Methods and system for determining performance of filters in a computer intrusion prevention detection system
US8321937B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Oct 22, 2008 |
| Grant date | Nov 27, 2012 |
| Priority date | — |
| Expiry date | May 17, 2030 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/577
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
An intrusion prevention/detection system filter (IPS filter) performance evaluation is provided. The performance evaluation is performed at both the security center and at the customer sites to derive a base confidence score and local confidence scores. Existence of new vulnerability is disclosed and its attributes are used in the generation of new IPS filter or updates. The generated IPS filter is first tested to determine its base confidence score from test confidence attributes prior to deploying it to a customer site. A deep security manager and deep security agent, at the customer site, collect local confidence attributes that are used for determining the local confidence score. The local confidence score and the base confidence score are aggregated to form a global confidence score. The local and global confidence scores are then compared to deployment thresholds to determine whether the IPS filter should be deployed in prevention or detection mode or sent back to the security center for improvement.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.