Source: https://patents.justia.com/patent/8255995
Timestamp: 2019-12-06 18:53:50
Document Index: 593997505

Matched Legal Cases: ['Application No. 60', 'application No. 07776475', 'application No. 07776475', 'application No. 07756155', 'Application No. 07756155', 'application No. 06717493', 'application No. 06717493', 'Application No. 07835909', 'Application No. 07835909']

US Patent for Methods and apparatus providing computer and network security utilizing probabilistic policy reposturing Patent (Patent # 8,255,995 issued August 28, 2012) - Justia Patents Search
Justia Patents Monitoring Or Scanning Of Software Or Data Including Attack PreventionUS Patent for Methods and apparatus providing computer and network security utilizing probabilistic policy reposturing Patent (Patent # 8,255,995)
This application claims benefit under 35 U.S.C. 120 as a continuation of U.S. patent application Ser. No. 11/415,022 filed May 1, 2006, now U.S. Pat. No. 7,882,560 which claims the benefit of U.S. Provisional Application No. 60/751,439 filed on Dec. 16, 2005, the entire contents of which is hereby incorporated by reference for all purposes as if fully set forth herein. The applicants hereby rescind any disclaimer of claim scope in the parent applications or the prosecution history thereof and advise the USPTO that the claims in this application may be broader than any claim in the parent applications.
at a client security agent: initializing probability settings, based on information about known types of security attacks and representing an initial level of a security policy; detecting an occurrence of a key event from a plurality of key events and collecting event data that represent effects caused by the occurrence of the key event; selecting one or more first rules that take into consideration the effects caused by the occurrence of the key event, and applying the one or more first rules to the collected event data to compute one or more event result values; in response to determining that the one or more event result values exceeded one or more corresponding threshold values, modifying the probability settings to increase the level of the security policy above the initial level, applying one or more second rules to the modified probability settings and determining whether a new type of security attack has occurred; wherein the one or more corresponding threshold values represent respective percentages of probabilities that the new type of security attack is occurring;
2. The method of claim 1, wherein the plurality of key events comprises any of:
3. The method of claim 1, wherein applying the one or more first rules comprises assigning a weight to the key event.
4. The method of claim 1, wherein modifying the probability settings comprises creating a Bayesian network model configured to detect a degree of attack, and denying an operation of a plurality of operations based, at least in part, on the modified probability settings.
5. The method of claim 1, wherein detecting the occurrence of the key event comprises observing an order in which the key event occurred with respect to other events in the plurality of key events.
a memory, encoded with one or more sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform:
in response to determining that the one or more event result values exceeded one or more corresponding threshold values, modifying the probability settings to increase the level of the security policy above the initial level, applying one or more second rules to the modified probability settings and determining whether a new type of security attack has occurred;
wherein the one or more corresponding threshold values represent respective percentages of probabilities that the new type of security attack is occurring.
7. The apparatus of claim 6, wherein the plurality of key events comprises any of:
8. The apparatus of claim 6, wherein the memory is further encoded with instructions, which when executed, cause the one or more processors to perform assigning a weight to the key event.
9. The apparatus of claim 6, wherein the memory is further encoded with instructions, which when executed, cause the one or more processors to perform creating a Bayesian network model configured to detect a degree of attack, and denying an operation of a plurality of operations based, at least in part, on the modified probability settings.
10. The apparatus of claim 6, wherein the memory is further encoded with instructions, which when executed, cause the one or more processors to perform observing an order in which the key event occurred with respect to other events in the plurality of key events.
11. A non-transitory computer readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform:
wherein the one or more corresponding threshold values represent percentages of probabilities that the new type of security attack is occurring.
12. The non-transitory computer readable storage medium of claim 11, wherein the plurality of key events comprises any of:
13. The non-transitory computer readable storage medium of claim 11, further comprising instructions, which when executed, cause assigning a weight to the key event.
14. The non-transitory computer readable storage medium of claim 11, further comprising instructions, which when executed, cause creating a Bayesian network model configured to detect a degree of attack, and denying an operation of a plurality of operations based, at least in part, on the modified probability settings.
15. The non-transitory computer readable storage medium of claim 11, further comprising instructions, which when executed, cause observing an order in which the key event occurred with respect to other events in the plurality of key events.
