Network intrusion detection with distributed correlation

US8516576B2 · kind B2 · utility

Assignee

• Microsoft Corporation · US

Inventors

• Igal Figlin · Redmond, US
• Arthur Zavalkovsky · Netanya, IL
• Lior Arzi · Givatayim, IL
• Efim Hudis · Bellevue, US
• Jennifer LeMond · Kirkland, US
• Robert Eric Fitzgerald · Herndon, US
• Khaja E. Ahmed · Bellevue, US
• Jeffrey Williams · Ann Arbor, US
• Edward W. Hardy · Seattle, US

Key dates

• Filing date: Jan 13, 2010
• Grant date: Aug 20, 2013
• Expiry date: Jan 13, 2032

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L63/205
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

A network security system employing multiple levels of processing to identify security threats. Multiple host machines may each contain an agent that detects possibilities of security threats based on raw data sensed locally at that host. The hosts may share information obtained from local analysis and each host may use information generated at one or more other hosts, in combination with information generated locally, to identify a security concern, indicating with greater certainty that a security threat exists. Based on security concerns generated by multiple hosts, a security threat may be indicated and protective action may be taken.