公开(公告)号：DE60308722T2

公开(公告)日：2007-08-16

申请号：DE60308722

申请日：2003-11-28

Applicant: IBM

Inventor： BAFFES THOMAS ,  GILFIX MICHAEL ,  GARRISON MICHAEL ,  HSU ALLAN ,  STADING TYRON JERROD

IPC: G06F1/00 ,  G06F9/30 ,  G06F11/30 ,  G06F11/36 ,  G06F15/00 ,  G06F21/00 ,  H04L12/24 ,  H04L29/06

Abstract: A method and system for managing an intrusion on a computer by graphically representing an intrusion pattern of a known past intrusion, and then comparing the intrusion pattern of the known intrusion with a current intrusion. The intrusion pattern may either be based on intrusion events, which are the effects of the intrusion or activities that provide a signature of the type of intrusion, or the intrusion pattern may be based on hardware topology that is affected by the intrusion. The intrusion pattern is graphically displayed with scripted responses, which in a preferred embodiment are presented in pop-up windows associated with each node in the intrusion pattern. Alternatively, the response to the intrusion may be automatic, based on a pre-determined percentage of common features in the intrusion pattern of the known past intrusion and the current intrusion.

公开(公告)号：DE60308722D1

公开(公告)日：2006-11-09

申请号：DE60308722

申请日：2003-11-28

Applicant: IBM

Inventor： BAFFES THOMAS ,  GILFIX MICHAEL ,  GARRISON MICHAEL ,  HSU ALLAN ,  STADING TYRON JERROD

IPC: G06F1/00 ,  G06F9/30 ,  G06F11/30 ,  G06F11/36 ,  G06F15/00 ,  G06F21/00 ,  H04L12/24 ,  H04L29/06

Abstract: A method and system for managing an intrusion on a computer by graphically representing an intrusion pattern of a known past intrusion, and then comparing the intrusion pattern of the known intrusion with a current intrusion. The intrusion pattern may either be based on intrusion events, which are the effects of the intrusion or activities that provide a signature of the type of intrusion, or the intrusion pattern may be based on hardware topology that is affected by the intrusion. The intrusion pattern is graphically displayed with scripted responses, which in a preferred embodiment are presented in pop-up windows associated with each node in the intrusion pattern. Alternatively, the response to the intrusion may be automatic, based on a pre-determined percentage of common features in the intrusion pattern of the known past intrusion and the current intrusion.