System and method for security information normalization
View Patent ↗A prevention-based network auditing system includes an audit repository storing network information gathered by a plurality of heterogeneous information sources. A semantic normalization module identifies semantic equivalencies in the gathered information, and generates a map listing for each fact gathered by an information source, an equivalent fact or set of facts gathered by each of the other information sources. A network policy is then uniformly applied to the information that is identified as being semantically equivalent.
1. A network auditing method comprising:
retrieving network information gathered by a plurality of heterogeneous information sources;
identifying a network policy to be applied to the retrieved information, utilizing a policy and vulnerability engine;
identifying semantic equivalencies in the information gathered by the plurality of heterogeneous information sources, utilizing the policy and vulnerability engine;
uniformly applying the network policy to the information identified as being semantically equivalent, utilizing the policy and vulnerability engine;
determining compliance with the network policy, utilizing the policy and vulnerability engine; and
making a recommendation for modifying a network feature based on the compliance determination, utilizing the policy and vulnerability engine;
wherein the identifying semantic equivalencies comprises:
identifying a list of facts gathered by each information source;
identifying for each fact on the list one or more equivalent facts gathered by each of the other information sources; and
storing the semantic equivalences;
wherein the recommendation is a list of network policy rules to include in the network policy;
wherein the network policy rules are ranked based on a number of times that a network policy rule was applied, a severity meter set for the network policy rule, and assets that are affected;
wherein an identifier is used for generating the network policy rule independently of a source type.
2. The method of claim 1 , wherein each semantic equivalence is associated with the identifier.
3. The method of claim 2 , wherein the identifier is associated with computer code parsing the information gathered by each heterogeneous information source.
4. The method of claim 1 , wherein the recommendation is a change to the network policy.
5. The method of claim 1 , wherein the recommendation is a task associated with the network feature.
6. A server in a network auditing system, the server comprising:
a data store storing network information gathered by a plurality of heterogeneous information sources;
a semantic normalization module coupled to the data store, the module identifying semantic equivalencies in the information gathered by the plurality of heterogeneous information sources;
means for uniformly applying a network policy to the information identified as being semantically equivalent;
means for determining compliance with the network policy; and
means for making a recommendation for modifying a network feature based on the compliance determination;
wherein the identifying semantic equivalencies comprises:
identifying a list of facts gathered by each information source;
identifying for each fact on the list one or more equivalent facts gathered by each of the other information sources; and
storing the semantic equivalences;
wherein the recommendation is a list of network policy rules to include in the network policy;
wherein the network policy rules are ranked based on a number of times that a network policy rule was applied, a severity meter set for the network policy rule, and assets that are affected;
wherein an identifier is used for generating the network policy rule independently of a source type.
7. The server of claim 6 , wherein each semantic equivalence is associated with the identifier.
8. The server of claim 7 , further comprising means for generating the network policy rule independently of the source type based on the identifier.
9. The server of claim 7 , wherein the identifier is associated with computer code parsing the information gathered by each heterogeneous information source.
10. The server of claim 6 , wherein the recommendation is a change to the network policy.
11. The server of claim 6 , wherein the recommendation is a task associated with the network feature.
12. The method of claim 1 , wherein the information gathered by the plurality of heterogeneous information sources is converted into a machine-processable language format normalized for structure.
13. The method of claim 1 , wherein the plurality of heterogeneous information sources include at least one of a scanner, a camera, and manually entered data.
14. The method of claim 1 , wherein the network policy rules include at least one of the network policy rules to find violations of the network policies; the network policy rules to gather information about a network; the network policy rules to identify compromised hosts; and the network policy rules to identify vulnerabilities in the network.
15. The method of claim 1 , wherein the severity meter quantifies the network policy rule as a severity from a severity range of 1 to 100, and allows the network policy rule to be weighted relative to other network policy rules in the list of network policy rules.
16. The method of claim 1 , wherein the making of the recommendation includes generating a remediation task for the network policy, the remediation task including information indicating the remediation task is for a network policy violation, a name of the network policy or a name of the network policy rule, a severity measure for the network policy rule, an address of a host in which the network policy violation was noted, and a date in which the network policy violation was detected.