IP Library › Granted Patent US 7,523,504

Granted Patent B2

US 7,523,504 · App. 10/909,655 · Granted Apr 21, 2009

Methods, systems and computer program products for evaluating security of a network environment

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 7,523,504
App. No.: 10/909,655
Granted: Apr 21, 2009
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Methods, systems and computer program products are provided for evaluating security of a network environment. Security data associated with an asset in the network environment collected over a first period of time is analyzed to detect security events occurring at a rate above a reference rate. Security data associated with the asset collected over a second period of time, greater than the first period of time, is analyzed to detect security events occurring at a rate below the reference rate. A threat index is generated based on the detected security events.

Claims (156)

1. A computer implemented method for evaluating security of a network environment, the method comprising:

analyzing security data associated with an asset in the network environment collected over a first period of time to detect security events occurring at a rate above a reference rate;

analyzing security data associated with the asset collected over a second period of time, greater than the first period of time, to detect security events occurring at a rate below the reference rate; and

generating a threat index based on the detected security events, wherein generating the threat index comprises:

calculating an event index for the asset based on the security data associated with the asset collected over the second period of time;

calculating an alert index for the asset based on the security data associated with the asset collected over the first period of time; and

combining the event index and the alert index to provide the threat index; and

wherein calculating the event index comprises calculating the event index using the following equation:

Event Index= i Σ(2 i *(number of events with i ))/total number of events,

wherein i comprises a severity index associated with the asset, wherein the number of events comprises a number of events associated with the asset having the severity index i during the second period of time and wherein the total number of events comprises a total number of events for the asset during the second period of time.

2. The method of claim 1 , wherein the first period of time comprises a most recent period of time.

3. The method of claim 2 , further comprising establishing a baseline pattern based on the analyzed security data associated with the asset collected over the first period of time and/or the second period of time.

4. The method of claim 3 , wherein the detected security events are detected based on security data that deviates from the baseline pattern.

5. The method of claim 4 , wherein the baseline pattern comprises a time sequence of events and wherein the security data that deviates comprises at least one event instance that is out of sequence with the time sequence of events.

6. The method of claim 3 , wherein the detected security events are detected based on security data that corresponds to the baseline pattern.

7. The method of claim 6 , wherein the baseline pattern corresponds to a defined pattern that indicates non-compliance with a policy indicating a possible security breach.

8. The method of claim 2 , wherein the detected security events are respectively detected based on a single instance of security data.

9. The method of claim 1 :

wherein analyzing security data associated with an asset in the network environment collected over a first period of time is preceded by obtaining the security data associated with an asset in the network environment collected over the first period of time; and

wherein analyzing security data associated with the asset collected over a second period of time is preceded by obtaining the security data associated with the asset collected over the second period of time.

10. The method of claim 9 , wherein generating a threat index based on the detected security events is followed by providing a notification of the threat index.

11. The method of claim 10 , wherein providing a notification of the threat index comprises generating a chart visually indicating the generated threat index.

12. The method of claim 1 , further comprising assigning a weighting to the event index and the alert index, wherein combining the event index and the alert index comprises combining the event index and the alert index based on the weighting.

13. The method of claim 12 wherein the assigned weighting for the event index is equal to the assigned weighting for the alert index and wherein generating the threat index comprises calculating a sum of the event index and the alert index and dividing the sum by 2.

14. The method of claim 1 , wherein the severity index i comprises a low severity, a medium severity and/or a high severity and wherein the second period of time comprises at least thirty days.

15. The method of claim 14 , wherein calculating the alert index comprises calculating the alert index using the following equation:

Alert Index= i Σ(2 i *(number of alerts))/total number of alerts,

wherein the number of alerts comprises the number of alerts for the asset having a severity index i during the first period of time and wherein the total number of alerts comprises a total number of alerts for all assets in the network during the first period of time.

16. The method of claim 15 , wherein the severity index for the alert index calculation comprises a high severity and wherein the first period of time comprises no more than about the last six hours before the alert index is calculated.

17. A computer implemented method for evaluating security of a network environment, the method comprising:

analyzing security data associated with an asset in the network environment collected over a first period of time to detect security events occurring at a rate above a reference rate;

generating a threat index based on the detected security events;

generating a vulnerability index for the asset based on obtained vulnerability data;

assigning an asset index to the asset based on obtained relative importance level data; and

generating a security index for the asset based on the generated threat index, the generated vulnerability index and the assigned asset index.

