Patent ID: 7237264
Filing Date: 2007-06-26
Classification: H04L

Abstract:
1. A computer-implemented method comprising: identifying a plurality of data signatures relevant to computer security; designating an alert condition value to each data signature based on each data signature itself and contextual information associated with the data signature, each alert condition value comprising a ranked value that is unique to each combination of data signature and contextual information associated with a particular data signature, the contextual information comprising at least one of an application layer data field type used to encapsulate the data signature and an application layer protocol type used to transmit the data signature, the alert condition value indicating a security risk level relative to different data signatures and relative to other identical data signatures associated with different contextual information; creating a table comprising the contextual information, the data signatures, and the alert condition values; detecting a data signature by evaluating communications at an application layer level between a target and a suspect; correlating said data signature with an application layer fingerprint of the target to determine to what extent said target is vulnerable to said data signature; evaluating contextual information related to the data signature by comparing the contextual information and the data signature to the table in order to determine a likelihood that said target is under attack; and assigning an alert condition value to the data signature based on the comparison of the contextual information and data signature to data in the table.