Christopher J Holm

US Patent:

7594270, Sep 22, 2009

Filed:

Dec 29, 2005

Appl. No.:

11/321620

Inventors:

Christopher A. Church - Houston TX, US
Mikhail Govshteyn - Houston TX, US
Christopher D. Baker - Pearland TX, US
Christopher D. Holm - Houston TX, US

Assignee:

Alert Logic, Inc. - Houston TX

International Classification:

G08B 23/00

US Classification:

726 23

Abstract:

Embodiments of the invention provide a security expert system (SES) that automates intrusion detection analysis and threat discovery that can use fuzzy logic and forward-chaining inference engines to approximate human reasoning process. Embodiments of the SES can analyze incoming security events and generate a threat rating that indicates the likelihood of an event or a series of events being a threat. In one embodiment, the threat rating is determined based on an attacker rating, a target rating, a valid rating, and, optionally, a negative rating. In one embodiment, the threat rating may be affected by a validation flag. The SES can analyze the criticality of assets and calibrate/recalibrate the severity of an attack accordingly to allow for triage. The asset criticality can have a user-defined value. This ability allows the SES to protect and defend critical network resources in a discriminating and selective manner if necessary (e. g.