Source: http://www.google.com/patents/US7895649?dq=5083039
Timestamp: 2017-11-21 07:07:18
Document Index: 647021703

Matched Legal Cases: ['§1', '§1', '§1', '§1', '§1', '§1', '§1', '§1', '§1', '§1', '§1']

Patent US7895649 - Dynamic rule generation for an enterprise intrusion detection system - Google Patents
A method for dynamically generating rules for an enterprise intrusion detection system comprises receiving a packet flow from a sensor. The packet flow is dynamically processed to detect if the packet flow represents an attack on the enterprise system. A response message is automatically generated in...http://www.google.com/patents/US7895649?utm_source=gb-gplus-sharePatent US7895649 - Dynamic rule generation for an enterprise intrusion detection system
Publication number US7895649 B1
Application number US 10/407,700
Publication number 10407700, 407700, US 7895649 B1, US 7895649B1, US-B1-7895649, US7895649 B1, US7895649B1
Inventors Jon-Michael C. Brook, Matthew C. Rixon, Randall S. Brooks, Troy Dean Rockwood
Patent Citations (83), Non-Patent Citations (103), Referenced by (48), Classifications (23), Legal Events (6)
US 7895649 B1
US7369565 * Jul 17, 2003 May 6, 2008 Samsung Electronics Co., Ltd. Wireless communication system and method using the same
US7593911 * Oct 12, 2005 Sep 22, 2009 At&T Corp. System and method for applying rule sets and rule interactions
US7752017 * Mar 24, 2006 Jul 6, 2010 Moca Systems, Inc. System and method for simulating resource allocation
US20010011211 * Jun 3, 1998 Aug 2, 2001 Sbc Technology Resources, Inc. A method for categorizing, describing and modeling types of system users
US20020059164 Dec 8, 1999 May 16, 2002 Yuri Shtivelman Method and apparatus for auto-assisting agents in agent-hosted communications sessions
US20040133543 Jul 28, 2003 Jul 8, 2004 Shlaes Marc J. Method and system of unifying data
US20050222996 Mar 30, 2004 Oct 6, 2005 Oracle International Corporation Managing event-condition-action rules in a database system
1 A. Arnold, "Kernel Based Anomaly Detection," Intrusion Detection Systems, Machine Learning Group, Columbia University, 2 pages, Apr. 26, 2001.
2 Adrian K. Rantilla, et al.; Aggregation of Expert Opinions; Proceedings of the 32nd Hawaii International Conference on System Sciences; IEEE; 0-7695-0001-3/99; pp. 1-11, 1999.
3 Alistair G. Sutcliffe, et al.; Supporting Scenario-Based Requirements Engineering; IEEE Transactions on Software Engineering; vol. 24, No. 12; pp. 1072-1088, Dec. 1998.
4 Allen Gersho, et al., entitled "Vector Quantization and Signal Compression," Academic Publisher, 737 pages, 1992.
5 Andrew Hamilton-Wright, et al.; Constructing a Fuzzy Rule Based Classification System Using Pattern Discovery; NAFIPS 2005-2005 Annual Meeting of the North American Fuzzy Information Processing Society; pp. 460-465, 2005.
6 Andrew Hamilton-Wright, et al.; Constructing a Fuzzy Rule Based Classification System Using Pattern Discovery; NAFIPS 2005—2005 Annual Meeting of the North American Fuzzy Information Processing Society; pp. 460-465, 2005.
7 Azizi Ab Aziz, et al.; Development of an Adaptive Business Insolvency Classifier Prototype (AVICENA) Using Hybrid Intelligent Algorithms; Proceedings Globalizing Research and Development in Electrical and Electronics Engineering; 5 pages, Jul. 2002.
