type in response thereto.
Claim 9
Dependent Claim
50 words
The system of claim 1 wherein an input of said detector is coupled to an output of said inserter and where the detector detects audit events in response to analyzing Virtual Records of the first type from the inserter and generates Virtual Records of the second type in response thereto.
Claim 10
Dependent Claim
34 words
The system of claim 8 wherein an output of said detector is coupled to an input of said inserter wherein Virtual Records of the second type are sent from the detector to the inserter.
Claim 11
Dependent Claim
50 words
The system of claim 1 wherein an input of said detector is coupled to an output of said database, and wherein said detector detects audit events in response to the Virtual Records of the first type in the database and generates Virtual Records of the second type in response thereto.
Claim 12
Dependent Claim
35 words
The system of claim 10 wherein an output of said detector is coupled to said inserter, wherein Virtual Records of the second type generated by the detector are inserted into the database by the inserter.
Claim 13
Dependent Claim
21 words
The system of claim 1 herein said collector collects local information from said first audit source, along with said audit data.
Claim 14
Dependent Claim
12 words
The system of claim 1 wherein said database is a relational database.
Claim 15
Dependent Claim
33 words
The system of claim 13 further comprising: a user interface coupled to the database, the user interface having a filter operable to filter Virtual Records in the database based on a filter criteria.
Claim 16
Dependent Claim
29 words
The system of claim 1 wherein said detector comprises: a processor operable to perform a rule-based analysis of the Virtual Records of the first type generated by the parser.
Claim 17
Dependent Claim
30 words
The system of claim 1 wherein said detector further comprises: a processor operable to perform a statistical analysis of the Virtual Records of the first type generated by the parser.
Claim 18
Dependent Claim
58 words
The system of claim 16 wherein said detector further comprises: a processor operable to determine a mean and a standard deviation of a parameter in a set of said Virtual Records, and further operable to detect in a subsequent Virtual Record whether the parameter is more than a predetermined multiple of the standard deviation away from the mean.
Claim 19
Dependent Claim
25 words
The system of claim 17 wherein said detector comprises: a processor operable to perform a rule-based analysis of the Virtual Records generated by the parser.
Claim 20
Dependent Claim
20 words
The system of claim 1 wherein said raw audit data is a security log generated by a computer operating system.
Claim 21
Independent Claim
167 words
A method of event detection comprising: collecting raw audit data at an audit source, the raw data comprising raw audit data records; parsing the raw audit data records by converting each raw audit data record into a Virtual Record of a first type, the Virtual Records of the first type being arranged according to a normalized format, the normalized format having a plurality of data fields, each data field corresponding to a different category of data associated with a potential audit event, the parsing including converting the raw audit data records into Virtual Records of the first type by parsing the raw audit data records to identify the different categories of data for storage within the data fields; detecting audit events in response to analyzing the different categories of data included in the Virtual Records; generating a Virtual Record of a second type in response to each detected audit event; and storing the Virtual Records of the first type and the Virtual Records of the second type.
Claim 22
Independent Claim
167 words
A method of event detection comprising: collecting raw audit data at an audit source, the raw data comprising raw audit data records; parsing the raw audit data records by converting each raw audit data record into a Virtual Record of a first type, the Virtual Records of the first type being arranged according to a normalized format, the normalized format having a plurality of data fields, each data field corresponding to a different category of data associated with a potential audit event, the parsing including converting the raw audit data records into Virtual Records of the first type by parsing the raw audit data records to identify the different categories of data for storage within the data fields; detecting audit events in response to analyzing the different categories of data included in the Virtual Records; generating a Virtual Record of a second type in response to each detected audit event; and storing the Virtual Records of the first type and the Virtual Records of the second type.
Claim 23
Dependent Claim
15 words
The method of claim 20 further comprising: encrypting the Virtual Records of the first type.
Claim 24
Dependent Claim
24 words
The method of claim 20 wherein said detecting comprises detecting audit events in response to retrieving the stored Virtual Records of the first type.
Claim 25
Dependent Claim
20 words
The method of claim 20 wherein said detecting comprises detecting audit events in response to Virtual Records and event signatures.
Claim 26
Dependent Claim
21 words
The method of claim 20 wherein said detecting comprises detecting audit events in response to Virtual Records and a statistical analysis.
Claim 27
Dependent Claim
20 words
The method of claim 20 further comprising filtering the stored Virtual Records of the first type using a user interface.
Claim 28
Dependent Claim
16 words
The method of claim 20 wherein said detecting comprises performing rule-based analysis on the Virtual Records.
Claim 29
Dependent Claim
28 words
The method of claim 20 wherein said detecting comprises performing statistical analysis in the Virtual Records using audit data associated with a plurality of types of audit sources.