18. The method of claim 17 , wherein calculating the vulnerability index comprises calculating the vulnerability index using the following equation:

Vulnerability Index= i Σ(2 i *(number of failed checks))/total number of checks

wherein i comprises a severity index associated with the asset, wherein the number of failed checks comprises the number of the failed checks associated with the asset having the severity index i during a third period of time and wherein the total number of checks comprises a total number of checks run on the asset during the third period of time.

19. The method of claim 18 , wherein the severity index i comprises a low severity, a medium severity and/or a high severity and wherein the third period of time comprises at least three full interrogations of the asset.

20. The method of claim 17 , wherein generating the security index for the asset comprises calculating a product of the generated threat index, the generated vulnerability index and the assigned asset index.

21. The method of claim 17 :

wherein generating a threat index comprises generating a threat index associated with each of a plurality of assets in the network environment;

wherein generating a vulnerability index comprises generating a vulnerability index associated with each of the plurality of assets in the network environment;

wherein assigning an asset index comprises assigning an asset index to each the plurality of assets in the network environment; and

wherein generating a security index comprises generating a security index for each of the plurality of assets in the network environment based on the threat index, the vulnerability index and the asset index associated with respective ones the plurality of assets.

22. The method of claim 21 , further comprising calculating an overall network security index based on the generated security indexes for each of the plurality of assets.

23. The method of claim 22 , wherein calculating the overall network security index comprises obtaining an average of the generated security indexes for each of the plurality of assets in the network environment.

24. The method of claim 21 , further comprising generating a chart visually indicating the security index for ones of the plurality of assets.

25. The method of claim 24 wherein each of the security indexes associated with ones of the plurality of assets has a different associated visual indication and wherein a size of the associated visual indication indicates the security index of ones of the plurality of assets relative to the security index of other ones of the plurality of assets.

26. The method of claim 25 , wherein generating the chart further comprises generating a chart including a visual indication of a historical trend of the security index for ones of the plurality of assets, the historical trend indicating an increase or decrease in the security index of an associated asset based on historical security data associated with ones of the plurality of assets.

27. The method of claim 17 , wherein assigning an asset index further comprises:

providing an initial asset index for the asset;

identifying a change in context for the asset; and

automatically changing the asset index for the asset based on the identified change in context of the asset.

28. A computer system for evaluating security of a network environment, the system comprising:

a first analyzer module configured to analyze security data associated with an asset in the network environment collected over a first period of time to detect security events occurring at a rate above a reference rate;

a second analyzer module configured to analyze security data associated with the asset collected over a second period of time, greater than the first period of time, to detect security events occurring at a rate below the reference rate; and

a security module configured to generate a threat index based on the detected security events, wherein the security module is further configured to:

calculate an event index for the asset based on the security data associated with the asset collected over the second period of time;

calculate an alert index for the asset based on the security data associated with the asset collected over the first period of time; and

combine the event index and the alert index to provide the threat index; and

wherein the security module is further configured to calculate the event index using the following equation:

Event Index= i Σ(2 i *(number of alerts))/total number of events,

29. The system of claim 28 , wherein the first period of time comprises a most recent period of time.

30. The system of claim 29 , wherein the security module is further configured to establish a baseline pattern based on the analyzed security data associated with the asset collected over the first period of time and/or the second period of time.

31. The system of claim 30 , wherein the security module is further configured to detect the detected security events based on security data that deviates from the baseline pattern.

32. The system of claim 31 , wherein the baseline pattern comprises a time sequence of events and wherein the security data that deviates comprises at least one event instance that is out of sequence with the time sequence of events.

33. The system of claim 30 , wherein the security module is further configured to detect the detected security events based on security data that corresponds to the baseline pattern.

34. The system of claim 33 , wherein the baseline pattern corresponds to a defined pattern that indicates non-compliance with a policy indicating a possible security breach.

35. The system of claim 29 , wherein the security module is further configured to respectively detect the detected security events based on a single instance of security data.

36. The system of claim 28 , wherein the security module is further configured to assign a weight to the event index and the alert index and combine the event index and the alert index based on the weighting.

37. The system of claim 28 , wherein the security module is further configured to calculate the alert index using the following equation:

Alert Index= i Σ(2 i *(number of alerts))/total number of alerts,

38. A computer system for evaluating security of a network environment, the system comprising:

a security module configured to generate a threat index based on the detected security events, wherein the security module is further configured to:

generate a vulnerability index for the asset based on obtained vulnerability data;

assign an asset index to the asset based on obtained relative importance level data; and

generate a security index for the asset based on the generated threat index, the generated vulnerability index and the assigned asset index.

