Patent ID: 7954158
Filing Date: 2011-05-31
Classification: G06F

Abstract:
1. A method for generating attacker signatures, the method comprising: grouping a plurality of computer system attacks into a plurality of preliminary signatures as a function of a first data of type data, timing information data and origin location data of each of the attacks, each of the preliminary signatures associated with a different value of the first data: storing the preliminary signatures into a signature matrix in a computer hardware storage device by: generating an attacker signature for each row of the matrix as a function of the matrix data in each row and a third data of the type data, the timing information data and the origin location data of the attacks, the third data different from the first data and the second data; and associating each of the attacker signatures with a different attacker; obtaining a type data, a timing information data and an origin location data from an attack on the computer system subsequent to the plurality of attacks, wherein a one of the subsequent attack type data, timing information data and origin location data is a new kind relative to a respective one of the plurality of attacks type data, timing information data and origin location data; revising the preliminary signatures into subsequent preliminary signatures as a function of the new kind of subsequent attack data; revising the signature matrix in the computer hardware storage device by creating another row or column for the new kind of subsequent attack data; populating the revised matrix at each column and row intersection as a function of matching the respective attack data to intersecting row first data and column second data; generating subsequent attacker signatures for each row of the revised matrix as a function of the matrix data in each row and the corresponding third data; and associating each of the subsequent attacker signatures with the respective attacker signatures and the different attackers.