At&t Intellectual Property I, LP

At+t Corp.

Michael Singer

Daniel G Sheleheda

Stephen Roderick

William O'Hern

Daniel F Hurley

Carl Brian Rexroad

James Boxmeyer

Keith Roden

John L Coviello

A method and apparatus for ignoring a duplicated alarm in a communications network are described. In one embodiment, at least one alarm message associated with at least one event is received. A determination of whether the at least one event exists in a database is subsequently made. The at least one event is recorded in the database if the at least one event does not exist in the database. Conversely, the at least one alarm message is suppressed if the at least one event exists in the database.

Method and apparatus for suppressing duplicate alarms

A method and apparatus for suppressing a duplicated alarm in a communications network are described. In one embodiment, at least one alarm message associated with at least one event is received. A determination of whether the at least one event exists in a database is subsequently made. The at least one event is recorded in the database if the at least one event does not exist in the database. Conversely, the at least one alarm message is suppressed if the at least one event exists in the database.

In one embodiment, the present invention is a method and apparatus for distributing network security advisory information. In one embodiment, each user creates a profile describing his or her preferences with regard to the receipt of security advisory information (e.g., types of security advisory information he or she wishes to receive, the channels over which he or she wishes to receive the security advisory information). Incoming security advisory information is then distributed in accordance with the user profiles.

Method and apparatus for distributing network security advisory information

A method and apparatus are disclosed whereby databases containing information related to an IP address are accessed directly from within a threat management software tool. When an alert is generated, an element within that alert, such as an IP address, is linked to one or more databases internal to an organization containing information related to the location or identity of a user or computer at a particular IP address. If no matches for that element are found in internal databases, a search of a registry of IP addresses is conducted. Finally, if the searches of internal and external databases are inadequate, an active scan of the device at that particular IP address or a router associated with that IP address is conducted. In this way, information related to a security threat is easily and efficiently obtained to enable a security analyst to better isolate that threat.

Method and apparatus for integrated network security alert information retrieval

A method and apparatus for detecting an anomalous activity in a communications network is described. In one example, short-term event data is received from a plurality of servers. An event detection rule is then executed to process the short-term event data over a predefined time period. Afterwards, at least one alarm message is generated in response to detecting the anomalous activity in accordance with at least one predefined long-term security data mining program. In response, the at least one alarm message is provided to at least one of the plurality of servers.

Method and apparatus for detecting anomalous network activities

A method and apparatus for generating a reconnaissance index for a communications network is described. In one embodiment, scan detection data is initially received. A number of scan flows and a number of unique source Internet protocol (SIP) addresses initiating said number of scan flows is then identified from said scan detection data. Afterwards, a reconnaissance index is generated by utilizing said number of scan flows and said number of unique SIP addresses.

Growing community of inventors

Basking Ridge, NJ, United States of America

Michael Singer