Steelcloud, LLC

Christopher Day

Cem Gurkok

Joseph M Patterson

An information security auditing and incident investigation method can include applying a correlation template to query different audit targets in an enterprise system to provide a complete result set for the query across different audit targets, receiving audit data provided in response to the query and rendering the audit data to produce an audit report. The applying step can include distributing one or more distributed audit and response tools to each of the targets in the enterprise and communicating with the targets in the enterprise to acquire audit data from each of the targets. The receiving step can include organizing the audit data in a hierarchy, and recursively walking the hierarchy as a directed, cyclic graph noting memberships and paths. Finally, the rendering step can include generating a graphical visualization interface, disposing a real-time object browser within the interface, and further disposing a differential report in the interface.

Information security auditing and incident investigation system

An intrusion detection system (IDS). An IDS which has been configured in accordance with the present invention can include a traffic sniffer for extracting network packets from passing network traffic; a traffic parser configured to extract individual data from defined packet fields of the network packets; and, a traffic logger configured to store individual packet fields of the network packets in a database. A vector builder can be configured to generate multi-dimensional vectors from selected features of the stored packet fields. Notably, at least one self-organizing clustering module can be configured to process the multi-dimensional vectors to produce a self-organized map of clusters. Subsequently, an anomaly detector can detect anomalous correlations between individual ones of the clusters in the self-organized map based upon at least one configurable correlation metric. Finally, a classifier can classify detected anomalous correlations as one of an alarm and normal behavior.

Intrusion detection system

The present invention is secure wireless network. The secure wireless network can include multiple receiver nodes coupled to corresponding high-precision clocks. Each of the receiver nodes can be configured to receive wireless frames transmitted both within and outside a secured geographic area covered by the secure wireless network. A master synchronization high-precision clock can be coupled to the corresponding high-precision clocks. Additionally, a position location system can be coupled to the receiver nodes. Specifically, the position location system can be programmed to compute estimated positions for individual ones of wireless nodes transmitting the wireless frames. Finally, access management logic can be coupled to the position location system. More particularly, the access management logic can be configured to manage access to the wireless network by the individual ones of the wireless nodes based upon the computed estimated positions.

Growing community of inventors

Biscayne Park, FL, United States of America

Christopher Day