Patent ID: 9256740
Filing Date: 2016-02-09
CPC Classification: G06F,H04L

Claim Text:
1. A method for managing events, comprising: receiving, by a computer, a multiplicity of event data that represents a respective multiplicity of events corresponding to the device; adding, by the computer, the multiplicity of event data to a queue for the device; based on a characteristic of a potential attack associated each of the multiplicity of events, categorizing, by the computer, the multiplicity of event data into at least one of a scanned event category that represents scanning attacks against the device, a worm signature event category that represents worm attacks against the device, a sweeps signature event category that represents sweep attacks against a network leading to the device, and a hot decodes signature event category that represents high priority signatures tracked by a user; determining, by the computer, a total number of events in each of the categories; determining, for each category, a stored profile of the events for each of the events corresponding to the device; calculating, by the computer, a percentage increase of the total number of events for each of the categories based on the total number of events of each of the categories and the stored profile of events of the respective category; determining, by the computer, a range of number of events within which the total number of events for each category fits, the range of number of events of each of the categories represented by a threshold matrix, for each of the categories, determining, by the computer, the alert percentage value associated with the range of the number of events within which the total number of events for the respective category fits, the alert percentage value comprising a value above-which alerts are triggered; and for each of the categories, determining, by the computer, if the percentage increase of the number of events is greater than the alert percentage value of the respective category to generate an alert.