Differential dependency tracking for attack forensics
US9736173B2 · kind B2 · utility
17Cited by
1References
12Claims
0Family size
Assignee
Inventors
Key dates
| Filing date | Oct 9, 2015 |
| Grant date | Aug 15, 2017 |
| Priority date | — |
| Expiry date | Dec 23, 2035 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L2463/146
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Methods and systems for intrusion attack recovery include monitoring two or more hosts in a network to generate audit logs of system events. One or more dependency graphs (DGraphs) is generated based on the audit logs. A relevancy score for each edge of the DGraphs is determined. Irrelevant events from the DGraphs are pruned to generate a condensed backtracking graph. An origin is located by backtracking from an attack detection point in the condensed backtracking graph.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.