US20040143749A1 - Behavior-based host-based intrusion prevention system - Google Patents

Behavior-based host-based intrusion prevention system Download PDF

Info

Publication number
US20040143749A1
US20040143749A1 US10/345,137 US34513703A US2004143749A1 US 20040143749 A1 US20040143749 A1 US 20040143749A1 US 34513703 A US34513703 A US 34513703A US 2004143749 A1 US2004143749 A1 US 2004143749A1
Authority
US
United States
Prior art keywords
behavior control
behavior
appfire
control description
policy
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US10/345,137
Inventor
Homayoon Tajalli
Jeffrey Graham
Timothy Fraser
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
NortonLifeLock Inc
Original Assignee
Platformlogic Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Platformlogic Inc filed Critical Platformlogic Inc
Priority to US10/345,137 priority Critical patent/US20040143749A1/en
Assigned to PLATFORMLOGIC, INC. reassignment PLATFORMLOGIC, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: FRASER, TIMOTHY J., GRAHAM, JEFFREY J., TAJALLI, HOMAYOON
Priority to PCT/US2004/000736 priority patent/WO2004066112A2/en
Publication of US20040143749A1 publication Critical patent/US20040143749A1/en
Priority to US11/009,704 priority patent/US7657927B2/en
Assigned to SYMANTEC CORPORATION reassignment SYMANTEC CORPORATION MERGER (SEE DOCUMENT FOR DETAILS). Assignors: PLATFORM LOGIC, INC.
Abandoned legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/316User authentication by observing the pattern of computer usage, e.g. typical user behaviour

Definitions

  • the present invention relates to host-based protection, and more particularly, to host-based protection that prevents attacks based on application behavior.
  • Network firewalls 101 provide perimeter defense, ostensibly keeping malicious activity out of the network. This type of defense does not account for damage caused from inside the network. Many studies have shown that internal attacks account for a large percentage of damage. Additionally, network firewalls work by examining network behavior, but even legitimate network traffic can take advantage of application vulnerabilities.
  • Intrusion detection systems (IDS) 102 work by examining various types of system behavior, e.g., network traffic and system logs, looking for patterns that indicate attacks. Typically IDS's 102 define attacks based on signatures of known attacks or on vague notions of “normal” activity. Signature-based systems only protect against attacks seen previously. Definitions of normal activity must be very loose to avoid generating false alarms.
  • IDS Intrusion detection systems
  • Anti-virus scanners 103 examine files or email messages and look for matches to known attack signatures. As with all signature-based products, these scanners 103 cannot deal with a new type of attack until it is known, a new signature is defined and then distributed by the vendor. Anti-virus scanners 103 also cannot detect attacks that are not carried in files or email messages.
  • a method of protecting a system from attack including monitoring processes running on a system, identifying behavior of the processes and attributes of the processes, grouping the processes into process sets based on commonality of attributes, and generating behavior control descriptions for each process set.
  • a method of protecting a system from unauthorized use including decomposing processes running on a system into a plurality of process sets, such that each process set has a corresponding behavior control description, and controlling access to system resources by each process based on a behavior control description for the process set to which the process belongs.
  • a method of protecting a system from unauthorized use including identifying processes running on a system, such that each process has an independent behavior control description and controlling access to system resources by each process based on the behavior control description for the process.
  • FIG. 1 shows conventional perimeter security approaches.
  • FIG. 2 shows how an APPFIRETM application firewall fits into a system security approach.
  • FIG. 3 shows an illustration of a Windows kernel environment and how an APPFIRETM Agent fits within it.
  • FIG. 4 shows a relationship between the various APPFIRETM components.
  • FIG. 5 shows a simple view of a policy in the APPFIRETM Authoring Environment.
  • FIG. 6 shows a graphical view of some deployed APPFIRETM Agents in the APPFIRETM Enterprise Manager.
  • FIGS. 7 A- 7 B show screenshots of the BCD editor in the APPFIRETM Authoring Environment.
  • FIGS. 8 A- 8 B show a graphical view of Process Set relationships in the APPFIRETM Authoring Environment.
  • FIG. 9 shows a source view of a policy in the APPFIRETM Authoring Environment.
  • FIG. 10 shows a screenshot of the Process Set Editor in the APPFIRETM Authoring Environment.
  • FIG. 11 shows a relationship between the agents and the profiler tool.
  • APPFIRETM is an example of an application firewall, described in detail below, that protects critical computing resources from the severe, frequent and costly damage caused by new and unknown attacks and hostile insiders.
  • Three important architectural decisions have a significant impact on the ability of APPFIRETM to meet the requirements for protection, ease of use, scalability, flexibility, and extensibility:
  • APPFIRETM Prevent unknown attacks: APPFIRETM's behavior-based policy philosophy does not depend on knowing the method of attack. It defines appropriate behavior based on the intended use of an application. If the application exhibits inappropriate behavior for any reason, APPFIRETM will prevent it.
  • APPFIRETM's modular policy model allows an administrator to easily view and configure security policies in a series of small manageable tasks.
  • the user interface provides three different views of a policy (simple, graphical, and source) allowing administrators to choose the level of abstraction most appropriate for their purposes at any time. Therefore APPFIRETM meets scalability and ease of use requirements by allowing an administrator to see exactly what a Behavior Control Description (BCD) affects and its relationship to other parts of the policy, without the need to understand all aspects of the policy and system.
  • BCD Behavior Control Description
  • the APPFIRETM management framework is designed to plug into existing management frameworks (i.e., Microsoft Operations Manager and Systems Management Server). This further reduces the learning curve by allowing administrators to continue using management tools they already understand.
  • APPFIRETM's pre-defined BCDs for popular applications and OS's provide true “out of the box” value for novice administrators or organizations that do not want to create or modify policy.
  • the J2EE Application Server architecture allows an enterprise to expand the Management Infrastructure (discussed below) as their needs grow. It allows them to leverage existing resources, such as database or enterprise management frameworks, or use built-in APPFIRETM-provided components.
  • the J2EE Application Server supports clustering and high-availability requirements common in large enterprises.
  • the management user interface allows administrators to easily deal with large numbers of machines by grouping them and applying common policies to entire groups.
  • the modular policy model allows creation of common policy building blocks that can be reused in policies throughout the enterprise.
  • the APPFIRETM application firewall can be implemented as an addition to an operating system or as an integrated part of an operating system. This flexibility increases the number of systems on which the invention can be implemented.
  • the APPFIRETM application firewall allows modular specification of policy information.
  • the policy configuration consists of multiple, independent behavior control descriptions and a set of process binding rules defining which processes are controlled by which behavior control descriptions. By avoiding a single system-wide configuration for all processes, the scope of changes is limited and more complex policies can be created.
  • the modular policy architecture also allows independent development of behavior-based controls for applications. Behavior control descriptions can be developed concurrently by several groups and combined with existing policies in a controlled fashion. This allows software vendors to develop APPFIRETM behavior control descriptions to distribute with their products and know that when they are added to an existing APPFIRETM policy on a customer's system the result will operate correctly. Similarly it allows consulting organizations to develop behavior control descriptions and add them to existing APPFIRETM policies in an understandable fashion.
  • the APPFIRETM application firewall looks at all aspects of a process' behavior. It does not focus on the use of a specific protocol or specific types of resources. It monitors all types of resources, e.g., files, registry, network, URLs, or any other type of resource that may become important for security protection. It can look at single actions, e.g., opening a file or a network connection. It can look at sequences of actions, e.g., attack signatures. It can also maintain state and control actions differently based on that state, e.g., once a network connection is opened, certain files can no longer be written. By not limiting itself to a subset of possible behaviors, the APPFIRETM application firewall becomes suitable for any type of operating system or application.
  • the APPFIRETM Agents accept configuration from a number of trusted sources.
  • a basic implementation accepts policy from an authenticated Management Infrastructure.
  • the Agents can also accept configuration from an application itself, e.g., applications built with NET development tools can contain explicit information about resources they need and don't need. This information can be read and enforced by APPFIRETM Agents.
  • APPFIRETM Agents can also assist operating systems that control application behavior based on licenses, e.g., Microsoft's planned Palladium architecture. Information provided by the operating system can be incorporated into the APPFIRETM policy to strengthen the computing platform available to applications.
  • the APPFIRETM firewall 201 provides an important new security capability. Rather than watching the activity happening around the application as the perimeter security products do, it watches the behavior of the application itself. By watching the behavior of an application, it can spot bad behavior as it happens and prevent it from causing damage. This behavior-based control creates a safe zone of operation around an application. The enterprise regains control of its applications.
  • the APPFIRETM firewall 201 should be used in conjunction with other security products for a defense-in-depth, as illustrated in FIG. 2.
  • the APPFIRETM firewall 201 addresses the weaknesses of existing security products. Its general behavior-based controls are suitable for both servers and workstations, for any operating system, and for any application.
  • the APPFIRETM firewall 201 uses Trusted Operating System concepts. Behavior control mechanisms are added to each target operating system. These mechanisms allow the APPFIRETM firewall 201 to actively monitor any application and ensure compliance with the policy configured by the administrator. Predefined policies and BCDs are available for popular operating systems, e.g., Windows NT/2000/XP, and applications, e.g., MS Exchange, Internet Information Server, MS Outlook and MS Internet Explorer. In addition, the APPFIRETM firewall 201 makes it easy to adapt policies for environmentally unique requirements. The APPFIRETM firewall 201 then allows each application to execute in its own confined domain having access to only the resources that it needs to perform its intended function and nothing more.
  • the behavior controls are implemented at a kernel level and cannot be bypassed by any application, including those that are considered privileged by the host operating system.
  • the APPFIRETM firewall 201 includes a user-friendly BCD editor, scalable remote management and reporting features and the ability to integrate with third-party enterprise management consoles. These capabilities make the APPFIRETM firewall 201 suitable for wide deployment in an enterprise of any size.
  • the initial APPFIRETM firewall 201 release will support Windows Server, Exchange Server and IIS.
  • APPFIRETM is also intended to support Windows Workstation, MS Outlook, MS Internet Explorer and UNIX servers and applications.
  • the APPFIRETM firewall 201 architecture includes the following main components, as shown in FIGS. 3 and 4:
  • APPFIRETM Agent 304 behavior control engine 302 within the Agent 304 monitors applications' use of system resources based on the System Behavior Policy; makes itself non-bypassable; provides an interface to the Management Infrastructure 402 (see FIG. 4).
  • FIG. 3 shows the use of BCDs 305 from the policy to monitor and control how applications use system resources.
  • Management Infrastructure 402 provides central storage for APPFIRETM system data; provides interfaces for managers and Agents to store and retrieve data; supports clustering for additional capacity and redundancy.
  • APPFIRETM Manager controls configuration of APPFIRETM Agents and includes efficient and secure communication channels and advanced customization capability.
  • APPFIRETM System Behavior Policies define the permitted behavior of applications running on the Agents 304 .
  • Policies contain Process Binding Rules 306 that group the applications on the system into process sets and Behavior Control Descriptions 305 that define the permitted behavior of applications in each process set.
  • a policy may contain as few as one process set and one BCD or as many process sets and BCDs as necessary to provide the protection desired.
  • Each of these components is designed to support multiple operating system platforms. The capabilities they provide are general enough to extend to a variety of applications and environments.
  • a common APPFIRETM firewall 201 installation would deploy the Manager 401 on several administrators' workstations, the Management Infrastructure 402 on a dedicated server, and the APPFIRETM Agents 304 on the organization's critical servers.
  • the architecture is extremely flexible in order to support a variety of deployment scenarios:
  • the Management Infrastructure 402 could be split onto two servers, one dedicated to the J2EE Application Server 406 and one to the database 407 . Each of those pieces could be clustered as well, to provide further capacity.
  • the J2EE Application Server 406 portion of the Management Infrastructure 402 could be installed on a dedicated server and configured to use the existing database on a separate system.
  • the J2EE Application Server 406 could be installed on the existing database server.
  • the Management Infrastructure 402 could be installed on the administrator's workstation along with the Manager 401 .
  • the Management Infrastructure 402 could be installed along with the Agent 304 directly on the server being protected.
  • the Manager 401 could also be installed on the server as well as on the administrator's workstation.
  • the Management Infrastructure 402 can be omitted entirely.
  • the Manager 401 and Agent 304 would reside on the single system and use local storage instead of a central Management Infrastructure 402 .
  • a more streamlined deployment would include the Agent 304 only with locally-stored policy and configuration settings. This type of deployment does not include any management user interface. Changes to the policy and configuration settings are made manually, using standard file editing and copying tools.
  • the architecture is designed to support these scenarios and many others.
  • FIG. 4 also shows how external tools 404 can interact with the APPFIRETM firewall 201 to extend the management capabilities. For example:
  • the APPFIRETM firewall 201 may include sophisticated Reporting Tools 404 .
  • the Agents 304 can send their log data to the database 407 in the Management Infrastructure 402 .
  • An organization can also use third-party reporting tools, such as Crystal Reports, to query a central database and generate the desired reports.
  • MOM Microsoft Operations Manager
  • the APPFIRETM Agent 304 lives on every protected system and enforces the behavior controls defined by the administrator.
  • the Agent 304 includes two main components: the generic behavior control engine 302 and the communications module (not shown in FIG. 3, see element 408 in FIG. 4).
  • the behavior control engine 302 monitors the access to and use of critical system resources. It provides a wide variety of controls over these resources, including resource names, access modes requested and time or frequency of access. These controls are flexible enough to describe the acceptable behavior of any application with respect to critical system resources.
  • the behavior control engine 302 watches as applications request and use resources, looking for requests or uses that depart from the acceptable behavior. When the behavior control engine 302 sees such a departure, it takes an appropriate action.
  • the definitions of acceptable behavior are contained in the System Behavior Policy.
  • the behavior control engine 302 simply provides the set of behavior controls available to the APPFIRETM firewall 201 .
  • a policy must be loaded into the behavior control engine 302 to set the controls and begin enforcing correct behavior.
  • the behavior control engine 302 is loaded into an operating system environment kernel 301 (which includes the Windows kernel 303 ) to make it non-bypassable. It captures any attempt by any application to access or use any resource and determines whether the request is acceptable behavior for the application.
  • the policy that protects other critical system resources also protects the behavior control engine 302 to ensure it remains intact and running. Malicious software cannot disable or evade it.
  • the behavior control engine 302 simply enforces behavior.
  • the communication module 408 connects the behavior control engine 302 with the outside world—specifically with the management software. This module 408 is the liaison between the behavior control engine 302 and any systems on the network attempting to manage the Agent 304 .
  • the behavior control engine 302 can be implemented as an addition to an existing operating system, e.g., as a set of loadable drivers and libraries. This implementation allows the behavior control engine 302 to work without access to operating system source code and without significant lag time behind new versions of an operating system.
  • the behavior control engine 302 can also be implemented as an integral part of an operating system. This implementation, with access to operating system source code and otherwise undocumented information, allows a wider set of features for recognizing and controlling application behavior.
  • the communications module 408 listens on the network for management commands from the Management Infrastructure 402 . Before acting on a command, the module 408 authenticates the sender to ensure the commands are coming from a legitimate Management Infrastructure 402 . Once authentication succeeds, the module accepts commands and responds appropriately.
  • the communications module 408 In addition to receiving commands from the Management Infrastructure 402 , the communications module 408 also periodically queries the Management Infrastructure 402 to see if new configuration data is available.
  • the communication module 408 retrieves it from the Management Infrastructure 402 , saves it to disk and passes it to the behavior control engine 302 .
  • the communication module 408 also monitors the local log files, transfers log data to the Management Infrastructure 402 and requests alerts when unusual events occur.
