France Telecom

France Telecom Sa

Hervé Debar

Benjamin Morin

Dominique Assing

Elvis Tombini

This invention concerns a method for processing computer system input data including at least one detection step for a specific word INSTR present among said data. In the method according to the invention, the specific word to be detected represents an instruction necessary for the execution of a program present among said data. Because it focuses detection on the means necessary for the execution of an attack program that thus reveal the presence of said program, the invention can be used to simply and effectively detect different types of attacks.

Generic method for detecting attack programs hidden in data chains

A method of managing alerts issued by intrusion detection sensors () of an information security system () including an alert management system (), each alert being defined by an alert identifier and an alert content. Each of the alerts issued by the intrusion detection sensors () is associated with a description including a conjunction of valued attributes belonging to attribute domains. The valued attributes belonging to each attribute domain are organized into a taxonomic structure defining generalization relationships between said valued attributes, the plurality of attribute domains thus forming a plurality of taxonomic structures. The description of each of said alerts is completed with sets of values induced by the taxonomic structures on the basis of the valued attributes of said alerts to form complete alerts. The complete alerts are stored in a logic file system () to enable them to be consulted.

Method of managing alerts issued by intrusion detection sensors of an information security system

A method of automatically classifying alerts issued by intrusion detection sensors () of an information security system () for producing collated alerts, each alert being defined by a plurality of qualitative attributes (a, . . . , a) belonging to a plurality of attribute domains (A, . . . , An). Attributes belonging to each attribute domain are organized into a hierarchical structure. For each alert issued by the intrusion detection sensors (), a trellis specific to that alert is constructed by generalizing each alert in accordance with each of its attributes and at all the levels of the hierarchical structure. Each specific trellis is iteratively merged into a general trellis. Collated alerts in the general trellis are identified by selecting the alerts that are simultaneously the most pertinent and the most general. The collated alerts are supplied to an output unit () of an alert management system ().

Growing community of inventors

Louvigny, France

Hervé Debar