Claim 30
Dependent Claim
51 words
The method of claim 27 wherein said performing statistical analysis comprises: determining a mean and a standard deviation of a parameter in a set of Virtual Records; and determining whether in a subsequent Virtual Record the parameter is more than a predetermined multiple of the standard deviation away from the mean.
Claim 31
Dependent Claim
17 words
The method of claim 28 wherein said detecting further comprises performing rule-based analysis on the Virtual Records.
Claim 32
Independent Claim
201 words
A method of event detection, the method comprising: collecting raw audit data at a first audit source having a first type of operating system, the raw audit data having one or more raw audit data records; collecting additional raw audit data at a second audit source having a second type of operating system, the additional raw audit data having one or more additional raw audit data records; converting each of the raw audit data records and additional raw audit data records into a Virtual Record, the Virtual Record being organized using a normalized format, the Virtual Record being populated with data from the raw audit data record in response to the type of operating system of the audit source associated with the raw audit data records; communicating the Virtual Records to a detector; and detecting audit events in response to the detector receiving the Virtual Records, wherein the detector detects audit events in response to performing signature analysis on the Virtual Records converted from the raw audit data records and the additional raw audit data records, and wherein the detector further detects audit events in response to performing statistical analysis on the Virtual Records as compared to previously stored Virtual Records.
Claim 33
Independent Claim
201 words
A method of event detection, the method comprising: collecting raw audit data at a first audit source having a first type of operating system, the raw audit data having one or more raw audit data records; collecting additional raw audit data at a second audit source having a second type of operating system, the additional raw audit data having one or more additional raw audit data records; converting each of the raw audit data records and additional raw audit data records into a Virtual Record, the Virtual Record being organized using a normalized format, the Virtual Record being populated with data from the raw audit data record in response to the type of operating system of the audit source associated with the raw audit data records; communicating the Virtual Records to a detector; and detecting audit events in response to the detector receiving the Virtual Records, wherein the detector detects audit events in response to performing signature analysis on the Virtual Records converted from the raw audit data records and the additional raw audit data records, and wherein the detector further detects audit events in response to performing statistical analysis on the Virtual Records as compared to previously stored Virtual Records.
Claim 34
Dependent Claim
34 words
The method of claim 30 , wherein detecting audit events further comprises detecting audit events wherein the detector is located at a different node of the network from the first and second audit sources.
Claim 35
Independent Claim
241 words
A method of event detection, the method comprising: collecting raw audit data at a first audit source having a first type of operating system, the raw audit data having one or more raw audit data records; collecting additional raw audit data at a second audit source having a second type of operating system, the additional raw audit data having one or more additional raw audit data records; converting each of the raw audit data records and additional raw audit data records into a Virtual Record, the Virtual Record being organized using a normalized format, the Virtual Record being populated with data from the raw audit data record in response to the type of operating system of the audit source associated with the raw audit data records; communicating the Virtual Records to a detector; and detecting audit events in response to the detector receiving the Virtual Records, wherein the detector detects audit events in response to performing signature analysis on the Virtual Records converted from the raw audit data records and the additional raw audit data records, and wherein the detector further detects audit events in response to performing statistical analysis on the Virtual Records as compared to previously stored Virtual Records, wherein detecting audit events further comprises detecting audit events in response to combining a first set of data associated with the first type of operating system with a second set of data associated with the second type of operating system.
Claim 36
Independent Claim
241 words
A method of event detection, the method comprising: collecting raw audit data at a first audit source having a first type of operating system, the raw audit data having one or more raw audit data records; collecting additional raw audit data at a second audit source having a second type of operating system, the additional raw audit data having one or more additional raw audit data records; converting each of the raw audit data records and additional raw audit data records into a Virtual Record, the Virtual Record being organized using a normalized format, the Virtual Record being populated with data from the raw audit data record in response to the type of operating system of the audit source associated with the raw audit data records; communicating the Virtual Records to a detector; and detecting audit events in response to the detector receiving the Virtual Records, wherein the detector detects audit events in response to performing signature analysis on the Virtual Records converted from the raw audit data records and the additional raw audit data records, and wherein the detector further detects audit events in response to performing statistical analysis on the Virtual Records as compared to previously stored Virtual Records, wherein detecting audit events further comprises detecting audit events in response to combining a first set of data associated with the first type of operating system with a second set of data associated with the second type of operating system.
Claim 37
Independent Claim
217 words
A method of event detection, the method comprising: collecting raw audit data at a first audit source having a first type of operating system, the raw audit data having one or more raw audit data records; collecting additional raw audit data at a second audit source having a second type of operating system, the additional raw audit data having one or more additional raw audit data records; converting each of the raw audit data records and additional raw audit data records into a Virtual Record, the Virtual Record being organized using a normalized format, the Virtual Record being populated with data from the raw audit data record in response to the type of operating system of the audit source associated with the raw audit data records; communicating the Virtual Records to a detector; and detecting audit events in response to the detector receiving the Virtual Records, wherein the detector detects audit events in response to performing signature analysis on the Virtual Records converted from the raw audit data records and the additional raw audit data records, and wherein the detector further detects audit events in response to performing statistical analysis on the Virtual Records as compared to previously stored Virtual Records, wherein detecting audit events in response to performing signature analysis includes maintaining and monitoring state information.