  • Management commands typically provide configuration data for the Agent's use or request data from the Agent 304 . If the command provides new configuration data, the communication module 408 saves the data to disk and passes it to the behavior control engine 302 . If the command requests data, the communication module 408 retrieves the configuration or log data and returns it. It can retrieve data from disk or from the engine 302 .
  • Process Binding Rules 306 are context-sensitive, especially with respect to an application's ancestry, applying a new policy to a running Agent 304 needs to have access to historical process data.
  • the Agent 304 uses this historical data when assigning processes to process sets in the new policy to make sure each existing process' ancestry is taken into account properly.
  • This historical data can be maintained in the behavior control engine 302 itself or it can be exported to the communications module. In the former case, when a new policy is applied, the communications module simply gives it to the behavior control engine 302 and the engine 302 uses its internal historical data to assign processes to the correct process sets in the new policy.
  • the communications module applies the historical data against the new policy and creates a set of process to process set assignments for the new policy. Then the communications module passes the process set assignments and the new policy into the behavior control engine 302 . The engine 302 sets the process sets of all the existing processes and then begins enforcing the new policy.
  • the communication module 408 also includes plug-ins that can talk to third-party management systems, such as BMC's Patrol, Tivoli Policy Manager, CA Unicenter, Check Point Firewall-1 Management Console. If the Agent 304 is being managed from one of these systems rather than from the native APPFIRETM Manager 401 , a plug-in translates the foreign remote management commands.
  • third-party management systems such as BMC's Patrol, Tivoli Policy Manager, CA Unicenter, Check Point Firewall-1 Management Console. If the Agent 304 is being managed from one of these systems rather than from the native APPFIRETM Manager 401 , a plug-in translates the foreign remote management commands.
  • the Management Infrastructure 402 is the central storage point for all APPFIRETM data. It includes:
  • Agent configuration data and Agent groupings
  • the Management Infrastructure 402 includes:
  • the J2EE Application Server 406 provides a platform for building the APPFIRETM management features. Its clustering capabilities allow an organization to expand the Management Infrastructure 402 as necessary to provide additional capacity or redundancy.
  • the Relational Database 407 is the actual data repository for the APPFIRETM data.
  • the Management Infrastructure 402 is database-independent.
  • a simple database can be provided with the J2EE Application Server 406 .
  • Organizations that require more capacity or redundancy can provide a database 407 that meets their needs.
  • the J2EE Application Server 406 can be configured to use an existing database or a database newly installed just to support the APPFIRETM firewall 201 .
  • EJBs Enterprise Java Beans
  • the EJBs implement the APPFIRETM-specific management logic. They provide interfaces to the Agents 304 and the APPFIRETM Manager 401 and all access to the data goes through the EJBs.
  • An alternative Management Infrastructure 402 implementation would use a Microsoft .NET server in place of the J2EE Application Server 406 and use Microsoft NET network applications in place of the EJBs.
  • the Management Infrastructure 402 could also be replaced by the infrastructure of an existing enterprise management product.
  • the specific technology used to implement the Management Infrastructure 402 is not critical, as long as it provides the ability to query and save the AppFire data in a central site.
  • the Management Infrastructure 402 is the intermediary between the Agents 304 and the APPFIRETM Manager 401 . Rather than communicate directly with each other, the APPFIRETM Manager 401 and the Agents 304 exchange data through the Management Infrastructure 402 .
  • the APPFIRETM Manager 401 is the user interface to the APPFIRETM firewall 201 . It retrieves data from the Management Infrastructure 402 and displays it to the administrator. The administrator modifies the data by editing policies or reconfiguring Agents 304 . When the administrator saves the modifications, the APPFIRETM Manager 401 sends the data to the Management Infrastructure 402 . If the data includes changes to Agent configurations, the Management Infrastructure 402 notifies the appropriate Agents 304 that changes have occurred.
  • Each Agent 304 holds a copy of its policy and other configuration settings locally. This allows the Agent 304 to operate without constant contact with the Management Infrastructure 402 . As noted above, the Management Infrastructure 402 notifies each Agent 304 when its configuration changes. At this point, the Agent 304 retrieves its new policy or other configuration data from the infrastructure and puts it in effect. Since notifications can be lost, e.g., when the Agent 304 is off the network for an extended period of time, the Agents 304 also periodically query the Management Infrastructure 402 for changes. This ensures that changes are propagated in a timely fashion.
  • Agents 304 In addition to retrieving configuration data, Agents 304 also send log and alert data to the Management Infrastructure 402 . This allows an organization to collect data from many Agents 304 into a central repository for system-wide reporting and analysis. Agents 304 use the Management Infrastructure 402 to generate alert messages, e.g., email and pages, rather than do it themselves. Normal log data is simply transferred to the Management Infrastructure 402 for storage.
  • the APPFIRETM Manager 401 includes two user interface applications.
  • the Enterprise Manager is used to manage and monitor APPFIRETM Agents 304 . It is the user interface that allows the administrator to configure Agents 304 and view the status of the network.
  • the Authoring Environment is used to create and modify policies and policy components.
  • the term APPFIRETM Manager 401 is used to include both user interface applications. The applications are specifically mentioned when appropriate.
  • the APPFIRETM Manager 401 contains two user interfaces because they perform two very different tasks.
  • the Authoring Environment is used by policy authors who have significant knowledge about operating system resources and behavior, application behavior and APPFIRETM policy concepts. Creating or modifying policy is an infrequent operation.
  • the Enterprise Manager is used by system administrators or operators who may have little knowledge about operating system resources and behavior, application behavior and APPFIRETM policy concepts. In contrast, their job is the day-to-day management of systems protected by APPFIRETM Agents 304 . They use the Enterprise Manager to configure and assign appropriate policies to Agents 304 and to view messages generated by the Agents 304 and stored in the Management Infrastructure 402 .
  • the Enterprise Manager is designed to manage large-scale networks and supports thousands of protected systems. An administrator with very little security experience can configure and deploy policies to individual Agents 304 or to large groups of Agents 304 in a single operation. The Enterprise Manager provides the ability to see the status of an individual Agent 304 or an aggregated view of a group of Agents 304 .
  • the Enterprise Manager may be dealing with thousands of Agents 304 , it only requests or updates data about them when necessary. Communications that involve large numbers of Agents 304 are performed infrequently and kept very lightweight to avoid clogging the network. Requests for large amounts of data are made only when necessary. The Enterprise Manager caches information when it can to avoid extra communication.
  • All management communications are secure.
  • the APPFIRETM Manager 401 authenticates itself to the Management Infrastrucure 402 so it can be certain the APPFIRETM Manager 401 is legitimate.
  • the management commands and data are encrypted and signed for integrity. All communications protocols are based on TCP/IP standards.
  • the APPFIRETM Manager 401 look-and-feel is completely configurable.
  • the APPFIRETM Manager's 401 appearance can be customized to provide a seamless integration with other products or tools they provide. This is especially useful for OEMs and VARs, but could be used for other purposes as well.
  • the APPFIRETM Manager 401 is easily transportable to a variety of operating system platforms.
  • the screen shot in FIG. 6 shows an example of how the Enterprise Manager displays Agents 304 , Agent groupings and policy assignment.
  • the Authoring Environment presents a user-friendly policy editor (see FIGS. 7 A- 8 B) that allows administrators to customize system behavior policies and policy components (BCDs 305 , PBRs 306 , macros, etc) to their particular corporate environment. They can also use the editor to create new policies and components for custom applications. These policies can be saved in a library in the Management Infrastructure 402 for future use.
  • the APPFIRETM firewall 201 's modular policy model enables three different user experiences for the policy author:
  • FIG. 5 A simple high-level view (FIG. 5) that requires very little configuration to implement—a few options to enable or disable based on the organization's need for specific application features. If a feature is not needed, the application does not need access to the corresponding resources. This view is for a novice administrator or organization that does not need to create or modify policy and BCDs.
  • a graphical view (FIGS. 7 A- 8 B) showing process sets, BCDs and their relationship to one another. This view gives the ability to drill down into to a process set or BCD to make changes and more importantly see the effect of changes on overall system wide protection.
  • the graphical view is for the administrator who wants to create new policies or make changes to previously provided BCDs.
  • FIG. 9 A source-level view (FIG. 9) showing the source code policy specification for the super technical administrator.
  • the Simple View offers a limited-choice interface in which administrators answer simple questions in order to secure their systems.
  • the questions are presented in terms of application features and required capabilities of the system, e.g., “Does your server support FTP?” This view does not force the administrator to understand the complexities of our policy designs.
  • a simple view is not required in a policy.
  • the policy author decides whether to create a simple view and uses the tools in the graphical view to create it.
  • the simple view is displayed to administrators when they configure the policy using the Enterprise Manager. This capability allows policy authors to create the user interface for administrators using the policy. Rather than having the policy configuration user interface determined by the vendor, each policy includes the definition of its configuration user interface.
  • the Enterprise Manager reads the simple view data from the policy and constructs the configuration user interface accordingly.
  • FIGS. 7 A- 8 B offer a visual interface to configure every portion of the security policy. This requires the administrator to understand more about how the APPFIRETM firewall 201 works, but in return offers them greater flexibility in securing their systems.
  • This view begins by displaying visual objects that represent BCDs 305 and Process Sets. Connections between the BCDs 305 and Process Sets show their relationships. To associate a BCD 305 with a Process Set, the author can visually draw the connection. Alternatively, the author can open the Process Set editor (FIG. 10) to associate the BCD.
  • FIGS. 7 A- 7 B show the contents of a BCD as viewed in the BCD editor.
  • the Source View (FIG. 9) shows the actual source code for the policy being created. This view not only requires understanding how policies work and how to construct them, but also how to use the source code to specify policy. The Source View would normally only be used by the most advanced policy writers.
  • FIG. 11 illustrates the process of using automated tools to creating a BCD 305 .
  • a plurality of profile files may exist.
  • a plurality of profile files 1101 may exist. These profile files 1101 are used by the profiler 1102 , as discussed below, to create a BCD 305 .
  • the policies are the key component of the APPFIRETM firewall 201 deployment.
  • the Agent 304 provides a behavior control engine 302 but that behavior control engine 302 needs instructions. Those instructions are in the policy.
  • the APPFIRETM Manager 401 provides a way to organize and configure Agents 304 but it needs policies to configure them.
  • a system behavior policy defines a set of applications, i.e., programs, threads, or processes, and the acceptable and unacceptable behaviors for those applications. It also defines the actions to take when unacceptable behavior occurs.
  • the APPFIRETM firewall 201 policies allow a modular approach to policy development and management. Policies contain three components: Behavior Control Descriptions (BCDs) 305 , Process Sets (Psets), and Process Binding Rules 306 (PBRs).
  • the APPFIRETM firewall 201 provides a library of pre-defined policies and policy components (BCDs 305 , PBRs 306 , macros, etc). These include generic policies for each supported operating system, e.g., Windows 2000 Server, generic BCDs that protect critical system resources, as well as more specific BCDs for specific operating system services and popular applications. Initially, the library can include only the most popular applications. Over time, the library can increase. The APPFIRETM Manager 401 can import objects into the library at any time—a new product release is not required.
  • the APPFIRETM firewall 201 policies are specified in an XML-based policy creation and management language, as discussed above, that enables the modular policy development process that is critical to creating policies for complex systems.
  • the main purpose of the APPFIRETM firewall 201 and the policies it enforces is to restrict some or all of the applications running on a system to a limited set of behavior defined as their “normal” behavior. But the APPFIRETM firewall 201 also has to handle the unusual behaviors required to administer a system it protects. Many administrative actions result in dangerous actions that the policy would define as “abnormal” and thus prevent. In some cases, behavior resulting from legitimate administrative changes is indistinguishable from malicious attacks. Therefore, most of the time, the customer will want the policy to prevent such behavior. However, if it is a result of legitimate administration, it should be allowed. So, the system includes a privilege-bracketing mechanism for an administrator to indicate when they are going to perform administrative actions and thus these normally “abnormal” behaviors should be allowed. The mechanism can be implemented in a number of ways, including:
  • Identity-based The policy can define a specific, privileged identity. The administrator logs into the system using the privileged identity when they want to do administration and logs in using a non-privileged identity when performing normal tasks.
  • Gateway program The system can include a special program that the administrator runs to indicate they want to perform administrative tasks.
  • the gateway program can authenticate the administrator to any desired degree, e.g., username and password, cryptographic authentication, biometrics, etc. Once the administrator is authenticated, the gateway program can start privileged programs or notify the behavior control engine to enter an administrative state and thus allow actions that would normally be denied.
  • the core of The APPFIRETM firewall 201 's sophistication is a policy creation and management language that enables a modular approach to policy development and management.
  • the policies include three components:
  • Behavior Control Descriptions (BCDs) 305 are self-contained definitions of behavior for an application or group of applications. BCDs 305 are completely independent, so changes to one BCD 305 cannot affect any other part of the policy.
  • Process Sets are logical groupings of processes within a given host (e.g., Interactive Pset, Administrator Pset, IIS Pset, and Exchange Pset).
  • a Pset is associated with a specific BCD 305 . Since a Pset is always associated with only one BCD 305 , all processes in the Pset are controlled by the same BCD 305 .
  • Process Binding Rules 306 assign processes to process sets.
  • the PBRs 306 create a graph of Process Sets. Changes to PBRs 306 only affect process sets reachable from the point of change in the graph.
  • Modular policy development allows easy modifications. A user can be absolutely sure of the limits to the ramifications of one's changes. A user can concentrate on those areas and make sure the changes are safe. New policy development also becomes easier because the system can be divided and concentrated on a piece at a time. The pieces combine in well-defined ways so one doesn't need to know all the detail of everything when combining them.
  • Some types of global control may require duplicating rules in several BCDs 305 or Process Sets.
  • the macro capability in the policy language minimizes the actual duplication required.
  • An alternative method for sharing definitions between BCDs 305 or Process Sets is to define the policy in an object-oriented fashion. This allows common items to be defined in base classes and individual BCDs 305 or Process Sets to extend these base classes with rules unique to the application to which the BCD or Process Set is targeted.
  • the Rules are order-dependent and the user determines the order.
  • the APPFIRETM Editor may suggest a default ordering that will work in most cases, but the user is free to adjust that ordering if necessary to achieve their goals. Those users who use the Simple View (see FIG. 5) in the user interface (UI) will never see any Rule lists or need to worry about ordering at all.
  • the modular structure allows a developer to break a complex policy development task into smaller manageable tasks.
  • the smaller tasks are largely independent and have well-defined effects on each other.
  • the modularity simplifies modifying existing policies by limiting the amount of knowledge a developer needs about the policy and by clearly defining the ramifications a particular modification might have.
  • Policy components are context-sensitive allowing the same application executed under different circumstances to be controlled differently. The ability to use context information allows creation of more sophisticated system policies thus providing even greater security with more flexibility.
  • the APPFIRETM firewall 201 's modular, context-sensitive, graphical view of policy creation and management means that:
  • New application Psets and BCDs can be added easily to policies without impacting existing policy components.
  • a protection model can grow with the needs of a diverse and large enterprise without becoming unmanageable.
  • New Psets and BCDs can be developed concurrently or sequentially by independent groups and combined into policies with a clear understanding of how the resulting policies will provide protection.
  • a policy can include definitions of well-known attachment points for adding Psets and BCDs developed in the future.
  • the policy author defines these attachment points such that new Psets and BCDs attached to the policy will function correctly.
  • a developer who wants to add a Pset and/or BCD to an existing policy references the attachment point suitable for the new components. For example, if the Pset and BCD are designed to control a custom service, the author could reference the “Service” attachment point. If the Pset and BCD are designed to control an application that can be started in many ways, the author could reference the “System-wide” or “Global” attachment point.