8 B. Yocom, K. Brown, and D. Van Derveer, "Intrusion Detection Products Grow Up," Network World, 12 pages, Oct. 2001.
9 C. Boeckman, "Getting Closer to Policy-Based Intrusion Detection." Information Security Bulletin, pp. 13-20, May 2000.
10 Cisco Systems, Inc., "NetRanger User Guide 2.2.1," Chapters 1-9 and Appendices A-C, 2000.
11 Commonwealth of Australia, "Handbook 13, Intrusion Detection and Audit Analysis v. 1.0," Australian Communications-Electronic Security Instruction 33 (ACSI 33).
12 D. Curry, and H. Debar, "Intrusion Detection Message Exchange Format Data Model and Extensible Markup Language (XML) Document Type Definition," Intrusion Detection Working Group, 116 pages, Jan. 2003.
13 F. Girault, et al.; Linear Logic as a Tool for Reasoning on a Petri Net Model; IEEE Symposium on Emerging Technologies and Factory Automation; 11 pages, Oct. 1995.
14 F. Wang, F. Gong, C. Sargor, K. Goseva-Popstojanova, K. Trivedi and F. Jou, "SITAR: A Scalable intrusion-Tolerant Architecture for Distributed Services," IEEE Workshop on Information Assurance and Security, pp. 38-45, Jun. 2001.
15 F. Y. Nakamoto, et al.; Systematization of the Project of the Production System Control; IEEE International Symposium on Industrial Electronics; 8 pages, Jun. 2003.
16 Henry S. Teng, et al.; Adaptive Real-Time Anomaly Detection Using Inductively Generated Sequential Patterns; IEEE; CH2884-5/90/0000/0278; pp. 278-284, 1990.
17 Henry S. Teng, et al.; Security Audit Trail Analysis Using Iductively Generated Predictive Rules; IEEE; CH2842-3/90/0000/0024; pp. 24-29, 1990.
18 Henry S. Vaccaro; Detection of Anomalous Computer Session Activity; IEEE Symposium on Research in Security and Privacy; 24 pages, May 1989.
19 Ian Ho, et al.; Generating Test Cases for Real-Time Software by Time Petri Nets Model; Proceedings Eighth Asian Test Symposium; 7 pages, Nov. 1999.
20 IEEE Xplore Release 2.5 Search Results; 4 pages, Retrieved Jan. 6, 2009.
21 Ilham Benyahia, et al.; An Adaptive Framework for Distributed Complex Applications Development; Proceedings 34th International Conference on Technology of Object-Oriented Languages and Systems; 12 pages, Jul. 2000.
22 Intrusion.com, Inc., "Network Intrusion Detection System Product Overview," SecureNet Series, 6 pages, Jul. 2001.
23 ISS Corporation, "ISS RealSecure © Protection System," 5 pages Apr. 1, 2003.
24 J. Li and G. Eschelbeck, "Multi-Tier Intrusion Detection System," 11 pages.
25 Keith C. C. Chan, et al.; Learning Sequential Patterns for Probabilistic Inductive Prediction; IEEE Transactions on Systems, Man, and Cybernetics; vol. 24, No. 10; 16 pages, Oct. 1994.
26 Liu et al., "incremental Maintenance of Nested Relational Views," Database Engineering and Applications, 1999, 9 pages, Aug. 2-4, 1999.
27 Loganathan Lingappan, et al.; Test Generation for Non-Separable RTL Controller-Datapath Circuits Using a Satisfiability Based Approach; Proceedings of the 21st International Conference on Computer Design; 7 pages, 2003.
28 Moataz A. Ahmed, et al.; Rule-Based Information Distribution Systems: Near-Optimal Rule Sets Generation; IEEE; 0-7803-4778-1; pp. 1564-1569, 1998.
29 N. Hari Narayanan, et al.; A Methodology for Knowledge Acquisition and Reasoning in Failure Analysis of Systems; IEEE Transactions on Systems, Man and Cybernetics; vol. SMC-17, No. 2; pp. 274-288, 1987.
