SG11201601800WA - Event model for correlating system component states - Google Patents

Event model for correlating system component states

Info

Publication number
SG11201601800WA
SG11201601800WA SG11201601800WA SG11201601800WA SG11201601800WA SG 11201601800W A SG11201601800W A SG 11201601800WA SG 11201601800W A SG11201601800W A SG 11201601800WA SG 11201601800W A SG11201601800W A SG 11201601800WA SG 11201601800W A SG11201601800W A SG 11201601800WA
Authority
SG
Singapore
Prior art keywords
system component
event model
component states
correlating system
correlating
Prior art date
Application number
SG11201601800WA
Inventor
Daniel T Martin
David F Diehl
Original Assignee
Crowdstrike Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Crowdstrike Inc filed Critical Crowdstrike Inc
Publication of SG11201601800WA publication Critical patent/SG11201601800WA/en

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3089—Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
    • G06F2201/86—Event-based monitoring
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
    • G06F2201/875—Monitoring of systems including the internet
SG11201601800WA 2013-10-08 2014-09-15 Event model for correlating system component states SG11201601800WA (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US14/048,920 US9477835B2 (en) 2013-10-08 2013-10-08 Event model for correlating system component states
PCT/US2014/055660 WO2015053906A1 (en) 2013-10-08 2014-09-15 Event model for correlating system component states

Publications (1)

Publication Number Publication Date
SG11201601800WA true SG11201601800WA (en) 2016-04-28

Family

ID=52778074

Family Applications (1)

Application Number Title Priority Date Filing Date
SG11201601800WA SG11201601800WA (en) 2013-10-08 2014-09-15 Event model for correlating system component states

Country Status (8)

Country Link
US (1) US9477835B2 (en)
EP (1) EP3055808B1 (en)
JP (1) JP2016533564A (en)
AU (1) AU2014332477A1 (en)
CA (1) CA2923611A1 (en)
IL (1) IL244790A0 (en)
SG (1) SG11201601800WA (en)
WO (1) WO2015053906A1 (en)

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9043903B2 (en) 2012-06-08 2015-05-26 Crowdstrike, Inc. Kernel-level security agent
US9292881B2 (en) 2012-06-29 2016-03-22 Crowdstrike, Inc. Social sharing of security information in a group
US10409980B2 (en) 2012-12-27 2019-09-10 Crowdstrike, Inc. Real-time representation of security-relevant system state
US10289405B2 (en) 2014-03-20 2019-05-14 Crowdstrike, Inc. Integrity assurance and rebootless updating during runtime
US9798882B2 (en) * 2014-06-06 2017-10-24 Crowdstrike, Inc. Real-time model of states of monitored devices
US11924018B2 (en) * 2015-01-27 2024-03-05 Dell Products L.P. System for decomposing events and unstructured data
US10339316B2 (en) 2015-07-28 2019-07-02 Crowdstrike, Inc. Integrity assurance through early loading in the boot phase
WO2017147236A1 (en) 2016-02-23 2017-08-31 Carbon Black, Inc. Cybersecurity systems and techniques
US10320820B2 (en) 2016-03-24 2019-06-11 Carbon Black, Inc. Systems and techniques for guiding a response to a cybersecurity incident
US10243972B2 (en) * 2016-04-11 2019-03-26 Crowdstrike, Inc. Correlation-based detection of exploit activity
US20170339100A1 (en) * 2016-05-18 2017-11-23 Empire Technology Development Llc Device address update based on event occurrences
US10681059B2 (en) 2016-05-25 2020-06-09 CyberOwl Limited Relating to the monitoring of network security
US10242187B1 (en) * 2016-09-14 2019-03-26 Symantec Corporation Systems and methods for providing integrated security management
US10387228B2 (en) 2017-02-21 2019-08-20 Crowdstrike, Inc. Symmetric bridge component for communications between kernel mode and user mode
US10740459B2 (en) 2017-12-28 2020-08-11 Crowdstrike, Inc. Kernel- and user-level cooperative security processing
US10728034B2 (en) * 2018-02-23 2020-07-28 Webroot Inc. Security privilege escalation exploit detection and mitigation
US10333977B1 (en) * 2018-08-23 2019-06-25 Illusive Networks Ltd. Deceiving an attacker who is harvesting credentials
US10951649B2 (en) * 2019-04-09 2021-03-16 Arbor Networks, Inc. Statistical automatic detection of malicious packets in DDoS attacks using an encoding scheme associated with payload content
US10977152B2 (en) * 2019-04-16 2021-04-13 Oracle International Corporation Rule-based continuous diagnosing and alerting from application logs
US11886585B1 (en) * 2019-09-27 2024-01-30 Musarubra Us Llc System and method for identifying and mitigating cyberattacks through malicious position-independent code execution