  • the author of the original policy (who defined the attachment points), the author of the new Pset and BCD (who uses an attachment point), and most importantly, the customer know that the resulting policy will work correctly and provide the desired protection. If a customer attempts to attach a Pset or BCD to an attachment point that does not exist in the policy, the attachment will fail.
  • the modular policy architecture allows application vendors to build Psets and BCDs for their applications and distribute them along with the applications.
  • the Pset and BCD can protect the vendor's application from harming other parts of the system and keep other applications on the system from harming it. This provides greater assurance to the customer that the application is safe and makes the vendor's application more attractive.
  • the APPFIRETM firewall 201 provides ways to group applications (“decompose the system”), or more accurately, to group processes running applications. These groupings form the basis for subsequent behavior controls enforced by the system.
  • Process Binding Rules 306 map processes to Process Sets (see screen shot of Process Set editor in FIG. 10). Process Binding Rules 306 are context-sensitive to parentage, so that the same application launched by two different methods might be placed in two different Process Sets.
  • the APPFIRETM Authoring Environment provides a graphical representation of the Process Binding Rules 306 (see FIGS. 8 A- 8 B) to assist the author in understanding the relationships between process sets.
  • Each process belongs to a single Process Set at any point in time.
  • Each Process Set maps to a specific BCD 305 . Thus, the behavior controls applied to a process are completely defined by its Process Set. Process Sets are defined using attributes of a process, including:
  • process identity including both user and group identities
  • a Process Set maps each of its descendants to a Process Set. Often, descendants are mapped to the same process set as the parent. But a Process Set can be defined to include all, some, or none of its descendants. An extreme case would have each descendant placed in its own Process Set.
  • Process Binding Rules 306 can include dynamic criteria as well as the static process attributes listed above. Dynamic rules assign processes to Process Sets based on operations they perform, such as opening particular files or devices. Dynamic criteria can be combined with static criteria in a single Rule.
  • Predefined BCDs 305 and Process Binding Rules 306 may be supplied with the APPFIRETM firewall 201 installation. These can be used as starting points for creating custom policies. All portions of the policy are modifiable by the user.
  • Process Binding Rules 306 can define process sets in terms of the process attributes used on each behavior. So rather than treating all actions of a server process the same, each action can be controlled based on the process set or other attributes of the client application on whose behalf it is being taken.
  • the behavior control engine can obtain client attributes along with the client request, such as the client's process set assignment, from the operating system in an assured manner, it can make decisions about server application actions based on those client attributes. If such attributes are not available or can't be trusted, then the server application has to be controlled in a more general way, based on its own attributes and behaviors.
  • Process Binding Rules 306 include several pseudo-Process Sets to handle special behaviors:
  • Initial Rules These rules define the Process Set assignments for any applications that are running before the behavior control engine starts. For these applications, there is no parentage history, and the initial rules must take this into account. If the behavior control engine is implemented as part of the operating system, there may be no opportunity for applications to start before the engine. But in the case where the engine is implemented as an addition to an existing operating system, it is likely that some low-level system applications or processes will start before the engine does.
  • Remote Rules These rules define the Process Set assignments for any actions take by applications on remote systems against the local system.
  • the behavior control engine may or may not know the normal information about the application taking the action. If the operating system provides information such as the remote application name and identity or the Process Set assignment of the remote application, then the Remote Rules can specify Process Set assignments using those attributes. But in many cases, this information is not available for remote requests. Therefore the Remote Rules have additional capabilities to make Process Set assignments based on the identity of the remote system from which the request has come.
  • the BCD 305 controls a set of applications, i.e., programs and processes, and defines the acceptable and unacceptable behaviors for those applications. It also defines the actions to take when unacceptable behavior occurs:
  • BCDs 305 are designed for only a single application, e.g., an Outlook BCD 305 A or an IIS BCD 305 C.
  • Other BCDs are designed for a large number of applications, e.g., an “administrative tool” BCD.
  • BCDs 305 include a small number of generic behaviors, e.g., “you cannot write to the D: drive.” Other BCDs 305 might include a large number of more specific behaviors, e.g., “you can only write to the following list of Registry keys.”
  • Actions the response to an unacceptable behavior will be different depending on the behavior and on the environment. Some actions just record the behavior, e.g., logging or sending alerts. Other actions block the behavior, e.g., deny with an error.
  • the APPFIRETM firewall 201 preferably provides a library of pre-defined BCDs 305 . These include generic BCDs 305 for each supported operating system, e.g., Windows 2000 Server, as well as more specific BCDs 305 for popular applications.
  • a typical policy includes a number of BCDs 305 , although it may include as few as one BCD.
  • the specific BCDs 305 used are determined by the applications expected to run on that system and by the granularity of control required on the system. Even if there is no specific BCD 305 for an application, using a generic BCD 305 immediately strengthens the security of the operating system platform and any application running on it.
  • a generic BCD 305 can also be used to protect the base operating system, since an application is only as secure as the base that supports it.
  • the APPFIRETM firewall 201 protection is based on behavior definitions, not on signatures of specific files or network commands.
  • a signature-based architecture results in a long list of very specific patterns to recognize and block.
  • a new attack is mounted, its signature must be determined and added to this list by the vendor. Then it must be deployed to all the protected systems. Until this happens, the attack is free to cause damage to as many systems as it can reach.
  • the APPFIRETM firewall 201 is based on the concept that each software program accesses certain system resources in certain ways to accomplish its tasks. There are some system resources it must create or modify, i.e., log files, message store, document files, etc. There are other system resources it only needs to read, i.e., configuration data, dynamic libraries, and content. And there are a large number of resources it has no reason to access at all. Many attacks cause damage by “convincing” an application to modify resources that are in the latter two categories.
  • the BCDs 305 define the acceptable behavior of an application with respect to system resources.
  • the APPFIRETM firewall 201 can stop bad behavior without advance knowledge of an attack and before it causes damage to the system. This protection works no matter what method the attacker takes to gain access to the system; it stops automated viruses as well as malicious insider attacks.
  • This behavior-based approach to protection allows the APPFIRETM firewall 201 to protect against new attacks right away, without the “catch-up” problem of signature-based products.
  • Process Binding Rules 306 are defined with respect to a particular process set. All Rules in an APPFIRETM firewall 201 policy are context-sensitive, in other words, they depend on the parentage of the application.
  • BCDs 305 are self-contained. They divide resources and control access independently of each other. Thus, by dividing the system and constructing the policy from modular components, the APPFIRETM firewall 201 simplifies the task of creating and modifying system policies. Changes to a particular BCD 305 are guaranteed to affect only that BCD 305 . Binding Rule changes for a particular process set have ramifications only for descendant Process Sets, not for the entire system. Thus, when making changes to or extending a policy, the user does not need to deal with the entire policy but, only needs detailed knowledge of the portion being changed. Even changes to the top level Process Sets can be done without affecting the BCDs 305 .
  • the APPFIRETM Editor provides the maximum assistance.
  • the developer can accept the default ordering. But for complex policies or for developers who think differently, the Editor gives the freedom to order and organize Rules in the most convenient way.
  • any BCD Rule can specify to log an event and/or generate profile information when the Rule is matched. All Rules have exactly the same actions. There are no special Rule types that have restricted choices or additional choices.
  • the APPFIRETM Profiler 1102 is a set of tools that assist with policy creation.
  • the tools record the behavior of an application, generate an initial BCD 305 or entire policy and allow iterative refinement of the policy. These same tools can be used by customers to generate BCDs 305 for their own custom applications.
  • An APPFIRETM Profiler (see element 1102 , FIG. 11) assists with BCD creation.
  • the Profiler 1102 uses the recorded behavior of an application, generates an initial BCD 305 and allows iterative refinement of the BCD.
  • An engineer can use these tools to create the pre-defined BCDs 305 distributed with the APPFIRETM firewall 201 .
  • the Profiler 1102 can be used by users to generate BCDs 305 for their own custom applications.
  • the Profiler 1102 also has the ability to update an existing policy or BCD.
  • the author gives the Profiler a recording of additional application behavior and an existing policy or BCD.
  • the profiler merges the new behavior into the policy or BCD. This is useful when trying a policy or BCD out in a new environment with new behaviors. It is more efficient to augment the existing policy or BCD than to start from scratch.
  • the Profiler 1102 can also produce data files instead of policy files. These files are delimited text files suitable for importing into a spreadsheet, database or other analysis tool. A policy author can use this type of output to analyze application or system behavior before generating or modifying policies.
  • the APPFIRETM firewall 201 's management framework is preferably built on a J2EE Application Server architecture.
  • the J2EE Application Server 406 provides several key capabilities for the framework:
  • Application server clustering means that no single point of failure exists.
  • the J2EE Application Server 406 keeps the clustered machines in sync, automatically distributes work among them, and allows the system to keep running if one machine goes down.
  • the Enterprise Java Beans running on the application server isolate the Database 407 from the user interface. This separation makes the APPFIRETM management framework database-independent.
  • the enterprise can choose a database that best suits its operational and capacity requirements. It can leverage an existing database or acquire a new one.
  • the Management Infrastructure 402 supports both redundancy and expansion through the use of a J2EE-compliant Application Server 406 .
  • the J2EE Application Server 406 includes a clustering capability and automatically distributes work and shares data among the systems.
  • the built-in clustering provided by the J2EE Application Server 406 is very powerful. It provides redundancy, allowing Agents 304 and administrators to reference the cluster, rather than an individual machine. If one of the systems in the cluster goes down, work is handled by the remaining systems. If the network grows and requires more resources for APPFIRETM management, the administrator simply needs to add another system to the cluster. The Agents 304 and administrators take advantage of the additional capacity automatically as the cluster distributes work to the new system.
  • the Management Infrastructure 402 is database-neutral.
  • the J2EE Application Server 406 preferably is supplied with a built-in database 407 suitable for small installations. Larger installations will need a higher capacity database, such as MS SQL or Oracle.
  • the APPFIRETM firewall 201 supports all of these.
  • Database neutrality gives users extremely flexible configuration options. Small organizations don't have to make a separate database purchase—they can use the built-in Database 407 . If the organization grows beyond the capacity of the built-in Database 407 , it can migrate to an external database when necessary. Larger enterprises that have already invested in large database resources can take advantage of them from the start. By supporting the most popular database products, users can use what they are familiar with, rather than needing to learn about a new database product just for the APPFIRETM firewall 201 .
  • File access The APPFIRETM firewall 201 controls access to any attributes of files or directories, including:
  • pathname including wildcards for single and multiple path elements
  • the APPFIRETM firewall 201 also provides “short hand” symbols, and allows specification of any environment variable or registry value for system- or application-specific values. Each Rule is part of a BCD 305 and controls all processes in process sets mapped to the BCD 305 .
  • the APPFIRETM firewall 201 allows individual specification of every operation provided by the operating system. The operations are controlled independently. The UI also provides abstract operations to avoid confusion for novice users. The system ships with predefined BCDs 305 , which in turn include file resource maps for common groupings.
  • Registry key control The APPFIRETM firewall 201 controls access to registry keys and values using any attributes of registry keys and values, including:
  • pathname including wildcards for single and multiple path elements
  • Each Rule is part of a BCD 305 and controls all processes in process sets mapped to the BCD 305 .
  • the APPFIRETM firewall 201 allows individual specification of every operation provided by the operating system. The operations can be allowed or denied independently.
  • the UI also provides abstract operations to avoid confusion for novice users.
  • the system ships with predefined BCDs 305 , which in turn include registry resource maps for common groupings.
  • Network socket access The APPFIRETM firewall 201 controls access to network services (i.e., sockets). Sockets are specified by:
  • connection direction server, client
  • protocol & port e.g., tcp/23 for initial connection and subsequent connections
  • the APPFIRETM firewall 201 allows separate control of server and client use of a socket.
  • the system ships with predefined BCDs 305 , which, in turn, include network resource maps for common protocols.
  • COM component access The APPFIRETM firewall 201 controls access to COM components using either the literal PROGID (friendly name) or the CLSID (GUID). Each rule is part of a BCD 305 and controls all processes in process sets mapped to the BCD 305 . Basic granularity of control allows access (or not). The system ships with predefined BCDs 305 , which, in turn, include COM resource maps for common groupings.
  • Application control is covered by the general file access control feature. Blocking execute access to the application executable(s) prevents that application from running. Applications can be specified by pathname and any of the other attributes available to file access control rules. The Simple View UI also provides a more intuitive way to block applications from running.
  • Network worm protection worms do their damage by accessing resources.
  • the APPFIRETM firewall 201 features allow specification of behavior controls to contain or prevent the damage worms can cause. Protection against worms using standard APPFIRETM firewall 201 behavior control provides full flexibility to choose which processes are subject to the controls. Protection against worms using standard APPFIRETM firewall 201 behavior control provides full flexibility to Deny (with the full range of denial responses), Log or both.
  • Some variants create a Trojan Horse file in the root directories of the systems hard drives. When executed, this Trojan Horse modifies two registry keys to make certain system directories remotely accessible and copies the Windows cmd.exe program to these directories. If successful, these actions create a backdoor, allowing the attacker to access the system remotely at any time in the future.
  • a Web server Under normal conditions, a Web server has no reason to modify system registry keys or to create files in system directories. Rather, it should only read system registry keys and directories.
  • An APPFIRETM behavior control description for a Web server would define reading system registry keys and directories as appropriate behavior, and modifying these same keys and directories as inappropriate behavior that should be blocked. If the CodeRed worm attacked a Web server protected by the APPFIRETM firewall 201 , its attempts to modify the registry to open security holes would be denied. Similarly, its attempts to create programs in the sensitive root directories would also be denied.
  • the BCD 305 would define network access for listening and responding as appropriate behavior and network access for initiating connections to other systems as inappropriate behavior.
  • the APPFIRETM behavior control engine 302 would deny attempts to create a network connection. If there were legitimate reasons for a particular Web server to initiate connections to remote systems, the BCD 305 could be customized to list specific systems to which connections should be permitted. Alternatively, the BCD 305 could specify a maximum permitted rate for creating outbound connections. When the Web server's behavior exceeds this rate, the APPFIRETM behavior control engine 302 can deny further connections.
  • This example illustrates how a BCD 305 can define the appropriate behavior of a Web server and contain the damage that an attack like the CodeRed worm can cause.
  • the APPFIRETM firewall 201 does not prevent the worm from infecting the Web server, but it does prevent the worm from using the compromised Web server to damage critical server or operating system resources. Note that since the defacing of Web pages happens entirely in memory, it does not result in behavior the APPFIRETM firewall 201 behavior control engine 302 controls. So the CodeRed worm would be able to deface Web pages, but only until the vulnerability is closed and the system rebooted.
  • the BCD 305 defines behaviors in terms of what is appropriate and inappropriate for a Web server. As such, the BCD 305 prevents damage from any attack that attempts to modify system registry keys or directories. It is not limited simply to the CodeRed-specific pattern of damage.
  • the critical data must be shared by groups of employees so the internal servers containing it must be connected to the company network. Unfortunately, this is the same network that the malicious employee has access to. Consequently, the internal servers are subject to attack.
  • a malicious employee can take advantage of vulnerabilities in the basic operating system software and applications, just as an outside attacker might. He or she can also use additional attack methods, such as stealing passwords or using unlocked, logged-in terminals.
  • the APPFIRETM firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, an APPFIRETM firewall 201 policy describes the permitted or denied behaviors of an application. If the application attempts denied behaviors, the APPFIRETM firewall 201 stops the action.