30 Nicholas Pioch, et al.; CADRE: Continuous Analysis and Discovery From Relational Evidence; International Conference on Integration of Knowledge Intensive Multi-Agent Systems; 9 pages, Sep. 2003.
31 Noel et al., "Correlating Intrusion Events and Building Attack Scenarios Through Attack Graph Distances", 2004, Computer Security Applications Conferences, 2004, 20th Annual, 10 pages, 2004.
32 P. Lang, et al.; A Graphical Editor for the Conceptual Design of Business Rules; 1 page, Feb. 1998.
33 P. Nassery, et al.; Real Time Seismic Signal Processing Using the ARMA Model Coefficients and an Intelligent Monitoring System; IEEE TENCON-Speech and Image Technologies for Computing and Telecommunications; pp. 807-810, 1997.
34 P. Nassery, et al.; Real Time Seismic Signal Processing Using the ARMA Model Coefficients and an Intelligent Monitoring System; IEEE TENCON—Speech and Image Technologies for Computing and Telecommunications; pp. 807-810, 1997.
35 Patent Pending U.S. Appl. 10/407,030 entitled Graphical User Interface for an Enterprise Intrusion Detection System in the name of Jon-Michael C. Brook; 41 total pages, filed Apr. 4, 2003.
36 Patent Pending U.S. Appl. No. 10/407,513 entitled Vertically Extensible Intrusion Detection Systems and Method in the name of Jon-Michael C. Brook; 51 total pages, filed Apr. 4, 2003.
37 Patent Pending U.S. Appl. No. 11/176,436 entitled System and Method for Active Data Collection in a Network Security System in the name of Troy D. Rockwood; 25 total pages, filed Jul. 6, 2005.
38 Patent Pending U.S. Appl. No. 11/219,025 entitled System and Method for Interactive Correlation Rule Design in a Network Security System in the name of Troy D. Rockwood; 35 total pages, filed Sep. 1, 2005.
39 Patent Pending U.S. Appl. No. 11/219,291 entitled System and Method for Collaborative Information Security Correlation in Low Bandwidth Environments in the name of Troy D. Rockwood; 51 total pages, filed Sep. 1, 2005.
40 Patent Pending U.S. Appl. No. 11/219,595 entitled System and Method for Intruder Tracking Using Advanced Correlation in a Network Security System in the name of Troy D. Rockwood; 50 total pages, filed Sep. 1, 2005.
41 Patent Pending U.S. Appl. No. 11/328,689 entitled System and Method for Attacker Attribution in a Network Security System in the name of Troy Dean Rockwood; 51 total pages, filed Jan. 10, 2006.
42 Patent Pending U.S. Appl. No. 11/559,786, entitle "Compressing N-Dimensional Data", inventors Qin Jiang, et al., 31 pages plus 3 pages of drawings, filed Nov. 14, 2006.
43 Peng Ning, et al.; Techniques and Tools for Analyzing Intrusion Alerts; ACM Transactions on Information and System Security; vol. 7, No. 2; 45 pages, May 2004.
44 Phung, "Data Mining in Intrusion Detection," Sans.org, 3 pages, Jan. 24, 2000.
45 Ping-Peng Yuan, et al.; An Event and Service Interacting Model and Event Detection Based on the Broker/Service Model; pp. 20-24, Jul. 2001.
46 Qin Jian, USPTO, Office Action for U.S. Appl. No. 11/559,786, filed Nov. 14, 2006, mailed Aug. 10, 2009.
47 R. Bace and P. Mell, "NIST Special Publication on Intrusion Detection Systems," 51 pages, Feb. 2001.
48 R. Power, "CSI Roundtable: Experts discuss present and future intrusion detection systems," Computer Security Journal vol. XIV, #1, 2001.
49 R. Raghudharan, "Intrusion detection Systems: Beyond the first line of defense," Network Magazine, 7 pages, Sep. 2001.
53 Rockwood, "Response Pursuant to 37 C.F.R. §1.111," U.S. Appl. No. 11/219,025, 11 pages, filed with USPTO Oct. 22, 2009.
