Method and apparatus for analyzing system events
An apparatus and an associated method facilitate analysis of events associated with a network system. Event occurrence items are compared with event rules of an event rule set to determine whether the items are potentially significant. If considered to be potentially significant, a scorer assigns a score to the event occurrence item to provide a relative indication of the potential significance of the event occurrence item.
1. An apparatus for facilitating analysis of system events, said apparatus comprising:
a collected-event matcher configured to identify collected system-event items related to network or information security occurring in a computer network that match at least an event rule of an event-rule set; and
a scorer configured to score each system-event item identified by said collected-event matcher with one or more scores using at least a scoring rule of a scoring-rule set, wherein the one or more scores are summed to determine a cumulative score of each scored system-event item that is used to prioritize the system-event items.
2. The apparatus of claim 1 further comprising a data collector configured to collect the system-event items.
3. The apparatus of claim 1 further comprising a normalizer configured to normalize collected system-event items that match the at least the event rule of the event-rule set.
4. The apparatus of claim 3 wherein said scorer is configured to score each system-event item identified by said collected-event matcher, once normalized by said normalizer.
5. The apparatus of claim 1 further including a prioritizer configured to prioritize the system-event items sequentially according to the score associated with each scored system-event item.
6. The apparatus of claim 1 wherein the at least one scoring rule of the scoring-rule set comprises a Bayesian score generated pursuant to pattern matching.
7. The apparatus of claim 1 wherein the event-rule set comprise a set of end rules of a rule group of a plurality of rule groups.
8. The apparatus of claim 7 wherein said collected-event matcher is further configured to select the rule group of the plurality of rule groups that contain the set of end rules comprising the event-rule set.
9. The apparatus of claim 1 wherein the event-rule set comprises a nested set of end rules.
10. The apparatus of claim 1 wherein the event-rule set comprises a trigger and nested set of end rules.
11. A method for facilitating analysis of system events, said method comprising:
identifying collected system-event items related to network or information security occurring in a computer network that match at least an event rule of an event-rule set; and
scoring each system-event item identified during said identifying with one or more scores using at least a scoring rule of a scoring-rule set, wherein the one or more scores are summed to determine a cumulative score of each scored system-event item that is used to prioritize the scored system-event items.
12. The method of claim 11 further comprising collecting the system-event items.
13. The method of claim 11 further comprising normalizing collected system-event items that match the at least the event rule of the event-rule set.
14. The method of claim 11 further comprising prioritizing the scored system-events.
15. The method of claim 14 further comprising displaying indications of the scored system events system-event items, once prioritized during said prioritizing.
16. The method of claim 11 wherein further comprising comparing each system-event item identified during said matching with each scoring rule of the scoring rule set.
17. The method of claim 11 wherein said identifying comprises selecting a rule group of a plurality of rule groups that contain a set of end rules comprising the end-rule set.
18. A method for facilitating analysis of a medical center computer network, said method comprising:
identifying collected computer system event items related to network or information security occurring in the computer network that match at least one computer system event rule of a computer system event rule set; and
scoring each computer system event item identified during said identifying using at least one scoring rule of a scoring rule set, including summing one or more scores respectively based on each at least one scoring rule to determine a total score of each computer system event;
prioritizing the computer system events using the total score; and
analyzing a prioritized list of scored system event items.
19. The apparatus of claim 1 , wherein the system-event items are generated by at least one of an information security device and a firewall.
20. The method of claim 11 , wherein the system-event items are generated by at least one of an information security device and a firewall.