Claim 38
Independent Claim
217 words
A method of event detection, the method comprising: collecting raw audit data at a first audit source having a first type of operating system, the raw audit data having one or more raw audit data records; collecting additional raw audit data at a second audit source having a second type of operating system, the additional raw audit data having one or more additional raw audit data records; converting each of the raw audit data records and additional raw audit data records into a Virtual Record, the Virtual Record being organized using a normalized format, the Virtual Record being populated with data from the raw audit data record in response to the type of operating system of the audit source associated with the raw audit data records; communicating the Virtual Records to a detector; and detecting audit events in response to the detector receiving the Virtual Records, wherein the detector detects audit events in response to performing signature analysis on the Virtual Records converted from the raw audit data records and the additional raw audit data records, and wherein the detector further detects audit events in response to performing statistical analysis on the Virtual Records as compared to previously stored Virtual Records, wherein detecting audit events in response to performing signature analysis includes maintaining and monitoring state information.
Claim 39
Dependent Claim
18 words
The method of claim 33 , wherein detecting audit events further comprises accessing a database of audit events.
Claim 40
Dependent Claim
35 words
The method of claim 33 , wherein detecting audit events further comprises accessing a database of audit events, the database being configurable by a user to add or delete categories used to identify audit events.
Claim 41
Dependent Claim
15 words
The method of claim 35 , wherein the categories include users, platforms, events, and intervals.
Claim 42
Independent Claim
210 words
A method of event detection, the method comprising: collecting raw audit data at a first audit source having a first type of operating system, the raw audit data having one or more raw audit data records; collecting additional raw audit data at a second audit source having a second type of operating system, the additional raw audit data having one or more additional raw audit data records; converting each of the raw audit data records and additional raw audit data records into a Virtual Record, the Virtual Record being organized using a normalized format, the Virtual Record being populated with data from the raw audit data record in response to the type of operating system of the audit source associated with the raw audit data records; communicating the Virtual Records to a detector; detecting audit events in response to the detector receiving the Virtual Records, wherein the detector detects audit events in response to performing signature analysis on the Virtual Records converted from the raw audit data records and the additional raw audit data records, and wherein the detector further detects audit events in response to performing statistical analysis on the Virtual Records as compared to previously stored Virtual Records; and wherein the method is conducted using transparent object connectivity.
Claim 43
Independent Claim
210 words
A method of event detection, the method comprising: collecting raw audit data at a first audit source having a first type of operating system, the raw audit data having one or more raw audit data records; collecting additional raw audit data at a second audit source having a second type of operating system, the additional raw audit data having one or more additional raw audit data records; converting each of the raw audit data records and additional raw audit data records into a Virtual Record, the Virtual Record being organized using a normalized format, the Virtual Record being populated with data from the raw audit data record in response to the type of operating system of the audit source associated with the raw audit data records; communicating the Virtual Records to a detector; detecting audit events in response to the detector receiving the Virtual Records, wherein the detector detects audit events in response to performing signature analysis on the Virtual Records converted from the raw audit data records and the additional raw audit data records, and wherein the detector further detects audit events in response to performing statistical analysis on the Virtual Records as compared to previously stored Virtual Records; and wherein the method is conducted using transparent object connectivity.
Claim 44
Dependent Claim
20 words
The method of claim 33 , wherein communicating the Virtual Records further comprises encrypting the Virtual Records prior to communication.
Claim 45
Dependent Claim
32 words
The method of claim 33 , wherein the raw audit data records each include audit data associated with an event or portion of an event taking place at the first audit source.
Claim 46
Dependent Claim
30 words
The method of claim 33 , wherein converting each of the raw audit data records further comprises accessing ancillary information from a local system associated with the first audit source.
Claim 47
Dependent Claim
21 words
The method of claim 33 , wherein communicating the Virtual Records further comprises communicating the Virtual Records in real-time upon conversion.
Claim 48
Dependent Claim
15 words
The method of claim 33 , and further comprising archiving the raw audit data records.
References Cited (Backward Citations)
US3931504A
Cited
US4141006A
Cited
US5032979A
Cited
US5278901A
Cited
US5440723A
Cited
US5621889A
Cited
US5557742A
Cited
US5758069A
Cited
US5909493A
Cited
US6052729A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-02-11 | 2005-08-13 | 2006-02-12 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-02-11 | 2009-08-13 | 2010-02-12 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-02-11 | 2013-08-13 | 2014-02-12 | $7700.00 | Window Closed / Lapsed |