  • the APPFIRETM firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, a BCD describes the permitted or denied behaviors of an application. If the application attempts denied behaviors, the APPFIRETM firewall 201 stops the action.
  • Pre-defined behavior policies are provided for common operating systems and servers, including Windows and the IIS server.
  • a company desiring to protect its internal Windows servers would deploy The APPFIRETM firewall 201 on those servers and apply the pre-defined Windows OS policy.
  • This BCD describes the permitted behavior of the base Windows operating system components. It also contains options for common Windows server features and applications. The IT department can select those features and applications required on the server and the APPFIRETM firewall 201 adjusts the policy appropriately.
  • the pre-defined Windows server policy includes descriptions of the permitted behavior of interactive applications, such as MS Office and e-mail applications. On a server system, these applications are restricted to reading or writing a very small set of files, blocking their use to steal or damage critical business data. Certain applications, such as e-mail readers, can be prevented from running altogether. Users would have to read their email from their workstation.
  • Standard Web, Transaction and Mail servers don't solve every business problem. Most businesses have unique needs and they often require custom applications to meet them. These custom applications are just as critical to businesses as the standard servers and applications they use. Attacks on and damage to custom applications cost businesses money.
  • the APPFIRETM firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, a BCD describes the permitted or denied behaviors of an application. If the application attempts denied behaviors, the APPFIRETM firewall 201 stops the action. This behavior control can be applied to custom applications just as easily as to popular applications.
  • a business desiring to protect a custom application would define a custom behavior policy.
  • the APPFIRETM firewall 201 provides pre-defined behavior policies for common operating systems and servers.
  • the custom policy would begin with a pre-defined OS policy. This policy controls the behavior of the base operating system components and provides the custom application with a more secure platform for execution.
  • the custom policy is completed by writing behavior controls for the custom application.
  • the policy author first analyzes the behavior of the custom application, combining design knowledge of the application (if available) with profiles of actual behavior. Using this data, the author uses the APPFIRETM Authoring Environment to create a new behavior control description for the custom application. Finally, the author modifies the Process Binding Rules 306 to map the custom application to the BCD 305 .
  • the resulting policy contains both the pre-defined OS controls and the custom controls for the custom application.
  • Custom applications often co-exist with standard applications, such as Web servers.
  • the pre-defined policies include behavior controls for standard applications. These behavior controls confine each application so that a problem in one application cannot undermine another application.
  • the custom application is protected from intrusions into the standard applications and vice versa.
  • Businesses use IIS Web servers for a variety of reasons. Some simply display corporate information to the public, e.g., product marketing documents, corporate press releases, etc. Others are integral parts of the company's daily operations, e.g., on-line stores, customer support servers, etc. In either case, attacks on the IIS server cost the business money. Customers cannot find the information they need and cannot interact with the company to do business.
  • IIS Web servers Since the purpose of these IIS Web servers is to interact with the public, they must be connected to a public network. Consequently, the servers are subject to constant attack. The types of attacks are always changing, as evidenced by the stream of virus announcements from the anti-virus vendors and of patch notifications from Microsoft. The attacks and patches are not limited just to the Web server software. Vulnerabilities in the basic Windows operating system software are also common and just as serious.
  • the APPFIRETM firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, a policy describes the permitted or denied behaviors of the applications on the system. If the application attempts denied behaviors, the APPFIRETM firewall 201 stops the action.
  • Pre-defined behavior policies for common operating systems and servers are provided, including Windows and the IIS server.
  • a company desiring to protect its public IIS Web servers would deploy the APPFIRETM firewall 201 on those servers and apply the pre-defined IIS server policy.
  • This policy describes the permitted behavior of the IIS server itself and of the base Windows operating system components. If an attack is launched against the IIS server, and the attacker tries to fool or force the Web application to access resources outside of its permitted set, the APPFIRETM firewall 201 will see the attempt and block it. Attacks against the Windows OS components are stopped in a similar manner.
  • the IIS server software has a large number of features. Besides providing Web services, it can provide FTP and News services, dynamic page generation, etc. Vulnerabilities are usually specific to a feature.
  • the APPFIRETM firewall 201 pre-defined policies provide options to specify which IIS server features are required by the business. For features that are not required, the policy can deny access to resources needed only by that specific feature. In this way, a business can customize the behavior policy for their specific needs and get even more protection than from a completely generic policy.
  • each group needs to have confidence that it has the means to do their job without interference, intentional or accidental, from the other groups.
  • the policy group wants to configure applications in a way that meets the organization's general policy and wants to be sure the operational group can't violate it.
  • the operational group wants to be able to reconfigure applications as necessary to keep the servers running. It needs to react quickly to new circumstances or problems and doesn't want to be prevented from changing configurations to do so.
  • the APPFIRETM firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, a policy describes the permitted or denied behaviors of an application. If the application attempts denied behaviors, the APPFIRETM firewall 201 stops the action. Pre-defined behavior policies for common operating systems and server applications are provided.
  • the APPFIRETM Manager 401 provides powerful tools to support a two-tiered management system.
  • the operational group may not have detailed knowledge of application behavior.
  • the Enterprise Manager accounts for this and provides a Simple View (see FIG. 5) of the policy that shows options in terms of application features rather than application behavior.
  • the policy group on the other hand, likely has detailed knowledge of application behavior. It can use the Authoring Environment, with its more sophisticated Graphical View (see FIGS. 7 A- 8 B) to understand a pre-defined policy or create a custom policy for the organization.
  • the policy group can customize a pre-defined policy in several ways. If some or all of the Simple View options could violate the organization's general policy, the policy group can select a safe choice for each option and remove them as options from the policy. This eliminates the possibility of the operational group making a wrong choice. If the operational group needs some additional options not provided by the pre-defined policy, the policy group can create new options in the policy.
  • the Authoring Environment provides the ability to define options for the Simple View and define the detailed behavior controls to be used for each choice. The policy group would define these new options such that any choice is in accordance with the organization's policy. Finally, if the organization has custom applications, the policy group can create BCDs for these applications and include them in the custom policy. This ensures that the custom applications are controlled in a consistent way across the organization.
  • the resulting custom policy satisfies both groups.
  • the policy group has defined the policy to support the organization's general security policy. Any choices that would violate the organization's policy have been removed and any special circumstances have been accounted for by additions to the policy.
  • the operational group is satisfied because the custom policy contains the flexibility it needs to deal with operational issues and it does not contain options that might violate the organization's general policy.
  • the operational group is no longer under severe pressure to deploy anti-virus signature updates or install patches immediately. It can establish a regular maintenance schedule for the updates and patches and be confident that the APPFIRETM firewall 201 protects the un-patched systems in the meantime.
  • APPFIRETM Agents 304 By installing APPFIRETM Agents 304 on their critical systems, administrators can reduce the number of patch conditions that apply to those systems.
  • the pre-defined APPFIRETM policies confine many standard operating system services to only the behaviors necessary for their required features. Thus, a patch that fixes a problem that would allow an attacker to cause an operating system service to exhibit a non-normal behavior would not be critical on an APPFIRETM-protected system. APPFIRETM would stop the undesired behavior.

Abstract

A method of protecting a system from attack that includes monitoring processes running on a system, identifying behavior of the processes and attributes of the processes, grouping the processes into process sets based on commonality of attributes, and generating behavior control descriptions for each process set.

Description

    BACKGROUND OF THE INVENTION
  • 1. Field of the Invention [0001]
  • The present invention relates to host-based protection, and more particularly, to host-based protection that prevents attacks based on application behavior. [0002]
  • 2. Related Art [0003]
  • There is a growing awareness that existing security infrastructure that guards the perimeter (e.g., firewalls) or uses signatures (e.g., anti-virus and intrusion detection) is no longer adequate protection against new and unknown attacks or hostile insiders. With the advent of the Internet and organizational mandates to open internal systems to customers, suppliers and partners, the concept of a perimeter has changed forever. Because of these mandates and the inability of perimeter security to protect applications and servers, critical computing resources are exposed to severe and frequent damage. [0004]
  • When a new attack appears (and all attacks are new and unknown at first) it slips past existing defenses (firewall, intrusion detection, and anti-virus software) and exploits some vulnerability in an application or operating system (e.g., buffer overflow) and then causes damage to critical computing resources. Historical data about operating system and application vulnerabilities, viruses, worms and insider attacks in the past 3 years shows that the majority of attacks obtain some system level privilege (e.g., administrator, or root) they should not have. Once the attack or attacker gains this privilege, it can then modify system files, change registry settings, access devices, and control network connections, and steal or alter proprietary information. In the case of a worm or virus, if a new attack propagates quickly, as many do (e.g., NIMDA, Melissa, I Love You), it damages thousands of servers before the defenses can be updated. In addition to automated attacks, such as viruses and worms, there is a significant risk from malicious insiders. Existing security products provide little defense against a malicious insider with legitimate privileges doing damage to servers. Viruses, worms and hostile insiders cause substantial damage and loss of productivity and proprietary information and require each of the damaged servers to be repaired by reformatting, reconfiguring, recovering data or even replacing the server. [0005]
  • As illustrated in FIG. 1, the existing perimeter security solutions solve some, but not all, of these problems. Each solution has specific strengths and weaknesses: [0006]
  • [0007] Network firewalls 101 provide perimeter defense, ostensibly keeping malicious activity out of the network. This type of defense does not account for damage caused from inside the network. Many studies have shown that internal attacks account for a large percentage of damage. Additionally, network firewalls work by examining network behavior, but even legitimate network traffic can take advantage of application vulnerabilities.
  • Intrusion detection systems (IDS) [0008] 102 work by examining various types of system behavior, e.g., network traffic and system logs, looking for patterns that indicate attacks. Typically IDS's 102 define attacks based on signatures of known attacks or on vague notions of “normal” activity. Signature-based systems only protect against attacks seen previously. Definitions of normal activity must be very loose to avoid generating false alarms.
  • [0009] Anti-virus scanners 103 examine files or email messages and look for matches to known attack signatures. As with all signature-based products, these scanners 103 cannot deal with a new type of attack until it is known, a new signature is defined and then distributed by the vendor. Anti-virus scanners 103 also cannot detect attacks that are not carried in files or email messages.
  • Security, however, is not a top priority for application software vendors in today's market. Market pressures force the vendors to deliver new features so rapidly that it is impossible to build software without inherent security flaws. The requirements for today's applications are so complex that simply delivering a working product within deadlines is difficult. The additional effort required to create a secure design and perform security testing is not practical. [0010]
  • Even if application vendors decided to make security a top priority for their products, there are significant barriers to developing secure applications. Most software developers do not have the expertise to design and build secure software. Training developers in these skills will not happen overnight. Additionally, secure applications are pointless without a secure foundation to host them. Today's operating systems do not provide a secure foundation to protect applications or allow them to protect themselves. Operating system vendors release new security patches each week to improve their products. But applying patches is not a strategic solution, because they are published only after the fact, only address known flaws, and are very cumbersome to deploy. [0011]
  • Even solving these problems cannot guarantee freedom from attacks. Enterprises today require complex software that permits interaction with a wide variety of other organizations for needs such as supply chain management, messaging, and customer relationship management. There will always be people who misuse legitimate features of the software and cause damage to critical information. The misuse might be accidental or malicious but the result is the same—loss of information or services and downtime to which critical are the enterprise. [0012]
  • Independent reports published by Computer Security Institute/FBI, CERT/CC, and Gartner determined that known users accessing the corporate network from the outside cause 70% of all security breaches; 57% of the breaches are unintentional and the balance are malicious. Further, because of the significant rise in identity theft, it is impossible to be certain whether or not a known user is the legitimate user or an imposter exploiting the access rights of the legitimate user's identity. This means that the definition of an insider has come to mean virtually any customer, supplier, partner, consultant, employee or identity thief who has access to the network. To make things even more difficult, the corporate mandate is to further open systems to access from anywhere, anyway and at anytime. This means that applications will need to be more extensible and as a consequence more complex and vulnerable. [0013]
  • A need therefore exists to enhance existing security infrastructure with technology that prevents new and unknown attacks and hostile insiders from compromising critical computing resources. [0014]
  • There has been significant research in the past 30 years related to adding system-wide security controls to operating systems. Often the solutions require modification of the operating system itself to support additional data structures or system calls. These modifications are necessary either for completeness or efficiency or both. By requiring modification to the operating system, these solutions limit themselves to vendors who distribute their source code, and even in those cases, since they aren't part of the basic product development process, the solutions typically lag behind the most current versions of the operating systems. [0015]
  • Most of the solutions also create system-wide tables of access control information. This limits their usefulness in complex system deployments. Since every change to the system-wide information has the potential to affect every other part, it is impractical to create very large or complex configurations. Beyond a certain size, the author will not be able to determine whether a change has detrimental ramifications on another part of the configuration. For this reason, the previous solutions either never reached commercial viability, or if they did, only provide simple, basic configurations and cannot be easily expanded for complex situations. [0016]
  • Other solutions currently available concentrate on a small area of protection, e.g., HTTP filtering or network connection control. While they do a good job within their target area, they leave large portions of the system unprotected. As a result, customers desiring overall protection of their computer systems must deploy a combination of products, each dealing with a part of the security problem. [0017]
  • SUMMARY OF THE INVENTION
  • The present invention is directed to a behavioral-based host-based system that substantially obviates one or more of the problems and disadvantages of the related art. [0018]
  • There is provided a method of protecting a system from attack including monitoring processes running on a system, identifying behavior of the processes and attributes of the processes, grouping the processes into process sets based on commonality of attributes, and generating behavior control descriptions for each process set. [0019]
  • In another aspect there is provided a method of protecting a system from unauthorized use including decomposing processes running on a system into a plurality of process sets, such that each process set has a corresponding behavior control description, and controlling access to system resources by each process based on a behavior control description for the process set to which the process belongs. [0020]
  • In another aspect there is provided a method of protecting a system from unauthorized use including identifying processes running on a system, such that each process has an independent behavior control description and controlling access to system resources by each process based on the behavior control description for the process. [0021]
  • Additional features and advantages of the invention will be set forth in the description that follows, and in part will be apparent from the description, or may be learned by practice of the invention. The advantages of the invention will be realized and attained by the structure and particularly pointed out in the written description and claims hereof as well as the appended drawings. [0022]
  • It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed.[0023]
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • The accompanying drawings, which are included to illustrate exemplary embodiments of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention. In the drawings: [0024]
  • FIG. 1 shows conventional perimeter security approaches. [0025]
  • FIG. 2 shows how an APPFIRE™ application firewall fits into a system security approach. [0026]
  • FIG. 3 shows an illustration of a Windows kernel environment and how an APPFIRE™ Agent fits within it. [0027]
  • FIG. 4 shows a relationship between the various APPFIRE™ components. [0028]
  • FIG. 5 shows a simple view of a policy in the APPFIRE™ Authoring Environment. [0029]
  • FIG. 6 shows a graphical view of some deployed APPFIRE™ Agents in the APPFIRE™ Enterprise Manager. [0030]
  • FIGS. [0031] 7A-7B show screenshots of the BCD editor in the APPFIRE™ Authoring Environment.
  • FIGS. [0032] 8A-8B show a graphical view of Process Set relationships in the APPFIRE™ Authoring Environment.