54 Rockwood, "Response Pursuant to 37 C.F.R. §1.111," U.S. Appl. No. 11/219,025, 13 pages, filed with USPTO Apr. 5, 2010.
55 Rockwood, "Response Pursuant to 37 C.F.R. §1.111," U.S. Appl. No. 11/219,025, 16 pages, filed with USPTO Apr. 14, 2009.
56 Rockwood, "Response Pursuant to 37 C.F.R. §1.111," U.S. Appl. No. 11/219,291, 13 pages, filed with USPTO Mar. 11, 2010.
57 Rockwood, "Response Pursuant to 37 C.F.R. §1.111," U.S. Appl. No. 11/219,291, 14 pages, filed with USPTO Aug. 20, 2009.
58 Rockwood, "Response Pursuant to 37 C.F.R. §1.111," U.S. Appl. No. 11/328,689, 15 pages, filed with USPTO Jun. 19, 2009.
59 Rockwood, "Response Pursuant to 37 C.F.R. §1.111," U.S. Appl. No. 11/559,786, 12 pages, filed with USPTO Nov. 10, 2009.
60 Rockwood, "Response Pursuant to 37 C.F.R. §1.111," U.S. Appl. No. 11/559,786, 13 pages, filed with USPTO Apr. 22, 2010.
61 Rockwood, "Response Pursuant to 37 C.F.R. §1.116," U.S. Appl. No. 11/176,436, 11 pages, filed with USPTO Oct. 7, 2009.
62 Rockwood, "Response Pursuant to 37 C.F.R. §1.116," U.S. Appl. No. 11/219,025, 12 pages, filed with USPTO Nov. 10, 2008.
63 Rockwood, "Response Pursuant to 37 C.F.R. §1.116," U.S. Appl. No. 11/328,689, 15 pages, filed with USPTO Nov. 9, 2009.
64 S. Northcutt, and J. Novak, "Network Intrusion Detection: An Analyst's Handbook," 2nd Ed., 18 pages, Sep. 2000.
65 S.F. Wu, H.C. Chang, F. Jou, F. Wang, F. Gong, C. Sargor, D. Qu and R. Cleaveland, "JiNao: Design and Implementation of a Scalable Intrusion Detection System for the OSPF Routing Protocol," pp. 0-23, Feb. 24, 1999.
66 Sanjoy Dasgupta; Experiments with Random Projection; Proc. 16th Conference Uncertaninty in Artificial intelligence (UAI), 9 pages, 2000.
67 Sheng, Ma, et al.; Event Miner: An Integrated Mining Tool for Scalable Analysis of Event Data; 17 pages, May 21, 2001.
68 Slavica Jonic, et al.; Three Machine Learning Techniques for Automatic Determination of Rules to Control Locomotion; IEEE Transactions on Biomedical Engineering; vol. 46, No. 3; pp. 300-310, Mar. 1999.
69 Stick, "A Potential Denial of Service Against IDS Systems," Internet Security Systems Security Alert, 2 pages, Mar. 2001.
70 Symantec, "Intrusion Detection," 4 pages, 2002.
71 Tae-Sic Yoo, et al.; New Results on Decentralized Supervisory Control of Discrete-Event Systems; 6 pages, Dec. 2000.
72 Troy Dean, USPTO, Office Action for U.S. Appl. No. 11/176,436, filed Jul. 6, 2005, mailed Aug. 7, 2009.
73 Troy Dean, USPTO, Office Action for U.S. Appl. No. 11/328,689, filed Jan. 10, 2006, mailed Sep. 10, 2009.
74 USPTO, Office Action for U.S. Appl. No. 11/219,291, filed Sep. 1, 2005 in the name of Troy Rockwood, 32 pages, Mailed Dec. 11, 2009.
75 USPTO; Advisory Action for U.S. Appl. No. 11/219,025, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 3 pages, Nov. 20, 2008.