39. The system of claim 38 , wherein the security module is further configured to calculate the vulnerability index using the following equation:

Vulnerability Index= i Σ(2 i *(number of failed checks))/total number of checks

40. The system of claim 38 , wherein the security module is further configured to:

generate a threat index for each of a plurality of assets in the network environment;

generate a vulnerability index for each of the plurality of assets in the network environment;

assign an asset index to each of the plurality of assets in the network environment; and

generate a security index for each of the plurality of assets in the network environment based on the threat index, the vulnerability index and the asset index associated with respective ones the plurality of assets.

41. The system of claim 40 , wherein the security module is further configured to calculate an overall network security index based on the generated security indexes for each of the plurality of assets.

42. The system of claim 38 , wherein the security module is further configured to:

provide an initial asset index for the asset;

identify a change in context for the asset; and

automatically change the asset index for the asset based on the identified change in context of the asset.

43. A computer system for evaluating security of a network environment, the system comprising:

means for analyzing security data associated with an asset in the network environment collected over a first period of time to detect security events occurring at a rate above a reference rate;

means for analyzing security data associated with the asset collected over a second period of time, greater than the first period of time, to detect security events occurring at a rate below the reference rate; and

means for generating a threat index based on the detected security events, wherein the means for generating the threat index comprises:

means for calculating an event index for the asset based on the security data associated with the asset collected over the second period of time;

means for calculating an alert index for the asset based on the security data associated with the asset collected over the first period of time; and

means for combining the event index and the alert index to provide the threat index; and

wherein the means for calculating the event index comprises calculating the event index using the following equation:

Event Index= i Σ(2 i *(number of alerts))/total number of events,

44. A computer program product for evaluating security of a network environment, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied in said medium, said computer readable program code comprising:

computer readable program code configured to analyze security data associated with an asset in the network environment collected over a first period of time to detect security events occurring at a rate above a reference rate;

computer readable program code configured to analyze security data associated with the asset collected over a second period of time, greater than the first period of time, to detect security events occurring at a rate below the reference rate; and

computer readable program code configured to generate a threat index based on the detected security events, wherein the computer readable program code configured to generate the threat index further comprises:

computer readable program code configured to calculate an event index for the asset based on the security data associated with the asset collected over the second period of time;

computer readable program code configured to calculate an alert index for the asset based on the security data associated with the asset collected over the first period of time; and

computer readable program code configured to combine the event index and the alert index to provide the threat index; and

wherein the computer readable program code configured to calculate the event index is configured to calculate the event index using the following equation:

Event Index= i Σ(2 i *(number of alerts))/total number of events,

45. The computer program product of claim 44 , wherein the first period of time comprises a most recent period of time.

46. The computer program product of claim 45 , further comprising computer readable program code configured to establish a baseline pattern based on the analyzed security data associated with the asset collected over the first period of time and/or the second period of time.

47. The computer program product of claim 46 , wherein the detected security events are detected based on security data that deviates from the baseline pattern.

48. The computer program product of claim 47 , wherein the baseline pattern comprises a time sequence of events and wherein the security data that deviates comprises at least one event instance that is out of sequence with the time sequence of events.

49. The computer program product of claim 46 , wherein the detected security events are detected based on security data that corresponds to the baseline pattern.

50. The computer program product of claim 49 , wherein the baseline pattern corresponds to a defined pattern that indicates non-compliance with a policy indicating a possible security breach.

51. The method of claim 45 , wherein the detected security events are respectively detected based on a single instance of security data.

52. The computer program product of claim 44 , the computer readable program code configured to generate a threat index further comprises computer readable program code configured to assign a weight to the event index and the alert index and combine the event index and the alert index based on the weighting.

53. The computer program product of claim 44 , wherein the computer readable program code configured to calculate the alert index is configured to calculate the alert index using the following equation:

Alert Index= i Σ(2 i *(number of alerts))/total number of alerts,

54. A computer program product for evaluating security of a network environment, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied in said medium, said computer readable program code comprising:

computer readable program code configured to generate a threat index based on the detected security events;

computer readable program code configured to generate a vulnerability index for the asset based on obtained vulnerability data;

computer readable program code configured to assign an asset index to the asset based on obtained relative importance level data; and

computer readable program code configured to generate a security index for the asset based on the generated threat index, the generated vulnerability index and the assigned asset index.