  • FIG. 9 shows a source view of a policy in the APPFIRE™ Authoring Environment. [0033]
  • FIG. 10 shows a screenshot of the Process Set Editor in the APPFIRE™ Authoring Environment. [0034]
  • FIG. 11 shows a relationship between the agents and the profiler tool. [0035]
  • DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION
  • Reference will now be made in detail to the embodiments of the present invention, examples of which are illustrated in the accompanying drawings. [0036]
    TABLE OF CONTENTS
    1.0 Introduction
    2.0 Requirements for a successful behavioral-based firewall
    3.0 The APPFIRE ™ Solution
    4.0 Architectural Overview
     4.1 APPFIRE ™ Agent
     4.2 Management Infrastructure
     4.3 APPFIRE ™ Manager
     4.4 The APPFIRE ™ Enterprise Manager
     4.5 The APPFIRE ™ Authoring Environment
    5.0 System Behavior Policies
     5.1 Modular Policy Definition
     5.2 Process Sets
     5.3 Behavior Control Descriptions (BCDs)
     5.4 The APPFIRE ™ Profiler
    6.0 J2EE Application Server
    7.0 System resources access control
    8.0 Example—CodeRed worm
    9.0 APPFIRE ™ Case Studies
     9.1 Protecting against Malicious Employees
     9.2 Protecting Custom Applications
     9.3 Protecting Public IIS Servers
     9.4 Managing Policy in Large Organizations
     9.5 Reducing the Time-Criticality of Patches
  • 1.0 Introduction [0037]
  • APPFIRE™ is an example of an application firewall, described in detail below, that protects critical computing resources from the severe, frequent and costly damage caused by new and unknown attacks and hostile insiders. Three important architectural decisions have a significant impact on the ability of APPFIRE™ to meet the requirements for protection, ease of use, scalability, flexibility, and extensibility: [0038]
  • Behavior-based rather than signature-based control [0039]
  • A modular approach to policy creation and management [0040]
  • A J2EE Application Server-based architecture [0041]
  • 2.0 Requirements for a Successful Behavioral-Based Firewall [0042]
  • The three architectural decisions for APPFIRE™ of behavior-based control, modular policy model, and J2EE Application Server allow the APPFIRE™ application firewall to meet the requirements below and thus provide a real enterprise-class solution: [0043]
  • Prevent unknown attacks: APPFIRE™'s behavior-based policy philosophy does not depend on knowing the method of attack. It defines appropriate behavior based on the intended use of an application. If the application exhibits inappropriate behavior for any reason, APPFIRE™ will prevent it. [0044]
  • Ease of Use: APPFIRE™'s modular policy model allows an administrator to easily view and configure security policies in a series of small manageable tasks. The user interface provides three different views of a policy (simple, graphical, and source) allowing administrators to choose the level of abstraction most appropriate for their purposes at any time. Therefore APPFIRE™ meets scalability and ease of use requirements by allowing an administrator to see exactly what a Behavior Control Description (BCD) affects and its relationship to other parts of the policy, without the need to understand all aspects of the policy and system. By making APPFIRE™'s policy creation and management framework modular and graphical, an organization can easily create and modify BCDs and policies. The APPFIRE™ management framework is designed to plug into existing management frameworks (i.e., Microsoft Operations Manager and Systems Management Server). This further reduces the learning curve by allowing administrators to continue using management tools they already understand. APPFIRE™'s pre-defined BCDs for popular applications and OS's provide true “out of the box” value for novice administrators or organizations that do not want to create or modify policy. [0045]
  • Scalability: The J2EE Application Server architecture allows an enterprise to expand the Management Infrastructure (discussed below) as their needs grow. It allows them to leverage existing resources, such as database or enterprise management frameworks, or use built-in APPFIRE™-provided components. The J2EE Application Server supports clustering and high-availability requirements common in large enterprises. The management user interface allows administrators to easily deal with large numbers of machines by grouping them and applying common policies to entire groups. The modular policy model allows creation of common policy building blocks that can be reused in policies throughout the enterprise. [0046]
  • Flexibility: The use of Java and the J2EE Application Server allows the management framework to run on multiple platforms. An enterprise can run the framework on whatever operating system they are most comfortable supporting, and it is database independent. The APPFIRE™ Agent software also supports multiple platforms, so an enterprise can protect any system. The language used to describe the policies (discussed below) supports a wide variety of resources, resource attributes and process attributes for use in Process Binding Rules (PBRs, see discussion below) and Behavior Control Descriptions (BCDs). This variety allows the policies to address both simple and complex application deployments. [0047]
  • Extensibility: the initial APPFIRE™ release focuses on controlling applications' access to resources. However, the modular policy model and the implementation are designed for easy extension to other types of protection schemes. The APPFIRE™ Profiler assists policy developers in extending policies with specific BCDs for new or custom-built applications. [0048]
  • 3.0 The APPFIRE™ Solution [0049]
  • The APPFIRE™ application firewall can be implemented as an addition to an operating system or as an integrated part of an operating system. This flexibility increases the number of systems on which the invention can be implemented. [0050]
  • The APPFIRE™ application firewall allows modular specification of policy information. The policy configuration consists of multiple, independent behavior control descriptions and a set of process binding rules defining which processes are controlled by which behavior control descriptions. By avoiding a single system-wide configuration for all processes, the scope of changes is limited and more complex policies can be created. [0051]
  • The modular policy architecture also allows independent development of behavior-based controls for applications. Behavior control descriptions can be developed concurrently by several groups and combined with existing policies in a controlled fashion. This allows software vendors to develop APPFIRE™ behavior control descriptions to distribute with their products and know that when they are added to an existing APPFIRE™ policy on a customer's system the result will operate correctly. Similarly it allows consulting organizations to develop behavior control descriptions and add them to existing APPFIRE™ policies in an understandable fashion. [0052]
  • The APPFIRE™ application firewall looks at all aspects of a process' behavior. It does not focus on the use of a specific protocol or specific types of resources. It monitors all types of resources, e.g., files, registry, network, URLs, or any other type of resource that may become important for security protection. It can look at single actions, e.g., opening a file or a network connection. It can look at sequences of actions, e.g., attack signatures. It can also maintain state and control actions differently based on that state, e.g., once a network connection is opened, certain files can no longer be written. By not limiting itself to a subset of possible behaviors, the APPFIRE™ application firewall becomes suitable for any type of operating system or application. [0053]
  • The APPFIRE™ Agents accept configuration from a number of trusted sources. A basic implementation accepts policy from an authenticated Management Infrastructure. The Agents can also accept configuration from an application itself, e.g., applications built with NET development tools can contain explicit information about resources they need and don't need. This information can be read and enforced by APPFIRE™ Agents. APPFIRE™ Agents can also assist operating systems that control application behavior based on licenses, e.g., Microsoft's planned Palladium architecture. Information provided by the operating system can be incorporated into the APPFIRE™ policy to strengthen the computing platform available to applications. [0054]
  • The [0055] APPFIRE™ firewall 201, as shown in FIG. 2, provides an important new security capability. Rather than watching the activity happening around the application as the perimeter security products do, it watches the behavior of the application itself. By watching the behavior of an application, it can spot bad behavior as it happens and prevent it from causing damage. This behavior-based control creates a safe zone of operation around an application. The enterprise regains control of its applications.
  • The [0056] APPFIRE™ firewall 201 should be used in conjunction with other security products for a defense-in-depth, as illustrated in FIG. 2. The APPFIRE™ firewall 201 addresses the weaknesses of existing security products. Its general behavior-based controls are suitable for both servers and workstations, for any operating system, and for any application.
  • The [0057] APPFIRE™ firewall 201 uses Trusted Operating System concepts. Behavior control mechanisms are added to each target operating system. These mechanisms allow the APPFIRE™ firewall 201 to actively monitor any application and ensure compliance with the policy configured by the administrator. Predefined policies and BCDs are available for popular operating systems, e.g., Windows NT/2000/XP, and applications, e.g., MS Exchange, Internet Information Server, MS Outlook and MS Internet Explorer. In addition, the APPFIRE™ firewall 201 makes it easy to adapt policies for environmentally unique requirements. The APPFIRE™ firewall 201 then allows each application to execute in its own confined domain having access to only the resources that it needs to perform its intended function and nothing more.
  • The behavior controls are implemented at a kernel level and cannot be bypassed by any application, including those that are considered privileged by the host operating system. The [0058] APPFIRE™ firewall 201 includes a user-friendly BCD editor, scalable remote management and reporting features and the ability to integrate with third-party enterprise management consoles. These capabilities make the APPFIRE™ firewall 201 suitable for wide deployment in an enterprise of any size.
  • The initial [0059] APPFIRE™ firewall 201 release will support Windows Server, Exchange Server and IIS. APPFIRE™ is also intended to support Windows Workstation, MS Outlook, MS Internet Explorer and UNIX servers and applications.
  • The sections below explain the architecture in more detail. [0060]
  • 4.0 Architectural Overview [0061]
  • The [0062] APPFIRE™ firewall 201 architecture includes the following main components, as shown in FIGS. 3 and 4:
  • APPFIRE™ Agent: [0063] 304 behavior control engine 302 within the Agent 304 monitors applications' use of system resources based on the System Behavior Policy; makes itself non-bypassable; provides an interface to the Management Infrastructure 402 (see FIG. 4). FIG. 3 shows the use of BCDs 305 from the policy to monitor and control how applications use system resources.
  • Management Infrastructure [0064] 402: provides central storage for APPFIRE™ system data; provides interfaces for managers and Agents to store and retrieve data; supports clustering for additional capacity and redundancy.
  • APPFIRE™ Manager: controls configuration of APPFIRE™ Agents and includes efficient and secure communication channels and advanced customization capability. [0065]
  • APPFIRE™ System Behavior Policies (policies) define the permitted behavior of applications running on the [0066] Agents 304. Policies contain Process Binding Rules 306 that group the applications on the system into process sets and Behavior Control Descriptions 305 that define the permitted behavior of applications in each process set. A policy may contain as few as one process set and one BCD or as many process sets and BCDs as necessary to provide the protection desired.
  • Each of these components is designed to support multiple operating system platforms. The capabilities they provide are general enough to extend to a variety of applications and environments. [0067]
  • A common [0068] APPFIRE™ firewall 201 installation would deploy the Manager 401 on several administrators' workstations, the Management Infrastructure 402 on a dedicated server, and the APPFIRE™ Agents 304 on the organization's critical servers. However, the architecture is extremely flexible in order to support a variety of deployment scenarios:
  • For extremely large installations, the [0069] Management Infrastructure 402 could be split onto two servers, one dedicated to the J2EE Application Server 406 and one to the database 407. Each of those pieces could be clustered as well, to provide further capacity.
  • For organizations with an existing database server, the [0070] J2EE Application Server 406 portion of the Management Infrastructure 402 could be installed on a dedicated server and configured to use the existing database on a separate system. Alternatively the J2EE Application Server 406 could be installed on the existing database server.
  • For small installations with a single administrator, the [0071] Management Infrastructure 402 could be installed on the administrator's workstation along with the Manager 401.
  • For single server installations, the [0072] Management Infrastructure 402 could be installed along with the Agent 304 directly on the server being protected. The Manager 401 could also be installed on the server as well as on the administrator's workstation.
  • For single system installations, either server or workstation, the [0073] Management Infrastructure 402 can be omitted entirely. The Manager 401 and Agent 304 would reside on the single system and use local storage instead of a central Management Infrastructure 402.
  • A more streamlined deployment would include the [0074] Agent 304 only with locally-stored policy and configuration settings. This type of deployment does not include any management user interface. Changes to the policy and configuration settings are made manually, using standard file editing and copying tools.
  • The architecture is designed to support these scenarios and many others. [0075]
  • FIG. 4 also shows how [0076] external tools 404 can interact with the APPFIRE™ firewall 201 to extend the management capabilities. For example:
  • The [0077] APPFIRE™ firewall 201 may include sophisticated Reporting Tools 404. However, the Agents 304 can send their log data to the database 407 in the Management Infrastructure 402. An organization can also use third-party reporting tools, such as Crystal Reports, to query a central database and generate the desired reports.
  • Some large organizations use Microsoft Operations Manager (MOM) [0078] 405 to monitor their networks. Such an organization can deploy a MOM application pack for the APPFIRE™ firewall 201 to monitor the APPFIRE™ Agent 304 logs, and have the results displayed on the MOM console with rest of their network management information.
  • 4.1 APPFIRE™ Agent [0079]
  • The [0080] APPFIRE™ Agent 304 lives on every protected system and enforces the behavior controls defined by the administrator. The Agent 304 includes two main components: the generic behavior control engine 302 and the communications module (not shown in FIG. 3, see element 408 in FIG. 4).
  • The [0081] behavior control engine 302 monitors the access to and use of critical system resources. It provides a wide variety of controls over these resources, including resource names, access modes requested and time or frequency of access. These controls are flexible enough to describe the acceptable behavior of any application with respect to critical system resources. The behavior control engine 302 watches as applications request and use resources, looking for requests or uses that depart from the acceptable behavior. When the behavior control engine 302 sees such a departure, it takes an appropriate action.
  • The definitions of acceptable behavior are contained in the System Behavior Policy. The [0082] behavior control engine 302 simply provides the set of behavior controls available to the APPFIRE™ firewall 201. A policy must be loaded into the behavior control engine 302 to set the controls and begin enforcing correct behavior.
  • The [0083] behavior control engine 302 is loaded into an operating system environment kernel 301 (which includes the Windows kernel 303) to make it non-bypassable. It captures any attempt by any application to access or use any resource and determines whether the request is acceptable behavior for the application. The policy that protects other critical system resources also protects the behavior control engine 302 to ensure it remains intact and running. Malicious software cannot disable or evade it.
  • The [0084] behavior control engine 302 simply enforces behavior. The communication module 408 connects the behavior control engine 302 with the outside world—specifically with the management software. This module 408 is the liaison between the behavior control engine 302 and any systems on the network attempting to manage the Agent 304.
  • The [0085] behavior control engine 302 can be implemented as an addition to an existing operating system, e.g., as a set of loadable drivers and libraries. This implementation allows the behavior control engine 302 to work without access to operating system source code and without significant lag time behind new versions of an operating system.
  • The [0086] behavior control engine 302 can also be implemented as an integral part of an operating system. This implementation, with access to operating system source code and otherwise undocumented information, allows a wider set of features for recognizing and controlling application behavior.
  • The [0087] communications module 408 listens on the network for management commands from the Management Infrastructure 402. Before acting on a command, the module 408 authenticates the sender to ensure the commands are coming from a legitimate Management Infrastructure 402. Once authentication succeeds, the module accepts commands and responds appropriately.
  • In addition to receiving commands from the [0088] Management Infrastructure 402, the communications module 408 also periodically queries the Management Infrastructure 402 to see if new configuration data is available.
  • When new configuration data is available, whether it was sent by the [0089] Management Infrastructure 402 or discovered by querying, the communication module 408 retrieves it from the Management Infrastructure 402, saves it to disk and passes it to the behavior control engine 302. The communication module 408 also monitors the local log files, transfers log data to the Management Infrastructure 402 and requests alerts when unusual events occur.
  • Management commands typically provide configuration data for the Agent's use or request data from the [0090] Agent 304. If the command provides new configuration data, the communication module 408 saves the data to disk and passes it to the behavior control engine 302. If the command requests data, the communication module 408 retrieves the configuration or log data and returns it. It can retrieve data from disk or from the engine 302.
  • Since the [0091] Process Binding Rules 306 are context-sensitive, especially with respect to an application's ancestry, applying a new policy to a running Agent 304 needs to have access to historical process data. The Agent 304 uses this historical data when assigning processes to process sets in the new policy to make sure each existing process' ancestry is taken into account properly. This historical data can be maintained in the behavior control engine 302 itself or it can be exported to the communications module. In the former case, when a new policy is applied, the communications module simply gives it to the behavior control engine 302 and the engine 302 uses its internal historical data to assign processes to the correct process sets in the new policy. In the latter case, the communications module applies the historical data against the new policy and creates a set of process to process set assignments for the new policy. Then the communications module passes the process set assignments and the new policy into the behavior control engine 302. The engine 302 sets the process sets of all the existing processes and then begins enforcing the new policy.
