Method and system for autonomous control and protection of computer systems

1. A management system, comprising:

a plurality of components within the computer system, wherein the computer system comprises a network interface configured to receive network-traffic data;

a plurality of component resource managers, wherein each of the components is controlled by at least one of the plurality of component resource managers;

a plurality of component management interfaces, wherein each of the components communicates with at least one of the controlling component resource managers via one of the component management interfaces;

a monitoring engine within each of the component resource managers in communication with at least one of the components through one of the component management interfaces, wherein the monitoring engine collects monitoring data corresponding to the network-traffic data;

an analysis engine within each of the component resource managers having at least one algorithm responsive to the monitored network-traffic data, wherein the analysis engine classifies network-traffic data communicated through components as one of at least normal and attacking according to an abnormality metric for the network-traffic data, wherein the abnormality metric is based on at least a packet rate, a flow rate, and a number of unsuccessful sessions found in the network-traffic data, and wherein network-traffic data having the abnormality metric in accord with at least one predetermined abnormality distance parameter is classified as attacking; and

at least one runtime manager autonomously controlling operation of the components and the component resource managers, wherein the runtime manager routes the network-traffic data according to the anomalous activity classification.

2. The management system of claim 1 , further comprising a control port within the component management interface communicatively connecting the analysis engine and the monitoring engine with the at least one of the components.

3. The management system of claim 1 , wherein each component is in communication with only one of the plurality of component resource managers.

4. The management system of claim 1 , wherein the analysis engine classifies network-traffic data communicated through components as one of at least of: normal, probable normal, probable attacking, and attacking.

5. A method, comprising:

controlling a plurality of components with a plurality of component resource managers;

communicating between the plurality of components and the plurality of component resource managers using a plurality of component management interfaces;

autonomously controlling operation of the components and the component resource managers with at least one runtime manager;

classifying data communicated through components as one of at least a normal classification and an attacking classification according to an abnormality metric for the data, wherein the abnormality metric is based on at least a packet rate, a flow rate, and a number of unsuccessful sessions found in the data, and wherein data having the abnormality metric in accord with at least one predetermined abnormality distance parameter is classified as attacking; and

routing the data according to the anomalous activity classification.

6. The method of claim 5 , further comprising communicating between one of the components and one of the component resource managers using one of the component management interfaces.

7. The method of claim 5 , further comprising monitoring for anomalous activity using the component management interfaces.

8. The method of claim 5 , wherein the data having the abnormality metric in accord with the at least one predetermined abnormality distance parameter is classified according to at least three distinct classifications.

9. The method of claim 5 , further comprising:

data-mining the component resource managers to collect activity data.

10. The method of claim 5 , further comprising:

data-mining the component resource managers to collect activity data;

compiling the activity data; and

defining anomalous activity classifications according to activity data compilations.

11. The method of claim 8 , wherein the at least three distinct classifications comprise the normal classification, a probable normal classification, a probable attacking classification, and the attacking classification.

12. A management system comprising:

a network interface configured to receive network-traffic data;

computer readable program code for controlling a plurality of components with a plurality of component resource managers;

computer readable program code for communicating between the plurality of components and the plurality of component resource managers using a plurality of component management interfaces;

computer readable program code for autonomously controlling operation of the components and the component resource managers with at least one runtime manager;

computer readable program code for classifying network-traffic data communicated through components as one of at least normal and attacking according to an abnormality metric for the network-traffic data, wherein the abnormality metric is based on at least a packet rate, a flow rate, and a number of unsuccessful sessions found in the network-traffic data, wherein network-traffic data having the abnormality metric in accord with at least one predetermined abnormality distance parameter is classified as attacking; and

computer readable program code for routing the data according to the anomalous activity classification.

13. The management system of claim 12 , further comprising computer readable computer code for monitoring for anomalous activity using the component management interfaces.

14. The management system of claim 12 , further comprising:

computer readable computer code for data-mining the component resource managers to collect activity data.

15. The management system of claim 12 , further comprising:

computer readable computer code for data-mining the component resource managers to collect activity data;

computer readable computer code for compiling the activity data; and

computer readable computer code for defining anomalous activity classifications according to activity data compilations.

16. The management system of claim 12 , wherein the computer readable program code for classifying network-traffic data communicated through components classifies the network-traffic data as one of at least of: normal, probable normal, probable attacking, and attacking.