6542993 April 1, 2003 Erfani
6898715 May 24, 2005 Smithson et al.
6963983 November 8, 2005 Munson et al.
7007302 February 28, 2006 Jagger et al.
7069583 June 27, 2006 Yann et al.
7203962 April 10, 2007 Moran
7263718 August 28, 2007 O'Brien et al.
7363515 April 22, 2008 Frazier et al.
7380267 May 27, 2008 Arai et al.
7401360 July 15, 2008 Ravishankar et al.
7516478 April 7, 2009 Limont et al.
7546629 June 9, 2009 Albert et al.
7555776 June 30, 2009 Lymer et al.
7565426 July 21, 2009 Jones et al.
7715315 May 11, 2010 Ferguson et al.
7716716 May 11, 2010 Boystun
7872975 January 18, 2011 Kruse et al.
7882560 February 1, 2011 Kraemer et al.
7965717 June 21, 2011 Mistry et al.
7979889 July 12, 2011 Gladstone et al.
8004980 August 23, 2011 Ferguson et al.
20020078049 June 20, 2002 Samar
20020078368 June 20, 2002 Yann et al.
20030027551 February 6, 2003 Rockwell
20040064737 April 1, 2004 Milliken et al.
20040073617 April 15, 2004 Milliken et al.
20040205474 October 14, 2004 Eskin et al.
20050076227 April 7, 2005 Kang et al.
20050166268 July 28, 2005 Szor
20060041936 February 23, 2006 Anderson et al.
20060064755 March 23, 2006 Azadet et al.
20060070118 March 30, 2006 Munson et al.
20060070128 March 30, 2006 Heimerdinger et al.
20060123482 June 8, 2006 Aaron
20060184682 August 17, 2006 Suchowski et al.
20060191006 August 24, 2006 Satake et al.
20060230453 October 12, 2006 Flynn et al.
20060236408 October 19, 2006 Yan
20070044152 February 22, 2007 Newman et al.
20100242111 September 23, 2010 Kraemer et al.
1 418 484 March 2003 EP
WO 02/14989 February 2002 WO
WO 02/103498 December 2002 WO
WO 03/058451 July 2003 WO
European Patent Office, Office Action, for foreign patent application No. 07776475.1-1245 dated Jun. 14, 2011, 5 pages.
Current claims in European patent application No. 07776475.1-1245, 4 pages, dated Jun. 2011.
Cohen I. et al., “Self Aware Services: Using Bayesian Networks for Detecting Anormalies in Internet-based Services”, dated Dec. 31, 2001, 16 pages.
European Patent Office, Search Report, for foreign patent application No. 07756155.3-2212/20133728, dated May 3, 2011, 9 pages.
Current Claims for Application No. 07756155.3-2212/20133728, dated May 2011, 5 pages.
Klaus Julisch, “Using Root Cause Analysis to Handle Intrusion Detection Alarms”, PhD Thesis, University of Dortmund, Germany (2003).
Seleznyov et al, “HIDSUR: A Hybrid Intrusion Detection System Based on Real-time User Recognition,” pp. 41-45, IEEE, 2000.
Jones et al, “Computer System Intrusion Detection: A Survey,” Feb. 2000, University of Virginia.
Newsome, James, “Dynamic Taint for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”. Report CMU-CS-04-140, Carnegie Mellon University, Published Jul. 2005. Retrieved from the Internet: <URL: http://reports-archive.adm.cs.cmu.edu/anon/2004/CMU-CS-04-140.pdf>.
Patent Cooperation Tready (PCT) International Preliminary Report on Patentability from co-pending PCT International Patent Application No. PCT/US2007/015065, International Filing Date of Jun. 28, 2007, Priority Date Aug. 4, 2006, and entitled “Methods and Apparatus Providing Computer and Network Security Utilizing Probabilistic Signature Generation”,having a date of mailing of the Feb. 19, 2009.
European Patent Office, Search Report, for foreign patent application No. 06717493.8-2212/1834439 PCT/U52006000302 dated Jun. 29, 2011, 7 pages.
Current Claims in application No. 06717493.8-2212/1834439, 5 pages.
European Patent Office, EP International Search Report received in International Application No. 07835909.8 dated Mar. 1, 2012 (11 pages).
Current Claims, Application No. 07835909.8, dated Mar. 2011, (4 pages).
U.S. Appl. No. 11/499,460, filed Aug. 4, 2006, Final Office Action, mailed Apr. 12, 2012.
Patent number: 8255995
Patent Publication Number: 20100242111
Inventors: Jeffrey A. Kraemer (Wellesley, MA), Andrew Zawadowskiy (Nashua, NH)
Application Number: 12/789,339
Current U.S. Class: Monitoring Or Scanning Of Software Or Data Including Attack Prevention (726/22); Intrusion Detection (726/23); Virus Detection (726/24); Vulnerability Assessment (726/25); Prevention Of Unauthorized Use Of Data Including Prevention Of Piracy, Privacy Violations, Or Unauthorized Data Modification (726/26); Data Processing Protection Using Cryptography (713/189); Computer Instruction/address Encryption (713/190); Upgrade/install Encryption (713/191); Usage Protection Of Distributed Data Files (705/51)