  • The [0092] communication module 408 also includes plug-ins that can talk to third-party management systems, such as BMC's Patrol, Tivoli Policy Manager, CA Unicenter, Check Point Firewall-1 Management Console. If the Agent 304 is being managed from one of these systems rather than from the native APPFIRE™ Manager 401, a plug-in translates the foreign remote management commands.
  • 4.2 Management Infrastructure [0093]
  • The [0094] Management Infrastructure 402 is the central storage point for all APPFIRE™ data. It includes:
  • all system behavior policies, both pre-defined policies and custom policies created by the user, [0095]
  • Agent configuration data and Agent groupings, and [0096]
  • log and alert data from the [0097] Agents 304.
  • As shown in FIG. 4, the [0098] Management Infrastructure 402 includes:
  • The J2EE Application Server [0099] 406: the J2EE Application Server 406 provides a platform for building the APPFIRE™ management features. Its clustering capabilities allow an organization to expand the Management Infrastructure 402 as necessary to provide additional capacity or redundancy.
  • The Relational Database [0100] 407: The Database 407 is the actual data repository for the APPFIRE™ data. The Management Infrastructure 402 is database-independent. A simple database can be provided with the J2EE Application Server 406. Organizations that require more capacity or redundancy can provide a database 407 that meets their needs. The J2EE Application Server 406 can be configured to use an existing database or a database newly installed just to support the APPFIRE™ firewall 201.
  • Enterprise Java Beans (EJBs): the EJBs implement the APPFIRE™-specific management logic. They provide interfaces to the [0101] Agents 304 and the APPFIRE™ Manager 401 and all access to the data goes through the EJBs.
  • An [0102] alternative Management Infrastructure 402 implementation would use a Microsoft .NET server in place of the J2EE Application Server 406 and use Microsoft NET network applications in place of the EJBs. The Management Infrastructure 402 could also be replaced by the infrastructure of an existing enterprise management product. The specific technology used to implement the Management Infrastructure 402 is not critical, as long as it provides the ability to query and save the AppFire data in a central site.
  • The [0103] Management Infrastructure 402 is the intermediary between the Agents 304 and the APPFIRE™ Manager 401. Rather than communicate directly with each other, the APPFIRE™ Manager 401 and the Agents 304 exchange data through the Management Infrastructure 402.
  • The [0104] APPFIRE™ Manager 401 is the user interface to the APPFIRE™ firewall 201. It retrieves data from the Management Infrastructure 402 and displays it to the administrator. The administrator modifies the data by editing policies or reconfiguring Agents 304. When the administrator saves the modifications, the APPFIRE™ Manager 401 sends the data to the Management Infrastructure 402. If the data includes changes to Agent configurations, the Management Infrastructure 402 notifies the appropriate Agents 304 that changes have occurred.
  • Each [0105] Agent 304 holds a copy of its policy and other configuration settings locally. This allows the Agent 304 to operate without constant contact with the Management Infrastructure 402. As noted above, the Management Infrastructure 402 notifies each Agent 304 when its configuration changes. At this point, the Agent 304 retrieves its new policy or other configuration data from the infrastructure and puts it in effect. Since notifications can be lost, e.g., when the Agent 304 is off the network for an extended period of time, the Agents 304 also periodically query the Management Infrastructure 402 for changes. This ensures that changes are propagated in a timely fashion.
  • In addition to retrieving configuration data, [0106] Agents 304 also send log and alert data to the Management Infrastructure 402. This allows an organization to collect data from many Agents 304 into a central repository for system-wide reporting and analysis. Agents 304 use the Management Infrastructure 402 to generate alert messages, e.g., email and pages, rather than do it themselves. Normal log data is simply transferred to the Management Infrastructure 402 for storage.
  • 4.3 APPFIRE™ Manager [0107]
  • The [0108] APPFIRE™ Manager 401 includes two user interface applications. The Enterprise Manager is used to manage and monitor APPFIRE™ Agents 304. It is the user interface that allows the administrator to configure Agents 304 and view the status of the network. The Authoring Environment is used to create and modify policies and policy components. In the descriptions below, the term APPFIRE™ Manager 401 is used to include both user interface applications. The applications are specifically mentioned when appropriate.
  • The [0109] APPFIRE™ Manager 401 contains two user interfaces because they perform two very different tasks. The Authoring Environment is used by policy authors who have significant knowledge about operating system resources and behavior, application behavior and APPFIRE™ policy concepts. Creating or modifying policy is an infrequent operation. The Enterprise Manager is used by system administrators or operators who may have little knowledge about operating system resources and behavior, application behavior and APPFIRE™ policy concepts. In contrast, their job is the day-to-day management of systems protected by APPFIRE™ Agents 304. They use the Enterprise Manager to configure and assign appropriate policies to Agents 304 and to view messages generated by the Agents 304 and stored in the Management Infrastructure 402.
  • Given the two very different type of tasks and users, it is likely that operators would only install the Enterprise Manager and that policy authors would only install the Authoring Environment. By only installing the user interface appropriate for their duties, an organization can have some assurance that neither group can modify data outside of their responsibilities. [0110]
  • 4.4 The APPFIRE™ Enterprise Manager [0111]
  • The Enterprise Manager is designed to manage large-scale networks and supports thousands of protected systems. An administrator with very little security experience can configure and deploy policies to [0112] individual Agents 304 or to large groups of Agents 304 in a single operation. The Enterprise Manager provides the ability to see the status of an individual Agent 304 or an aggregated view of a group of Agents 304.
  • Since the Enterprise Manager may be dealing with thousands of [0113] Agents 304, it only requests or updates data about them when necessary. Communications that involve large numbers of Agents 304 are performed infrequently and kept very lightweight to avoid clogging the network. Requests for large amounts of data are made only when necessary. The Enterprise Manager caches information when it can to avoid extra communication.
  • All management communications are secure. The [0114] APPFIRE™ Manager 401 authenticates itself to the Management Infrastrucure 402 so it can be certain the APPFIRE™ Manager 401 is legitimate. The management commands and data are encrypted and signed for integrity. All communications protocols are based on TCP/IP standards.
  • The [0115] APPFIRE™ Manager 401 look-and-feel is completely configurable. The APPFIRE™ Manager's 401 appearance can be customized to provide a seamless integration with other products or tools they provide. This is especially useful for OEMs and VARs, but could be used for other purposes as well.
  • By using Java and standard TCP/IP communication protocols, the [0116] APPFIRE™ Manager 401 is easily transportable to a variety of operating system platforms.
  • The screen shot in FIG. 6 shows an example of how the Enterprise Manager displays [0117] Agents 304, Agent groupings and policy assignment.
  • 4.5 The APPFIRE™ Authoring Environment [0118]
  • The Authoring Environment presents a user-friendly policy editor (see FIGS. [0119] 7A-8B) that allows administrators to customize system behavior policies and policy components (BCDs 305, PBRs 306, macros, etc) to their particular corporate environment. They can also use the editor to create new policies and components for custom applications. These policies can be saved in a library in the Management Infrastructure 402 for future use.
  • The [0120] APPFIRE™ firewall 201's modular policy model enables three different user experiences for the policy author:
  • 1. A simple high-level view (FIG. 5) that requires very little configuration to implement—a few options to enable or disable based on the organization's need for specific application features. If a feature is not needed, the application does not need access to the corresponding resources. This view is for a novice administrator or organization that does not need to create or modify policy and BCDs. [0121]
  • 2. A graphical view (FIGS. [0122] 7A-8B) showing process sets, BCDs and their relationship to one another. This view gives the ability to drill down into to a process set or BCD to make changes and more importantly see the effect of changes on overall system wide protection. The graphical view is for the administrator who wants to create new policies or make changes to previously provided BCDs.
  • 3. A source-level view (FIG. 9) showing the source code policy specification for the super technical administrator. [0123]
  • The Simple View (FIG. 5) offers a limited-choice interface in which administrators answer simple questions in order to secure their systems. The questions are presented in terms of application features and required capabilities of the system, e.g., “Does your server support FTP?” This view does not force the administrator to understand the complexities of our policy designs. [0124]
  • A simple view is not required in a policy. The policy author decides whether to create a simple view and uses the tools in the graphical view to create it. The simple view is displayed to administrators when they configure the policy using the Enterprise Manager. This capability allows policy authors to create the user interface for administrators using the policy. Rather than having the policy configuration user interface determined by the vendor, each policy includes the definition of its configuration user interface. The Enterprise Manager reads the simple view data from the policy and constructs the configuration user interface accordingly. [0125]
  • The Graphical View (FIGS. [0126] 7A-8B) offers a visual interface to configure every portion of the security policy. This requires the administrator to understand more about how the APPFIRE™ firewall 201 works, but in return offers them greater flexibility in securing their systems.
  • This view begins by displaying visual objects that represent [0127] BCDs 305 and Process Sets. Connections between the BCDs 305 and Process Sets show their relationships. To associate a BCD 305 with a Process Set, the author can visually draw the connection. Alternatively, the author can open the Process Set editor (FIG. 10) to associate the BCD.
  • If the author wants to configure the sub-elements of these components they can expand the icons representing them. This expansion will then show the sub-elements and the relationships between them. Alternatively, the author can open a BCD editor and define the sub-elements as a list of rules. The screen shots in FIGS. [0128] 7A-7B show the contents of a BCD as viewed in the BCD editor.
  • The Source View (FIG. 9) shows the actual source code for the policy being created. This view not only requires understanding how policies work and how to construct them, but also how to use the source code to specify policy. The Source View would normally only be used by the most advanced policy writers. [0129]
  • FIG. 11 illustrates the process of using automated tools to creating a [0130] BCD 305. As shown in FIG. 11, for each APPFIRE™ Agent 304, a plurality of profile files may exist. A plurality of profile files 1101 may exist. These profile files 1101 are used by the profiler 1102, as discussed below, to create a BCD 305.
  • 5.0 System Behavior Policies [0131]
  • The policies are the key component of the [0132] APPFIRE™ firewall 201 deployment. The Agent 304 provides a behavior control engine 302 but that behavior control engine 302 needs instructions. Those instructions are in the policy. The APPFIRE™ Manager 401 provides a way to organize and configure Agents 304 but it needs policies to configure them.
  • A system behavior policy defines a set of applications, i.e., programs, threads, or processes, and the acceptable and unacceptable behaviors for those applications. It also defines the actions to take when unacceptable behavior occurs. The [0133] APPFIRE™ firewall 201 policies allow a modular approach to policy development and management. Policies contain three components: Behavior Control Descriptions (BCDs) 305, Process Sets (Psets), and Process Binding Rules 306 (PBRs).
  • The [0134] APPFIRE™ firewall 201 provides a library of pre-defined policies and policy components (BCDs 305, PBRs 306, macros, etc). These include generic policies for each supported operating system, e.g., Windows 2000 Server, generic BCDs that protect critical system resources, as well as more specific BCDs for specific operating system services and popular applications. Initially, the library can include only the most popular applications. Over time, the library can increase. The APPFIRE™ Manager 401 can import objects into the library at any time—a new product release is not required.
  • The [0135] APPFIRE™ firewall 201 policies are specified in an XML-based policy creation and management language, as discussed above, that enables the modular policy development process that is critical to creating policies for complex systems. The source code for an example policy that profiles all resource access attempts is shown below:
    <?xml version=“1.0”?>
    <policy name=“profile policy” version=“1” info=“Profile Everything”>
     <bcd name=“ProfileBCD” version=“1” info=“Profile Everything”>
     <access>
      <rset name=“all_t” info=“all resources”/>
      <rmap type=“file”>
      <default rset=“all_t”/>
      </rmap>
      <rmap type=“registry”>
      <default rset=“all_t”/>
      </rmap>
      <rule rset=“all_t”>
      <response type=“profile”/>
       <op type=“file” perm=“read”/>
       <op type=“file” perm=“readea”/>
       <op type=“file” perm=“execute”/>
       <op type=“file” perm=“readattributes”/>
       <op type=“file” perm=“readcontrol”/>
       <op type=“file” perm=“synchronize”/>
       <op type=“file” perm=“write”/>
       <op type=“file” perm=“append”/>
       <op type=“file” perm=“writeea”/>
       <op type=“file” perm=“deletechild”/>
       <op type=“file” perm=“writeattributes”/>
       <op type=“file” perm=“delete”/>
       <op type=“file” perm=“writeacl”/>
       <op type=“file” perm=“writeowner”/>
       <op type=“file” perm=“accesssystemsecurity”/>
       <op type=“registrykey” perm=“queryvalue”/>
       <op type=“registrykey” perm=“enumeratesubkey”/>
       <op type=“registrykey” perm=“notify”/>
       <op type=“registrykey” perm=“readcontrol”/>
       <op type=“registrykey” perm=“synchronize”/>
       <op type=“registrykey” perm=“setvalue”/>
       <op type=“registrykey” perm=“createsubkey”/>
       <op type=“registrykey” perm=“createlink”/>
       <op type=“registrykey” perm=“delete”/>
       <op type=“registrykey” perm=“writeacl”/>
       <op type=“registrykey” perm=“writeowner”/>
       <op type=“registrykey” perm=“accesssystemsecurity”/>
      </rule>
     </access>
     </bcd>
     <pbr name=“therules” version=“1” info=“Put everyone in a single
    pset”>
     <pset name=“profile_p” info=“”/>
     <psetdef name=“profile_p” bcd=“ProfileBCD” log=“off”
    profile=“on”>
      <newproc>
      <default pset=“profile_p”/>
      </newproc>
     </psetdef>
     <initial>
      <default pset=“profile_p”/>
     </initial>
     <lanman>
      <default pset=“profile_p”/>
     </lanman>
     </pbr>
    </policy>
  • The main purpose of the [0136] APPFIRE™ firewall 201 and the policies it enforces is to restrict some or all of the applications running on a system to a limited set of behavior defined as their “normal” behavior. But the APPFIRE™ firewall 201 also has to handle the unusual behaviors required to administer a system it protects. Many administrative actions result in dangerous actions that the policy would define as “abnormal” and thus prevent. In some cases, behavior resulting from legitimate administrative changes is indistinguishable from malicious attacks. Therefore, most of the time, the customer will want the policy to prevent such behavior. However, if it is a result of legitimate administration, it should be allowed. So, the system includes a privilege-bracketing mechanism for an administrator to indicate when they are going to perform administrative actions and thus these normally “abnormal” behaviors should be allowed. The mechanism can be implemented in a number of ways, including:
  • Identity-based: The policy can define a specific, privileged identity. The administrator logs into the system using the privileged identity when they want to do administration and logs in using a non-privileged identity when performing normal tasks. [0137]
  • Gateway program: The system can include a special program that the administrator runs to indicate they want to perform administrative tasks. The gateway program can authenticate the administrator to any desired degree, e.g., username and password, cryptographic authentication, biometrics, etc. Once the administrator is authenticated, the gateway program can start privileged programs or notify the behavior control engine to enter an administrative state and thus allow actions that would normally be denied. [0138]
  • 5.1 Modular Policy Definition [0139]
  • Defining the behaviors for all processes on a system without preventing legitimate application usage is a complex problem to solve. Dedicated servers must support some applications for system and application administration. It is not unusual for organizations to put several server applications on a single machine. A successful product must make the task of policy definition for such complex systems easier, and ensure that the policy will not prevent normal application usage. [0140]
  • The core of The [0141] APPFIRE™ firewall 201's sophistication is a policy creation and management language that enables a modular approach to policy development and management. The policies include three components:
  • Behavior Control Descriptions (BCDs) [0142] 305 are self-contained definitions of behavior for an application or group of applications. BCDs 305 are completely independent, so changes to one BCD 305 cannot affect any other part of the policy.