76 USPTO; Advisory Action, U.S. Appl. No. 11/328,689, filed Jan. 10, 2006 in the name of Troy Dean Rockwood; 2 pages, Nov. 30, 2009.
77 USPTO; Final Office Action, U.S. Appl. No. 11/219,025, filed Sep. 1, 2005, Inventor Troy Dean Rockwood; May 28, 2010, 13 pages.
78 USPTO; Notice of Allowance and Fee(s) Due for U.S. Appl. No. 10/407,030, filed Apr. 4, 2003 in the name of Jon-Michael C. Brook; 15 pages, Aug. 24, 2007.
79 USPTO; Notice of Allowance and Fee(s) Due for U.S. Appl. No. 10/407,513, filed Apr. 4, 2003 in the name of Jon-Michael C. Brook; 17 pages, Nov. 6, 2007.
80 USPTO; Notice of Allowance and Fee(s) Due for U.S. Appl. No. 11/219,595, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 6 pages, Nov. 7, 2007.
81 USPTO; Office Action for U.S. Appl. No. 10/407,030, filed Apr. 4, 2003 in the name of Jon-Michael C. Brook; 9 pages, Jan. 8, 2007.
82 USPTO; Office Action for U.S. Appl. No. 10/407,513, filed Apr. 4, 2003 in the name of Jon-Michael C. Brook; 12 pages, Mar. 27, 2007.
83 USPTO; Office Action for U.S. Appl. No. 11/176,436, filed Jul. 6, 2005 in the name of Troy Dean Rockwood; 20 pages; Dec. 24, 2009.
84 USPTO; Office Action for U.S. Appl. No. 11/176,436, filed Jul. 6, 2005 in the name of Troy Dean Rockwood; 20 pages; Jun. 3, 2010.
85 USPTO; Office Action for U.S. Appl. No. 11/176,436, filed Jul. 6, 2005 in the name of Troy Dean Rockwood; 29 pages, Feb. 10, 2009.
86 USPTO; Office Action for U.S. Appl. No. 11/219,025, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 11 pages, Mar. 24, 2008.
87 USPTO; Office Action for U.S. Appl. No. 11/219,025, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 12 pages, Jul. 22, 2009.
88 USPTO; Office Action for U.S. Appl. No. 11/219,025, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 12 pages, Sep. 10, 2008.
89 USPTO; Office Action for U.S. Appl. No. 11/219,025, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 16 pages, Jan. 15, 2009.
90 USPTO; Office Action for U.S. Appl. No. 11/219,025, filed Sep. 1, 2005, Inventor Troy Dean Rockwood; 12 pages; Jan. 5, 2010.
91 USPTO; Office Action for U.S. Appl. No. 11/219,291, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 33 pages, Dec. 11, 2008.
92 USPTO; Office Action for U.S. Appl. No. 11/219,291, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 36 pages, May 20, 2009.
93 USPTO; Office Action for U.S. Appl. No. 11/219,595, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 17 pages, Jun. 7, 2007.
94 USPTO; Office Action for U.S. Appl. No. 11/328,689, filed Jan. 10, 2006 in the name of Troy Dean Rockwood; 18 pages, Mar. 19, 2009.
95 USPTO; Office Action for U.S. Appl. No. 11/328,689, filed Jan. 10, 2006, Inventor Troy Dean Rockwood; 25 pages; Feb. 22, 2010.
96 USPTO; Office Action for U.S. Appl. No. 11/559,786, filed Nov. 14, 2006 in the name of Qin Jiang; 22 pages; Jan. 22, 2010.
97 USPTO; Office Action for U.S. Appl. No. 11/559,786, filed Nov. 14, 2006 in the name of Qin Jiang; 24 pages; Jul. 15, 2010.
98 USPTO; Office Action, U.S. Appl. No. 11/219,291, filed Sep. 1, 2005 in the name of Troy Dean Rockwood; 36 pages, Jun. 24, 2010.
