Patent ID: 7039953
Filing Date: 2006-05-02
Classification: G06F,H04L

Abstract:
1. A computer-implemented method in a data processing system for reporting security situations, comprising the computer-imnplemented steps of: in a first correlation server in a hierarchy of correlation servers, logging events by storing event attributes as an event set, wherein each event set includes a source attribute, a target attribute and an event category attribute; classifying events as groups by aggregating events with at least one attribute within the event set as an identical value; calculating a respective severity level for each of the groups; calculating a delta severity for each group from the respective severity level and a respective prior severity level; for each group having a non-zero delta severity, propagating the respective delta severity to a higher-level correlation server; receiving, in the higher-level correlation server, a plurality of delta packets from a plurality of lower-level correlation servers that include the first correlation server, wherein each delta packet contains the respective delta severity for each group of the respective lower-level correlation server that has a non-zero delta severity; performing a first mathematical operation on the plurality of delta packets to form a new delta packet; if the higher-level correlation server is the top level of the hierarchy of correlation servers, performing a second mathematical operation on the new delta packet and a stored severity packet to form a new severity packet; and if the higher-level correlation server is not the top level of the hierarchy of correlation servers, propagating the new delta packet to a higher-level correlation server.