  • Process Sets (Psets) are logical groupings of processes within a given host (e.g., Interactive Pset, Administrator Pset, IIS Pset, and Exchange Pset). A Pset is associated with a [0143] specific BCD 305. Since a Pset is always associated with only one BCD 305, all processes in the Pset are controlled by the same BCD 305.
  • Process Binding Rules [0144] 306 (PBRs) assign processes to process sets.
  • The [0145] PBRs 306 create a graph of Process Sets. Changes to PBRs 306 only affect process sets reachable from the point of change in the graph.
  • Modular policy development allows easy modifications. A user can be absolutely sure of the limits to the ramifications of one's changes. A user can concentrate on those areas and make sure the changes are safe. New policy development also becomes easier because the system can be divided and concentrated on a piece at a time. The pieces combine in well-defined ways so one doesn't need to know all the detail of everything when combining them. [0146]
  • Some types of global control may require duplicating rules in [0147] several BCDs 305 or Process Sets. The macro capability in the policy language minimizes the actual duplication required.
  • An alternative method for sharing definitions between [0148] BCDs 305 or Process Sets is to define the policy in an object-oriented fashion. This allows common items to be defined in base classes and individual BCDs 305 or Process Sets to extend these base classes with rules unique to the application to which the BCD or Process Set is targeted.
  • Within the modular units, i.e., the [0149] BCDs 305 and PBRs 306, the Rules are order-dependent and the user determines the order. The APPFIRE™ Editor may suggest a default ordering that will work in most cases, but the user is free to adjust that ordering if necessary to achieve their goals. Those users who use the Simple View (see FIG. 5) in the user interface (UI) will never see any Rule lists or need to worry about ordering at all.
  • The modular structure allows a developer to break a complex policy development task into smaller manageable tasks. The smaller tasks are largely independent and have well-defined effects on each other. Similarly, the modularity simplifies modifying existing policies by limiting the amount of knowledge a developer needs about the policy and by clearly defining the ramifications a particular modification might have. Policy components are context-sensitive allowing the same application executed under different circumstances to be controlled differently. The ability to use context information allows creation of more sophisticated system policies thus providing even greater security with more flexibility. [0150]
  • The [0151] APPFIRE™ firewall 201's modular, context-sensitive, graphical view of policy creation and management means that:
  • New application Psets and BCDs can be added easily to policies without impacting existing policy components. [0152]
  • Atomic and global changes can be made to a policy with a clear understanding of the impact of those modifications on system protection. [0153]
  • More secure and finer grain policies can be created. [0154]
  • A protection model can grow with the needs of a diverse and large enterprise without becoming unmanageable. [0155]
  • New Psets and BCDs can be developed concurrently or sequentially by independent groups and combined into policies with a clear understanding of how the resulting policies will provide protection. [0156]
  • A policy can include definitions of well-known attachment points for adding Psets and BCDs developed in the future. The policy author defines these attachment points such that new Psets and BCDs attached to the policy will function correctly. A developer who wants to add a Pset and/or BCD to an existing policy references the attachment point suitable for the new components. For example, if the Pset and BCD are designed to control a custom service, the author could reference the “Service” attachment point. If the Pset and BCD are designed to control an application that can be started in many ways, the author could reference the “System-wide” or “Global” attachment point. In this way, the author of the original policy (who defined the attachment points), the author of the new Pset and BCD (who uses an attachment point), and most importantly, the customer know that the resulting policy will work correctly and provide the desired protection. If a customer attempts to attach a Pset or BCD to an attachment point that does not exist in the policy, the attachment will fail. [0157]
  • The modular policy architecture allows application vendors to build Psets and BCDs for their applications and distribute them along with the applications. The Pset and BCD can protect the vendor's application from harming other parts of the system and keep other applications on the system from harming it. This provides greater assurance to the customer that the application is safe and makes the vendor's application more attractive. [0158]
  • 5.2 Process Sets [0159]
  • In order to control applications, the [0160] APPFIRE™ firewall 201 provides ways to group applications (“decompose the system”), or more accurately, to group processes running applications. These groupings form the basis for subsequent behavior controls enforced by the system.
  • Groups of processes are called Process Sets. [0161] Process Binding Rules 306 map processes to Process Sets (see screen shot of Process Set editor in FIG. 10). Process Binding Rules 306 are context-sensitive to parentage, so that the same application launched by two different methods might be placed in two different Process Sets. The APPFIRE™ Authoring Environment provides a graphical representation of the Process Binding Rules 306 (see FIGS. 8A-8B) to assist the author in understanding the relationships between process sets. Each process belongs to a single Process Set at any point in time. Each Process Set maps to a specific BCD 305. Thus, the behavior controls applied to a process are completely defined by its Process Set. Process Sets are defined using attributes of a process, including:
  • pathname of the file being executed [0162]
  • process identity (including both user and group identities) [0163]
  • process privileges [0164]
  • process command line arguments [0165]
  • additional attributes of the file being executed, including: [0166]
  • file owner [0167]
  • filesystem type [0168]
  • encryption present [0169]
  • object type (file versus link) [0170]
  • remote or local [0171]
  • Any other process attributes available from the system [0172]
  • Combinations of these attributes can also be used. [0173]
  • A Process Set maps each of its descendants to a Process Set. Often, descendants are mapped to the same process set as the parent. But a Process Set can be defined to include all, some, or none of its descendants. An extreme case would have each descendant placed in its own Process Set. [0174]
  • [0175] Process Binding Rules 306 can include dynamic criteria as well as the static process attributes listed above. Dynamic rules assign processes to Process Sets based on operations they perform, such as opening particular files or devices. Dynamic criteria can be combined with static criteria in a single Rule.
  • [0176] Predefined BCDs 305 and Process Binding Rules 306 may be supplied with the APPFIRE™ firewall 201 installation. These can be used as starting points for creating custom policies. All portions of the policy are modifiable by the user.
  • Most modern operating systems allow remote procedure calls, where a server application accepts requests from client applications and the server application performs actions on behalf of the client applications. In some systems, the server application impersonates some aspects of the client application's attributes when making calls on its behalf. In these situations, the [0177] Process Binding Rules 306 can define process sets in terms of the process attributes used on each behavior. So rather than treating all actions of a server process the same, each action can be controlled based on the process set or other attributes of the client application on whose behalf it is being taken.
  • If the behavior control engine can obtain client attributes along with the client request, such as the client's process set assignment, from the operating system in an assured manner, it can make decisions about server application actions based on those client attributes. If such attributes are not available or can't be trusted, then the server application has to be controlled in a more general way, based on its own attributes and behaviors. [0178]
  • Besides the general Process Set definition rules, the [0179] Process Binding Rules 306 include several pseudo-Process Sets to handle special behaviors:
  • Initial Rules: These rules define the Process Set assignments for any applications that are running before the behavior control engine starts. For these applications, there is no parentage history, and the initial rules must take this into account. If the behavior control engine is implemented as part of the operating system, there may be no opportunity for applications to start before the engine. But in the case where the engine is implemented as an addition to an existing operating system, it is likely that some low-level system applications or processes will start before the engine does. [0180]
  • Remote Rules: These rules define the Process Set assignments for any actions take by applications on remote systems against the local system. Depending on the implementation, the behavior control engine may or may not know the normal information about the application taking the action. If the operating system provides information such as the remote application name and identity or the Process Set assignment of the remote application, then the Remote Rules can specify Process Set assignments using those attributes. But in many cases, this information is not available for remote requests. Therefore the Remote Rules have additional capabilities to make Process Set assignments based on the identity of the remote system from which the request has come. [0181]
  • 5.3 Behavior Control Descriptions (BCDs) [0182]
  • The [0183] BCD 305 controls a set of applications, i.e., programs and processes, and defines the acceptable and unacceptable behaviors for those applications. It also defines the actions to take when unacceptable behavior occurs:
  • Applications: some [0184] BCDs 305 are designed for only a single application, e.g., an Outlook BCD 305A or an IIS BCD 305C. Other BCDs are designed for a large number of applications, e.g., an “administrative tool” BCD.
  • Behaviors: some [0185] BCDs 305 include a small number of generic behaviors, e.g., “you cannot write to the D: drive.” Other BCDs 305 might include a large number of more specific behaviors, e.g., “you can only write to the following list of Registry keys.”
  • Actions: the response to an unacceptable behavior will be different depending on the behavior and on the environment. Some actions just record the behavior, e.g., logging or sending alerts. Other actions block the behavior, e.g., deny with an error. [0186]
  • The [0187] APPFIRE™ firewall 201 preferably provides a library of pre-defined BCDs 305. These include generic BCDs 305 for each supported operating system, e.g., Windows 2000 Server, as well as more specific BCDs 305 for popular applications.
  • A typical policy includes a number of [0188] BCDs 305, although it may include as few as one BCD. The specific BCDs 305 used are determined by the applications expected to run on that system and by the granularity of control required on the system. Even if there is no specific BCD 305 for an application, using a generic BCD 305 immediately strengthens the security of the operating system platform and any application running on it. A generic BCD 305 can also be used to protect the base operating system, since an application is only as secure as the base that supports it.
  • The [0189] APPFIRE™ firewall 201 protection is based on behavior definitions, not on signatures of specific files or network commands. A signature-based architecture results in a long list of very specific patterns to recognize and block. When a new attack is mounted, its signature must be determined and added to this list by the vendor. Then it must be deployed to all the protected systems. Until this happens, the attack is free to cause damage to as many systems as it can reach.
  • In contrast to signature approaches, the [0190] APPFIRE™ firewall 201 is based on the concept that each software program accesses certain system resources in certain ways to accomplish its tasks. There are some system resources it must create or modify, i.e., log files, message store, document files, etc. There are other system resources it only needs to read, i.e., configuration data, dynamic libraries, and content. And there are a large number of resources it has no reason to access at all. Many attacks cause damage by “convincing” an application to modify resources that are in the latter two categories.
  • The [0191] BCDs 305 define the acceptable behavior of an application with respect to system resources. By enforcing the BCDs 305, the APPFIRE™ firewall 201 can stop bad behavior without advance knowledge of an attack and before it causes damage to the system. This protection works no matter what method the attacker takes to gain access to the system; it stops automated viruses as well as malicious insider attacks. This behavior-based approach to protection allows the APPFIRE™ firewall 201 to protect against new attacks right away, without the “catch-up” problem of signature-based products.
  • Process Binding Rules [0192] 306 (PBRs, see discussion above) are defined with respect to a particular process set. All Rules in an APPFIRE™ firewall 201 policy are context-sensitive, in other words, they depend on the parentage of the application.
  • BCDs [0193] 305 are self-contained. They divide resources and control access independently of each other. Thus, by dividing the system and constructing the policy from modular components, the APPFIRE™ firewall 201 simplifies the task of creating and modifying system policies. Changes to a particular BCD 305 are guaranteed to affect only that BCD 305. Binding Rule changes for a particular process set have ramifications only for descendant Process Sets, not for the entire system. Thus, when making changes to or extending a policy, the user does not need to deal with the entire policy but, only needs detailed knowledge of the portion being changed. Even changes to the top level Process Sets can be done without affecting the BCDs 305.
  • By suggesting an ordering but allowing adjustments, the APPFIRE™ Editor (see FIGS. [0194] 7A-7B) provides the maximum assistance. For simpler policies, the developer can accept the default ordering. But for complex policies or for developers who think differently, the Editor gives the freedom to order and organize Rules in the most convenient way.
  • All BCD Rules allow one of the following actions: [0195]
  • Deny the operation (optionally specifying an error code to return) [0196]
  • Query an administrator about the operation [0197]
  • Kill the offending process [0198]
  • Shut down the system [0199]
  • Allow the operation [0200]
  • In addition, any BCD Rule can specify to log an event and/or generate profile information when the Rule is matched. All Rules have exactly the same actions. There are no special Rule types that have restricted choices or additional choices. [0201]
  • Since all BCD Rules use the same pattern and have similar choices, the learning curve for configuring policies is low. Once a user knows how to use the Rules, he knows how to use them everywhere. For any action he can control, he has the full range of options for how to control it. This means administrators can concentrate on configuring systems, not on figuring out how to configure them. [0202]
  • 5.4 The APPFIRE™ Profiler [0203]
  • The [0204] APPFIRE™ Profiler 1102 is a set of tools that assist with policy creation. The tools record the behavior of an application, generate an initial BCD 305 or entire policy and allow iterative refinement of the policy. These same tools can be used by customers to generate BCDs 305 for their own custom applications.
  • An APPFIRE™ Profiler (see [0205] element 1102, FIG. 11) assists with BCD creation. The Profiler 1102 uses the recorded behavior of an application, generates an initial BCD 305 and allows iterative refinement of the BCD. An engineer can use these tools to create the pre-defined BCDs 305 distributed with the APPFIRE™ firewall 201. The Profiler 1102 can be used by users to generate BCDs 305 for their own custom applications.
  • The [0206] Profiler 1102 also has the ability to update an existing policy or BCD. In this case, the author gives the Profiler a recording of additional application behavior and an existing policy or BCD. The profiler merges the new behavior into the policy or BCD. This is useful when trying a policy or BCD out in a new environment with new behaviors. It is more efficient to augment the existing policy or BCD than to start from scratch.
  • The [0207] Profiler 1102 can also produce data files instead of policy files. These files are delimited text files suitable for importing into a spreadsheet, database or other analysis tool. A policy author can use this type of output to analyze application or system behavior before generating or modifying policies.
  • 6.0 J2EE Application Server [0208]
  • The [0209] APPFIRE™ firewall 201's management framework is preferably built on a J2EE Application Server architecture. The J2EE Application Server 406 provides several key capabilities for the framework:
  • Application server clustering means that no single point of failure exists. The [0210] J2EE Application Server 406 keeps the clustered machines in sync, automatically distributes work among them, and allows the system to keep running if one machine goes down. In addition, when more capacity is needed, the enterprise can expand the cluster without extensive infrastructure redesign. The Enterprise Java Beans running on the application server isolate the Database 407 from the user interface. This separation makes the APPFIRE™ management framework database-independent. The enterprise can choose a database that best suits its operational and capacity requirements. It can leverage an existing database or acquire a new one.
  • Using Java and following the J2EE standards allows the [0211] Management Infrastructure 402 to run on any platform (NT, UNIX, LINUX, etc).
  • The [0212] Management Infrastructure 402 supports both redundancy and expansion through the use of a J2EE-compliant Application Server 406. The J2EE Application Server 406 includes a clustering capability and automatically distributes work and shares data among the systems.
  • The built-in clustering provided by the [0213] J2EE Application Server 406 is very powerful. It provides redundancy, allowing Agents 304 and administrators to reference the cluster, rather than an individual machine. If one of the systems in the cluster goes down, work is handled by the remaining systems. If the network grows and requires more resources for APPFIRE™ management, the administrator simply needs to add another system to the cluster. The Agents 304 and administrators take advantage of the additional capacity automatically as the cluster distributes work to the new system.
  • The [0214] Management Infrastructure 402 is database-neutral. The J2EE Application Server 406 preferably is supplied with a built-in database 407 suitable for small installations. Larger installations will need a higher capacity database, such as MS SQL or Oracle. The APPFIRE™ firewall 201 supports all of these.