99 Virtyt Koshi; Radio Network Planning for Ultra TDD Systems; First International Conference on 3G Mobile Communication Technologies; 7 pages, Mar. 2000.
100 W. E. Brown, et al.; Estimation of Ocean Bottom Scattering Strength Using Discrete Eigenray Matching in Shallow Water; MTS 0-933-957-28-9; pp. 1636-1639, Nov. 2001.
101 W. Jansen, P. Mell, et al., "Mobile Agents in Intrusion Detection and Response." National Institute for Standards and Technology, 12 pages, Jun. 2000.
102 XiaoShu Hang, et al.; A FSA-Based Approach for Mining Sequential Patterns With User-Specified Skeletons; Proceedings of the 4th World Congress on Intelligent Control and Automation; 6 pages, Jun. 2002.
103 Y.F. Jou, F. Gong, C. Sargor, X Wu, S.F. Wu, H.Y. Chang and F. Wang, "Design and implementation of a scalable intrusion detection system for protection of network infrastructure," DARPA Information Survivability Conference and Exposition (DISCEX), 15 pages, Jan. 2000.
US8037532 * Dec 11, 2007 Oct 11, 2011 International Business Machines Corporation Application protection from malicious network traffic
US8356116 * Aug 31, 2009 Jan 15, 2013 Murata Machinery, Ltd. Relay server and relay communication system
US8397284 * Jan 17, 2007 Mar 12, 2013 University Of Maryland Detection of distributed denial of service attacks in autonomous system domains
US8443416 * May 6, 2011 May 14, 2013 Novell, Inc. Techniques for secure channel messaging
US8515881 Mar 11, 2011 Aug 20, 2013 Raytheon Company Multiple hypothesis tracking
US8799189 Mar 11, 2011 Aug 5, 2014 Raytheon Company Multiple hypothesis tracking
US9069955 * Apr 30, 2013 Jun 30, 2015 International Business Machines Corporation File system level data protection during potential security breach
US9118702 * Jul 27, 2011 Aug 25, 2015 Bce Inc. System and method for generating and refining cyber threat intelligence data
US9646155 * Oct 20, 2011 May 9, 2017 Hewlett Packard Enterprise Development Lp Systems and methods for evaluation of events based on a reference baseline according to temporal position in a sequence of events
US20090150996 * Dec 11, 2007 Jun 11, 2009 International Business Machines Corporation Application protection from malicious network traffic
US20120284768 * May 6, 2011 Nov 8, 2012 Jason Allen Sabin Techniques for secure channel messaging
US20120317636 * Aug 28, 2012 Dec 13, 2012 International Business Machines Corporation Management system, management method and management program for managing industrial control system
US20140165140 * Oct 20, 2011 Jun 12, 2014 Anurag Singla Systems and methods for evaluation of events based on a reference baseline according to temporal position in a sequence of events
US20140325616 * Apr 30, 2013 Oct 30, 2014 International Business Machines Corporation File system level data protection during potential security breach
US20160191552 * Nov 24, 2015 Jun 30, 2016 Fujitsu Limited Network monitoring system and method
EP2498470A1 * Dec 20, 2011 Sep 12, 2012 Raytheon Company Multiple hypothesis tracking
EP2498471A1 * Dec 20, 2011 Sep 12, 2012 Raytheon Company Multiple hypothesis tracking
WO2014179805A1 * May 5, 2014 Nov 6, 2014 Webroot Inc. Method and apparatus for providing forensic visibility into systems and networks
U.S. Classification 726/22, 726/23, 726/2, 709/225, 709/236, 713/188, 709/246, 726/26, 713/189, 709/227, 709/224, 726/3
Cooperative Classification H04L63/1441, H04L43/028, H04L43/026, H04L41/22, H04L63/20
European Classification H04L43/02B, H04L63/14D, H04L43/02C, H04L63/20