Monitoring a message associated with an action
View Patent ↗The invention relates to a method for monitoring at least one message, each message being associated with an action generated by at least one element or user of an information system ( 1000 ), said message(s) being collected by at least one message collecting device of the IS. According to the invention, the method comprises the step of defining a plurality of reference event categories each associated with at least one reference action from an ontology based on an intention class that characterizes the purpose of each reference action, an activity type class that qualifies the nature of each reference action, a movement class that characterizes the means for implementing each reference action, a target class that characterizes the object of each reference action, and a gain class that characterizes the result of each reference action.
1. A method executed by a computer, the method comprising:
defining a plurality of reference event categories each associated with at least one reference action from an ontology based on:
an intention class representing a purpose of each reference action,
an activity type class representing a nature of each reference action,
a movement class representing an implementation of each reference action,
a target class representing an object of each reference action, and
a gain class representing result of each reference action, wherein the ontology is operable to define each action by meaning of an event such that, based on linguistic rules associated with each reference action, the action belongs to no more than one reference event category; and
for each given message,
disassembling the given message in a database defined by the intention class, the activity type class, the movement class, the target class and the gain class;
comparing the disassembled message with at least one reference event category; and
generating at least one standardised event representing a correspondence between the disassembled message and the reference event category, wherein:
each of the linguistic rules corresponds to a type of reference action that is represented in different fields of messages when the messages are generated from different log-generating systems;
each of the linguistic rules associates the type of reference action with a predicted result of the reference action;
the meaning of the event is defined based at least in part on the type of reference action and the predicted result; and
the standardised event is operable to represent the given message by meaning regardless of differences in arrangements of fields between the message and other messages having the same meaning.
2. The method of claim 1 , comprising, when the disassembled message corresponds to a reference event category:
verifying that the reference event category is not already present in a first storage device; and
upon a positive verification, storing the reference event category in the first storage device.
3. The method of claim 2 , comprising storing the message in a second storage device.
4. The method of claim 1 , wherein defining the plurality of reference event categories comprises defining each reference category based on at least one of a syntactic rule, a lexical rule, or a semantic rule.
5. The method of claim 1 , comprising:
counting a number of disassembled messages corresponding to each reference event category.
6. The method of claim 1 , wherein the intention class comprises at least one of:
an intention of discovering at least one datum on at least one target of an information system;
an intention of collecting at least one datum on at least one target of an information system;
an intention of accessing an information system using at least one authentication procedure that employs at least one identification datum;
an intention of accessing at least one resource of an information system using at least one rights-requiring procedure; or
an intention of accessing an availability setting of at least one resource of an information system.
7. The method of claim 1 , wherein the movement class comprises at least one of:
a movement related to at least one action that does not affect a configuration of an information system;
a movement related to at least one action that does affect a configuration of an information system;
a movement related to at least one attack;
a movement related to at least one malicious software item operable to harm an information system;
a movement related to at least one suspect action detected by at least one action detector probe of an information system;
a movement related to at least one vulnerability of an information system; or
a movement reflecting an observed state of an information system.
8. The method of claim 7 , wherein the gain class comprises at least one of:
corresponding to the movement related to the at least one action that does affect the configuration of the information system or the movement related to the at least one action that does not affect the configuration of the information system: a success, a failure, a denial, or an error;
corresponding to the movement related to at least one attack, the movement related to the at least one malicious software item, the movement related to at least one vulnerability, or the movement related to at least one suspect action: a detection; or
corresponding to the movement reflecting the observed state of the IS:
a gain from intentions corresponding to at least one movement reflecting at least one action of at least one target of the information system; or
a gain from intentions corresponding to at least one movement reflecting at least one use of at least one threshold with respect to at least one target of the information system.
9. The method of claim 8 , wherein the gain from intentions corresponding to movements reflecting actions of targets of the information system comprises:
a valid state subsequent to at least one control;
an invalid state subsequent to at least one control;
a notification about at least one target subsequent to at least one control.
10. The method of claim 8 , wherein the gain from intentions corresponding to movements reflecting the at least one use of at least one threshold comprises at least one of:
exceeding at least one time threshold;
exceeding at least one threshold unrelated to time;
low usage of at least one threshold;
normal usage of at least one threshold; or
high usage of at least one threshold.
11. A computer program product configured to cause a computer to perform operations comprising:
defining a plurality of reference event categories each associated with at least one reference action from an ontology based on:
an intention class representing a purpose of each reference action,
an activity type class representing a nature of each reference action,
a movement class representing an implementation of each reference action,
a target class representing an object of each reference action, and
a gain class representing result of each reference action, wherein the ontology is operable to define each action by meaning of an event such that, based on linguistic rules associated with each reference action, the action belongs to no more than one reference event category; and
for each given message,
disassembling the given message in a database defined by the intention class, the activity type class, the movement class, the target class and the gain class;
comparing the disassembled message with at least one reference event category; and
generating at least one standardised event representing a correspondence between the disassembled message and the reference event category, wherein:
each of the linguistic rules corresponds to a type of reference action that is represented in different fields of messages when the messages are generated from different log-generating systems;
each of the linguistic rules associates the type of reference action with a predicted result of the reference action;
the meaning of the event is defined based at least in part on the type of reference action and the predicted result; and
the standardised event is operable to represent the given message by meaning regardless of differences in arrangements of fields between the message and other messages having the same meaning.
12. The computer program product of claim 11 , the operations comprising, when the disassembled message corresponds to a reference event category:
verifying that the reference event category is not already present in a first storage device; and
upon a positive verification, storing the reference event category in the first storage device.
13. The computer program product of claim 12 , the operations comprising storing the message in a second storage device.
14. The computer program product of claim 11 , wherein defining the plurality of reference event categories comprises defining each reference category based on at least one of a syntactic rule, a lexical rule, or a semantic rule.
15. The computer program product of claim 11 , the operations comprising:
counting a number of disassembled messages corresponding to each reference event category.
16. A system comprising:
a computer configured to perform operations comprising:
defining a plurality of reference event categories each associated with at least one reference action from an ontology based on:
an intention class representing a purpose of each reference action,
an activity type class representing a nature of each reference action,
a movement class representing an implementation of each reference action,
a target class representing an object of each reference action, and
a gain class representing result of each reference action, wherein the ontology is operable to define each action by meaning of an event such that, based on linguistic rules associated with each reference action, the action belongs to no more than one reference event category; and
for each given message,
disassembling the given message in a database defined by the intention class, the activity type class, the movement class, the target class and the gain class;
comparing the disassembled message with at least one reference event category; and
generating at least one standardised event representing a correspondence between the disassembled message and the reference event category, wherein:
each of the linguistic rules corresponds to a type of reference action that is represented in different fields of messages when the messages are generated from different log-generating systems;
each of the linguistic rules associates the type of reference action with a predicted result of the reference action;
the meaning of the event is defined based at least in part on the type of reference action and the predicted result; and
the standardised event is operable to represent the given message by meaning regardless of differences in arrangements of fields between the message and other messages having the same meaning.
17. The system of claim 16 , the operations comprising, when the disassembled message corresponds to a reference event category:
verifying that the reference event category is not already present in a first storage device; and
upon a positive verification, storing the reference event category in the first storage device.
18. The system of claim 17 , the operations comprising storing the message in a second storage device.
19. The system of claim 16 , wherein defining the plurality of reference event categories comprises defining each reference category based on at least one of a syntactic rule, a lexical rule, or a semantic rule.