55. The computer program product of claim 54 , wherein the computer readable program code configured to calculate the vulnerability index is configured to calculate the vulnerability index using the following equation:

Vulnerability Index= i Σ(2 i *(number of failed checks))/total number of checks

56. The computer program product of claim 54 further comprising:

computer readable program code configured to generate a threat index associated each of a plurality of assets in the network environment;

computer readable program code configured to generate a vulnerability index associated each of the plurality of assets in the network environment;

computer readable program code configured to assign an asset index associated with each of the plurality of assets in the network environment; and

computer readable program code configured to generate a security index for each of the plurality of assets in the network environment based on the threat index, the vulnerability index and the asset index associated with respective ones the plurality of assets.

57. The computer program product of claim 56 further comprising computer readable program code configured to calculate an overall network security index based on the generated security indexes for each of the plurality of assets.

58. The computer program product of claim 54 , wherein the computer readable program code configured to assign an asset index further comprises:

computer readable program code configured to provide an initial asset index for the asset;

computer readable program code configured to identify a change in context for the asset; and

computer readable program code configured to automatically change the asset index or the asset based on the identified change in context of the asset.

59. A computer system for evaluating security of a network environment, the system comprising:

means for analyzing security data associated with an asset in the network environment collected over a first period of time to detect security events occurring at a rate above a reference rate;

means for generating a threat index based on the detected security events;

means for generating a vulnerability index for the asset based on obtained vulnerability data;

means for assigning an asset index to the asset based on obtained relative importance level data; and

means for generating a security index for the asset based on the generated threat index, the generated vulnerability index and the assigned asset index.

Assignments (12)

RELEASE OF SECURITY INTEREST REEL/FRAME 035656/0251 Recorded Feb 2, 2023

From: JPMORGAN CHASE BANK, N.A.

To: BORLAND SOFTWARE CORPORATION; ATTACHMATE CORPORATION; NETIQ CORPORATION; MICRO FOCUS (US), INC.; MICRO FOCUS SOFTWARE INC. (F/K/A NOVELL, INC.)

Reel/Frame 062623/0009 →

RELEASE OF SECURITY INTEREST REEL/FRAME 044183/0718 Recorded Feb 2, 2023

From: JPMORGAN CHASE BANK, N.A.

To: MICRO FOCUS LLC (F/K/A ENTIT SOFTWARE LLC); BORLAND SOFTWARE CORPORATION; MICRO FOCUS (US), INC.; SERENA SOFTWARE, INC; ATTACHMATE CORPORATION; MICRO FOCUS SOFTWARE INC. (F/K/A NOVELL, INC.); NETIQ CORPORATION

Reel/Frame 062746/0399 →

CORRECTIVE ASSIGNMENT TO CORRECT THE TO CORRECT TYPO IN APPLICATION NUMBER 10708121 WHICH SHOULD BE 10708021 PREVIOUSLY RECORDED ON REEL 042388 FRAME 0386. ASSIGNOR(S) HEREBY CONFIRMS THE NOTICE OF SUCCESSION OF AGENCY. Recorded Jul 26, 2018

From: BANK OF AMERICA, N.A., AS PRIOR AGENT

To: JPMORGAN CHASE BANK, N.A., AS SUCCESSOR AGENT

Reel/Frame 048793/0832 →

SECURITY INTEREST Recorded Oct 11, 2017

From: ATTACHMATE CORPORATION; BORLAND SOFTWARE CORPORATION; NETIQ CORPORATION; MICRO FOCUS (US), INC.; MICRO FOCUS SOFTWARE, INC.; ENTIT SOFTWARE LLC; ARCSIGHT, LLC; SERENA SOFTWARE, INC.

To: JPMORGAN CHASE BANK, N.A.

Reel/Frame 044183/0718 →

NOTICE OF SUCCESSION OF AGENCY Recorded May 2, 2017

From: BANK OF AMERICA, N.A., AS PRIOR AGENT

To: JPMORGAN CHASE BANK, N.A., AS SUCCESSOR AGENT

Reel/Frame 042388/0386 →

SECURITY INTEREST Recorded May 13, 2015

From: MICRO FOCUS (US), INC.; BORLAND SOFTWARE CORPORATION; ATTACHMATE CORPORATION; NETIQ CORPORATION; NOVELL, INC.

To: BANK OF AMERICA, N.A.

Reel/Frame 035656/0251 →

RELEASE OF SECURITY INTEREST RECORDED AT REEL/FRAME 028253/0127 Recorded Nov 24, 2014

From: CREDIT SUISSE AG