초록 ▼

A system, method and computer program product for automatic response to computer system misuse using active response modules (ARMs). ARMs are tools that allow static intrusion detection system applications the ability to dynamically increase security levels by allowing real-time responses to detecte

A system, method and computer program product for automatic response to computer system misuse using active response modules (ARMs). ARMs are tools that allow static intrusion detection system applications the ability to dynamically increase security levels by allowing real-time responses to detected instances of computer misuse. Several classes of ARMs exist which allow them to interface with several types of network elements found within a computing environment (e.g., firewalls, web servers, Kerberos severs, certificate authorities, etc.). The ARMs, once defined, are deployed in a "plug and play" manner into an existing intrusion detection system within a computing environment. A user (e.g., system administrator) may then configure the ARMs by linking them to specific computer misuses. Upon receipt of an instance of the computer misuse from the intrusion detection system, each ARM linked to the misuse collects pertinent data from the intrusion detection system and invokes a response specified by the ARM class and the collected pertinent data.

대표청구항 ▼

[ What is claimed is:] [1.]1. A method for automatically responding to an instance of computer misuse, comprising the steps of:(1) selecting an active response module (ARM) from a plurality of available ARMs;(2) linking said ARM to a computer misuse;(3) invoking said ARM in response to an instance o

[ What is claimed is:] [1.]1. A method for automatically responding to an instance of computer misuse, comprising the steps of:(1) selecting an active response module (ARM) from a plurality of available ARMs;(2) linking said ARM to a computer misuse;(3) invoking said ARM in response to an instance of said computer misuse;(4) receiving, by said ARM, data pertinent to said instance of said computer misuse; and(5) performing actions, by said ARM, using said data to thereby respond to said instance of said computer misuse.