Emc Corporation

Catherine V Hart

Ari Juels

Nikolaos Triandopoulos

Kevin Bowers

John Jamail

Daniel B Reich

Jeans

Methods and apparatus are provided for secure transmission of alert messages over a message locking channel. An alert message is transmitted from a Security Alerting System indicating a potential compromise of a protected resource by obtaining the alert message from the Security Alerting System; authenticating the alert message using a secret key known by a server, wherein the secret key evolves in a forward-secure manner; storing the authenticated alert message in a buffer; and transmitting the buffer to the server. The alert message is authenticated by digitally signing the alert message or applying a message authentication code and is possibly encrypted using a secret key known by a server, wherein the secret key evolves in a forward-secure manner. The authenticated alert message can be maintained in the buffer after the transmitting step. The buffer optionally has a fixed-size and alert messages can be stored in a round-robin manner, for example, from a random position. The buffer can be encrypted prior to transmission to the server.

Methods and apparatus for secure, stealthy and reliable transmission of alert messages from a security alerting system

A security information and event management (SIEM) system includes a data storage sub-system that stores (1) security data pertaining to security-related events and states of a production computer system, (2) security business objects (SBOs) as an abstraction layer over the security data, and (3) workflows which each include a set of the SBOs organized in a workflow-specific manner. Each SBO represents a security-related aspect of the production system and includes data queries to generate output data pertaining to the security-related aspect. Each workflow embodies a complex multi-step security analysis operation. In operation, security users of the SIEM system execute the workflows including the respective security business objects, resulting in a set of result data which identifies security threats and vulnerabilities of the production computer system. A workflow can provide additional contextualization for detected events, including asset data regarding the configuration of hosts in the data processing system which can be used to generate recommendations for remedial action, such as applying certain software patches to address a threat.

Security information and event management system employing security business objects and workflows

A behavioral security analysis system comprises a computational semantic parser configured to process data associated with a security information and event management (SIEM) system to generate a plurality of logical descriptors, and a learning engine coupled to the computational semantic parser and configured to generate a plurality of behavioral security descriptors based at least in part on at least a subset of the logical descriptors. The behavioral security descriptors are made accessible to an alerting engine of the SIEM system and utilized to generate one or more security alerts. The computational semantic parser may be operative, for example, to syntactically decompose a portion of the data into component elements, to assign lexical meanings and context denotation information to the component elements, and to apply semantic recomposition to generate a given logical descriptor based on a combinatorial tree having a structure determined using the assigned lexical meanings and context denotation information.

Semantically-aware behavioral security analysis system for security information and event management

A processing device comprises a processor coupled to a memory and implements a host-based intrusion detection system configured to permit detection of tampering with at least one software component installed on the processing device. The host-based intrusion detection system comprises a forward-secure logging module configured to record information characterizing a plurality of events occurring in the device in such a manner that modification of the recorded information characterizing the events is indicative of a tampering attack and can be detected by an authority. For example, the recorded information may comprise at least one forward-secure logging record R having entries r. . . rcorresponding to respective ones of the events wherein any erasure or other modification of a particular pre-existing entry rin R by an attacker is detectable by the authority upon inspection of R.

Detection of tampering with software installed on a processing device

There is disclosed techniques for generating alerts in an event management system which comprises event management device and risk assessment device. In one example, a method comprises the following steps. There is received data in an event management device related to events associated with an asset in a network environment. The received data is filtered in order to provide an input to risk assessment device. The filtered data is forwarded to risk assessment device. A score indicative of risk based on filtered data is determined in risk assessment device. The score is forwarded to event management device and received in event management device. A score chart is generated in the event management device. The score chart includes the score and enables the prioritization of threats based on their respective scores.

Growing community of inventors

Burlington, MA, United States of America

Catherine V Hart