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6463565B1 (en) 1999-01-05 2002-10-08 Netspeak Corporation Method for designing object-oriented table driven state machines
US7275250B1 (en) * 2001-05-01 2007-09-25 Microsoft Corporation Method and apparatus for correlating events
WO2003015000A1 (en) 2001-08-08 2003-02-20 Trivium Systems Inc. Workflow engine for automating business processes in scalable multiprocessor computer platforms
WO2003100619A1 (en) * 2002-05-28 2003-12-04 Fujitsu Limited Unauthorized access detection apparatus, unauthorized access detection program, and unauthorized access detection method
SE523140C2 (en) 2002-07-02 2004-03-30 Telia Ab Protective device in computer systems designed to protect a file with a security policy in a security policy application system
JP4547861B2 (en) * 2003-03-20 2010-09-22 日本電気株式会社 Unauthorized access prevention system, unauthorized access prevention method, and unauthorized access prevention program
US7668953B1 (en) * 2003-11-13 2010-02-23 Cisco Technology, Inc. Rule-based network management approaches
JP2005222216A (en) * 2004-02-04 2005-08-18 Mitsubishi Electric Corp System audit method and system audit device
US7421546B2 (en) 2004-02-12 2008-09-02 Relaystar Sa/Nv Intelligent state engine system
US7974800B2 (en) * 2006-12-12 2011-07-05 International Business Machines Corporation Method, apparatus, and program for detecting the correlation between repeating events
JP5343854B2 (en) * 2007-09-20 2013-11-13 日本電気株式会社 Security operation management system, security operation management method, and security operation management program
US8631468B2 (en) 2008-11-10 2014-01-14 Samsung Electronics Co., Ltd. Active access monitoring for safer computing environments and systems
KR20100078081A (en) 2008-12-30 2010-07-08 (주) 세인트 시큐리티 System and method for detecting unknown malicious codes by analyzing kernel based system events
US20120137367A1 (en) * 2009-11-06 2012-05-31 Cataphora, Inc. Continuous anomaly detection based on behavior modeling and heterogeneous information analysis
CN101958897B (en) * 2010-09-27 2013-10-09 北京系统工程研究所 Correlation analysis method of security incident and system

Also Published As

Publication number Publication date
IL244790A0 (en) 2016-04-21
EP3055808A4 (en) 2017-04-26
WO2015053906A1 (en) 2015-04-16
EP3055808B1 (en) 2020-08-26
WO2015053906A8 (en) 2015-07-02
CA2923611A1 (en) 2015-04-16
JP2016533564A (en) 2016-10-27
US20150101044A1 (en) 2015-04-09
AU2014332477A1 (en) 2016-03-24
US9477835B2 (en) 2016-10-25
EP3055808A1 (en) 2016-08-17

Similar Documents

Publication Publication Date Title
IL244790A0 (en) Event model for correlating system component states
EP3088128A4 (en) Component supply system
GB2534093B (en) Systems and methods for improved accuracy
EP2948876A4 (en) Invitation-to-bid management system
GB201301576D0 (en) System
EP3007537A4 (en) Nozzle management system
EP2972777A4 (en) Review system
EP3018901A4 (en) Projection system
GB201600625D0 (en) Monitoring systems
EP2963628A4 (en) Monitoring system
HK1213318A1 (en) Monitoring system
EP3070932A4 (en) Projection system
EP2941292A4 (en) Systems for enhancing sleep
GB201316940D0 (en) Tranaction system
GB201301783D0 (en) A fuel system
GB201318240D0 (en) Metering System
EP2967459A4 (en) Blood-donation system
GB2517013B (en) Facing system
GB2515532B (en) Multi-pour nozzle system
PL2824265T3 (en) Fitting system
GB201316429D0 (en) A system and method for co-ordering
GB2522402B (en) A Connection System
ZA201400971B (en) Component for a sprinkler system
GB201315187D0 (en) A face painting system
GB201314394D0 (en) A system