International Business Machines Corporation

Lenovo (singapore) Pte. Ltd.

Trend Micro Inc.

John Joseph McKenna

Jeffrey Scott Bardsley

Charles K Davis, Iii

Nathaniel Wook Kim

Ashley Anderson Brock

Carlos F Villegas

Charles Steven Lingafelt

Robert Barry Sisk

Alison Cohen

John M Thompson

Luciene Costa Nascimento

Jonathan Stephen Beck

Gary Alan Schlachter

A countermeasure for a computer security threat to a computer system is administered by establishing a baseline identification of an operating or application system type and an operating or application system release level for the computer system that is compatible with a Threat Management Vector (TMV). A TMV is then received, including therein a first field that provides identification of at least one operating system type that is affected by a computer security threat, a second field that provides identification of an operating system release level for the operating system type, and a third field that provides identification of a set of possible countermeasures for an operating system type and an operating system release level. Countermeasures that are identified in the TMV are processed if the TMV identifies the operating system type and operating system release level for the computer system as being affected by the computer security threat. The received TMV may be mutated to a format for processing of the countermeasure.

Method for administration of computer security threat countermeasures to a computer system

Computer security threat management information is generated by receiving a notification of a security threat and/or a notification of a test that detects intrusion of a computer security threat. A computer-actionable TMV is generated from the notification that was received. The TMV includes a computer-readable field that provides identification of at least one system type that is effected by the computer security threat, a computer-readable field that provides identification of a release level for a system type, and a computer-readable field that provides identification of the test that detects intrusion of the computer security threat for a system type and a release level, a computer-readable field that provides identification of a method to reverse the intrusion exploit of the computer security threat for a system type and a release level, and a computer-readable field that provides identification of a method to remediate the vulnerability subject to exploit of the computer security threat for a system type and a release level. The TMV is transmitted to target systems for processing by the target systems.

Methods, computer program products and data structures for intrusion detection, intrusion response and vulnerability remediation across target computer systems

The invention relates to the integration of a security operations policy into a threat management vector. In one embodiment, a method according to the invention includes receiving at least one threat management vector (TMV) from a TMV generator, the TMV including a root vulnerability vector, at least one system vector, at least one system level vector, and a countermeasures payload including intrusion detection countermeasures (IDC), intrusion response countermeasures (IRC), and vulnerability remediation countermeasures (VRC); forwarding to the TMDC a TMV including only the root vulnerability vector, the at least one system vector, and the at least one system level vector; propagating the TMV through a hierarchy of policy mediation regions (PMRs), each PMR being operable to refine at least one of the IDC, the IRC, and the VRC; refining at least one of the IDC, the IRC, and the VRC to conform to a security operations policy of the PMR; forwarding the refined TMV to a threat management domain controller (TMDC); recording refinements made by each PMR to each of the IDC, the IRC, and the VRC; transferring the recorded refinements to a threat management control book (TMCB); and marking the refined TMV as having been refined by each PMR making a refinement.

Method of integrating a security operations policy into a threat management vector

Systems, methods and computer program products for administration of computer security threat countermeasures to a computer system

A threat management domain controller is responsive to a computer-actionable threat management vector that includes a first computer-readable field that provides identification of at least one system type that is affected by a computer security threat, a second computer-readable field that provides identification of a release level for the system type and a third computer-readable field that provides identification of a set of possible countermeasures for a system type and release level. The threat management domain controller processes a threat management vector that is received for use by a domain of target computer systems, and transmits the threat management vector that has been processed to at least one of the target computer systems in the domain of target computer systems.

Domain controlling systems, methods and computer program products for administration of computer security threat countermeasures to a domain of target computer systems

An intrusion detection security system (IDSS) guards a server against vandals' attacks such as denial of service, distributed denial of service, and common gateway interface attacks. An incoming source address is compared with the contents of a database of privileged addresses. If the incoming address is present in the database, the IDSS instructs protective equipment such as a firewall or router to allow the incoming message to pass to the web server despite any ongoing attack, thus allowing messages from customers or suppliers, for example, through. Otherwise, the IDSS checks a database of blocked addresses. When the incoming address is absent, the IDSS writes the address to the database of blocked addresses and instructs the protective equipment to block subsequent messages from the incoming address.

Method and apparatus for protecting a web server against vandals attacks without restricting legitimate access

System and method for storing in a generalized format, and representing on a graphical user interface, the topology information for a plurality of logical and physical resources in a heterogeneous computer communications network. Topological data for each network resource is encoded using a collection of record structures having a tabular format and stored in a plurality of topology information element tables which are categorized further as data element tables, relationship element tables and auxiliary element tables. The rows in the tables representing discrete data elements are recursively processed and correlated and presented as a generalized topology display via a user interface.

System and method for generalized network topology representation

The present invention provides in a data processing system storing a plurality of discrete entities, each identified by a single parameter within a monotonic parameter spectrum, resident at an addressable location and locatable by searching a system maintained hierarchical index mapping parameters onto location addresses, a method of compressing the index by the system, which method is interruptable to permit valid searching of the index and executes in a variable length ordered sequence of processing cycles, each comprising a variable length sequence of two part iterations, each iteration comprising the selective performance of each of an ordered fixed sequence of basic operations, wherein each full cycle initially operates on successive index levels in the direction opposite to that in which the index is searched while performing the first part of each iteration and thereafter operates on successive levels in the reverse direction performing the second part of each iteration, parameter relocation at a level being performed by duplicating a parameter at its target location in a first part of the iteration at that level and deleting the original presence of the parameter in the second part of that iteration.

Growing community of inventors

Cary, NC, United States of America

John Joseph McKenna