  • Database neutrality gives users extremely flexible configuration options. Small organizations don't have to make a separate database purchase—they can use the built-in [0215] Database 407. If the organization grows beyond the capacity of the built-in Database 407, it can migrate to an external database when necessary. Larger enterprises that have already invested in large database resources can take advantage of them from the start. By supporting the most popular database products, users can use what they are familiar with, rather than needing to learn about a new database product just for the APPFIRE™ firewall 201.
  • 7.0 System Resources Access Control [0216]
  • File access: The [0217] APPFIRE™ firewall 201 controls access to any attributes of files or directories, including:
  • pathname, including wildcards for single and multiple path elements [0218]
  • file owner [0219]
  • file version [0220]
  • filesystem type [0221]
  • encryption present [0222]
  • object type (file versus link) [0223]
  • any other file or directory attributes maintained by the operating system [0224]
  • Any combination of these attributes can be used. [0225]
  • The [0226] APPFIRE™ firewall 201 also provides “short hand” symbols, and allows specification of any environment variable or registry value for system- or application-specific values. Each Rule is part of a BCD 305 and controls all processes in process sets mapped to the BCD 305.
  • The [0227] APPFIRE™ firewall 201 allows individual specification of every operation provided by the operating system. The operations are controlled independently. The UI also provides abstract operations to avoid confusion for novice users. The system ships with predefined BCDs 305, which in turn include file resource maps for common groupings.
  • Registry key control: The [0228] APPFIRE™ firewall 201 controls access to registry keys and values using any attributes of registry keys and values, including:
  • pathname, including wildcards for single and multiple path elements [0229]
  • key/value owner [0230]
  • object type (key versus link) [0231]
  • any other registry attributes maintained by the operating system [0232]
  • Any combination of these attributes can be used. [0233]
  • Each Rule is part of a [0234] BCD 305 and controls all processes in process sets mapped to the BCD 305. The APPFIRE™ firewall 201 allows individual specification of every operation provided by the operating system. The operations can be allowed or denied independently.
  • The UI also provides abstract operations to avoid confusion for novice users. The system ships with [0235] predefined BCDs 305, which in turn include registry resource maps for common groupings.
  • Network socket access: The [0236] APPFIRE™ firewall 201 controls access to network services (i.e., sockets). Sockets are specified by:
  • connection direction (server, client) [0237]
  • protocol & port (e.g., tcp/23) for initial connection and subsequent connections [0238]
  • remote addresses for the connection [0239]
  • local addresses for the connection [0240]
  • The [0241] APPFIRE™ firewall 201 allows separate control of server and client use of a socket. The system ships with predefined BCDs 305, which, in turn, include network resource maps for common protocols.
  • COM component access: The [0242] APPFIRE™ firewall 201 controls access to COM components using either the literal PROGID (friendly name) or the CLSID (GUID). Each rule is part of a BCD 305 and controls all processes in process sets mapped to the BCD 305. Basic granularity of control allows access (or not). The system ships with predefined BCDs 305, which, in turn, include COM resource maps for common groupings.
  • Application control: application control is covered by the general file access control feature. Blocking execute access to the application executable(s) prevents that application from running. Applications can be specified by pathname and any of the other attributes available to file access control rules. The Simple View UI also provides a more intuitive way to block applications from running. [0243]
  • Network worm protection: worms do their damage by accessing resources. The [0244] APPFIRE™ firewall 201 features allow specification of behavior controls to contain or prevent the damage worms can cause. Protection against worms using standard APPFIRE™ firewall 201 behavior control provides full flexibility to choose which processes are subject to the controls. Protection against worms using standard APPFIRE™ firewall 201 behavior control provides full flexibility to Deny (with the full range of denial responses), Log or both.
  • 8.0 Example—CodeRed worm [0245]
  • To illustrate how the [0246] APPFIRE™ firewall 201 protects a system, let us examine the CodeRed worm. The CodeRed worm attacks Windows 2000 systems via a buffer overflow vulnerability in Microsoft IIS. When it successfully infects a web server, it has three main behaviors:
  • Some variants “deface” web pages with a “Hacked by Chinese” message. This defacement occurs entirely in memory. Web page files on disk are not altered. [0247]
  • Some variants create a Trojan Horse file in the root directories of the systems hard drives. When executed, this Trojan Horse modifies two registry keys to make certain system directories remotely accessible and copies the Windows cmd.exe program to these directories. If successful, these actions create a backdoor, allowing the attacker to access the system remotely at any time in the future. [0248]
  • All variants initiate HTTP connections to other Web servers, searching for new machines to infect. [0249]
  • Under normal conditions, a Web server has no reason to modify system registry keys or to create files in system directories. Rather, it should only read system registry keys and directories. An APPFIRE™ behavior control description for a Web server would define reading system registry keys and directories as appropriate behavior, and modifying these same keys and directories as inappropriate behavior that should be blocked. If the CodeRed worm attacked a Web server protected by the [0250] APPFIRE™ firewall 201, its attempts to modify the registry to open security holes would be denied. Similarly, its attempts to create programs in the sensitive root directories would also be denied.
  • Further, most Web servers have no reason to initiate outbound HTTP connections. Instead, they listen for incoming HTTP connections and respond. The [0251] BCD 305 would define network access for listening and responding as appropriate behavior and network access for initiating connections to other systems as inappropriate behavior. When the CodeRed worm tried to spread itself, the APPFIRE™ behavior control engine 302 would deny attempts to create a network connection. If there were legitimate reasons for a particular Web server to initiate connections to remote systems, the BCD 305 could be customized to list specific systems to which connections should be permitted. Alternatively, the BCD 305 could specify a maximum permitted rate for creating outbound connections. When the Web server's behavior exceeds this rate, the APPFIRE™ behavior control engine 302 can deny further connections.
  • This example illustrates how a [0252] BCD 305 can define the appropriate behavior of a Web server and contain the damage that an attack like the CodeRed worm can cause. The APPFIRE™ firewall 201 does not prevent the worm from infecting the Web server, but it does prevent the worm from using the compromised Web server to damage critical server or operating system resources. Note that since the defacing of Web pages happens entirely in memory, it does not result in behavior the APPFIRE™ firewall 201 behavior control engine 302 controls. So the CodeRed worm would be able to deface Web pages, but only until the vulnerability is closed and the system rebooted.
  • The [0253] BCD 305 defines behaviors in terms of what is appropriate and inappropriate for a Web server. As such, the BCD 305 prevents damage from any attack that attempts to modify system registry keys or directories. It is not limited simply to the CodeRed-specific pattern of damage.
  • 9.0 APPFIRE™ Case Studies [0254]
  • 9.1 Protecting Against Malicious Employees [0255]
  • A typical business maintains a large amount of critical and sensitive data on internal servers. If this data were destroyed or even disclosed, the business would suffer considerable damage. Attacks on this data from outside are one concern, but attacks by malicious employees are also not unusual. [0256]
  • The critical data must be shared by groups of employees so the internal servers containing it must be connected to the company network. Unfortunately, this is the same network that the malicious employee has access to. Consequently, the internal servers are subject to attack. A malicious employee can take advantage of vulnerabilities in the basic operating system software and applications, just as an outside attacker might. He or she can also use additional attack methods, such as stealing passwords or using unlocked, logged-in terminals. [0257]
  • The result is the IT department must spend at least as much effort to deploy anti-virus signature updates and application or OS patches on internal servers as on external servers. This is an on-going, time-consuming task diverting IT resources from more constructive work. Furthermore, the possibility of additional types of attacks requires additional effort to monitor internal servers and enforce proper user behavior. The [0258] APPFIRE™ firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, an APPFIRE™ firewall 201 policy describes the permitted or denied behaviors of an application. If the application attempts denied behaviors, the APPFIRE™ firewall 201 stops the action.
  • The [0259] APPFIRE™ firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, a BCD describes the permitted or denied behaviors of an application. If the application attempts denied behaviors, the APPFIRE™ firewall 201 stops the action.
  • Pre-defined behavior policies are provided for common operating systems and servers, including Windows and the IIS server. A company desiring to protect its internal Windows servers would deploy The [0260] APPFIRE™ firewall 201 on those servers and apply the pre-defined Windows OS policy. This BCD describes the permitted behavior of the base Windows operating system components. It also contains options for common Windows server features and applications. The IT department can select those features and applications required on the server and the APPFIRE™ firewall 201 adjusts the policy appropriately.
  • The pre-defined Windows server policy includes descriptions of the permitted behavior of interactive applications, such as MS Office and e-mail applications. On a server system, these applications are restricted to reading or writing a very small set of files, blocking their use to steal or damage critical business data. Certain applications, such as e-mail readers, can be prevented from running altogether. Users would have to read their email from their workstation. [0261]
  • By having a security solution that is independent of the means of attack, the IT department is no longer under severe pressure to deploy anti-virus signature updates and test and install patches immediately. IT can establish a regular maintenance schedule for the updates and patches and be confident that the [0262] APPFIRE™ firewall 201 protects the un-patched application from damaging the system in the meantime. In addition, by confining the behavior of interactive applications running on the servers, the APPFIRE™ firewall 201 goes beyond protecting against application bugs or viruses, and blocks the use of typical applications in undesirable ways.
  • 9.2 Protecting Custom Applications [0263]
  • Standard Web, Transaction and Mail servers don't solve every business problem. Most businesses have unique needs and they often require custom applications to meet them. These custom applications are just as critical to businesses as the standard servers and applications they use. Attacks on and damage to custom applications cost businesses money. [0264]
  • Not only are the custom applications just as critical, if they are deployed on public networks, they are also just as vulnerable to attack. Even if the custom application is perfectly implemented, a flawed operating system foundation will make it vulnerable. So the IT department must spend the same effort on anti-virus updates and OS patches that it would for a standard server with no custom application. [0265]
  • Of course, custom applications are not built perfectly and have vulnerabilities of their own. These vulnerabilities are not going to be discovered and fixed as readily as those of more popular applications because there are fewer people looking for them. In fact, it's likely that the only people looking for them are attackers. This means they could be found and exploited for longer periods of time than flaws in standard software. This becomes an additional concern for the IT department. [0266]
  • The [0267] APPFIRE™ firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, a BCD describes the permitted or denied behaviors of an application. If the application attempts denied behaviors, the APPFIRE™ firewall 201 stops the action. This behavior control can be applied to custom applications just as easily as to popular applications.
  • A business desiring to protect a custom application would define a custom behavior policy. The [0268] APPFIRE™ firewall 201 provides pre-defined behavior policies for common operating systems and servers. The custom policy would begin with a pre-defined OS policy. This policy controls the behavior of the base operating system components and provides the custom application with a more secure platform for execution.
  • The custom policy is completed by writing behavior controls for the custom application. The policy author first analyzes the behavior of the custom application, combining design knowledge of the application (if available) with profiles of actual behavior. Using this data, the author uses the APPFIRE™ Authoring Environment to create a new behavior control description for the custom application. Finally, the author modifies the [0269] Process Binding Rules 306 to map the custom application to the BCD 305. The resulting policy contains both the pre-defined OS controls and the custom controls for the custom application.
  • Custom applications often co-exist with standard applications, such as Web servers. The pre-defined policies include behavior controls for standard applications. These behavior controls confine each application so that a problem in one application cannot undermine another application. The custom application is protected from intrusions into the standard applications and vice versa. [0270]
  • By having a security solution that is independent of the means of attack, the IT department is no longer under severe pressure to deploy anti-virus signature updates and test and install OS patches immediately. IT can establish a regular maintenance schedule for the updates and patches and be confident that the [0271] APPFIRE™ firewall 201 protects the un-patched OS from damaging the custom application in the meantime. The worry of vulnerabilities in the custom application is reduced because the behavior of the application is controlled. Vulnerabilities cannot cause it to damage other applications on the system and vulnerabilities in other applications cannot cause them to damage the custom application.
  • 9.3 Protecting Public IIS Servers [0272]
  • Businesses use IIS Web servers for a variety of reasons. Some simply display corporate information to the public, e.g., product marketing documents, corporate press releases, etc. Others are integral parts of the company's daily operations, e.g., on-line stores, customer support servers, etc. In either case, attacks on the IIS server cost the business money. Customers cannot find the information they need and cannot interact with the company to do business. [0273]
  • Since the purpose of these IIS Web servers is to interact with the public, they must be connected to a public network. Consequently, the servers are subject to constant attack. The types of attacks are always changing, as evidenced by the stream of virus announcements from the anti-virus vendors and of patch notifications from Microsoft. The attacks and patches are not limited just to the Web server software. Vulnerabilities in the basic Windows operating system software are also common and just as serious. [0274]
  • The result is a constant stream of work for the IT department to find, test and deploy anti-virus signature updates and application or OS patches. This is a time consuming task diverting IT resources from more constructive work. Since the solutions are targeted at specific attacks on specific vulnerabilities, they generally don't help stop new attack methods. [0275]
  • The [0276] APPFIRE™ firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, a policy describes the permitted or denied behaviors of the applications on the system. If the application attempts denied behaviors, the APPFIRE™ firewall 201 stops the action.
  • Pre-defined behavior policies for common operating systems and servers are provided, including Windows and the IIS server. A company desiring to protect its public IIS Web servers would deploy the [0277] APPFIRE™ firewall 201 on those servers and apply the pre-defined IIS server policy. This policy describes the permitted behavior of the IIS server itself and of the base Windows operating system components. If an attack is launched against the IIS server, and the attacker tries to fool or force the Web application to access resources outside of its permitted set, the APPFIRE™ firewall 201 will see the attempt and block it. Attacks against the Windows OS components are stopped in a similar manner.
  • By having a security solution that is independent of the means of attack, the IT department is no longer under severe pressure to deploy anti-virus signature updates and test and install patches immediately. IT can establish a regular maintenance schedule for the updates and patches and be confident that the [0278] APPFIRE™ firewall 201 protects the un-patched application from damaging the system in the meantime.
  • The IIS server software has a large number of features. Besides providing Web services, it can provide FTP and News services, dynamic page generation, etc. Vulnerabilities are usually specific to a feature. The [0279] APPFIRE™ firewall 201 pre-defined policies provide options to specify which IIS server features are required by the business. For features that are not required, the policy can deny access to resources needed only by that specific feature. In this way, a business can customize the behavior policy for their specific needs and get even more protection than from a completely generic policy.
  • 9.4 Managing Policy in Large Organizations [0280]
  • In large organizations, responsibility for managing critical server systems is often spread across several groups. It is not unusual for one central group to be responsible for translating the organization's general security policy into specific security configurations for individual applications. The responsibility for day-to-day operations of the servers is often held by another group, or possibly several groups at several sites. Sometimes this division of responsibilities is a result of the availability of different skills sets; sometimes a result of organizational policy or legal restrictions. [0281]
  • With responsibility divided in this way, each group needs to have confidence that it has the means to do their job without interference, intentional or accidental, from the other groups. The policy group wants to configure applications in a way that meets the organization's general policy and wants to be sure the operational group can't violate it. The operational group wants to be able to reconfigure applications as necessary to keep the servers running. It needs to react quickly to new circumstances or problems and doesn't want to be prevented from changing configurations to do so. [0282]
  • The [0283] APPFIRE™ firewall 201 provides intrusion prevention protection based on application behavior. Rather than define a set of signatures describing specific attacks against specific vulnerabilities, a policy describes the permitted or denied behaviors of an application. If the application attempts denied behaviors, the APPFIRE™ firewall 201 stops the action. Pre-defined behavior policies for common operating systems and server applications are provided.
  • The [0284] APPFIRE™ Manager 401 provides powerful tools to support a two-tiered management system. The operational group may not have detailed knowledge of application behavior. The Enterprise Manager accounts for this and provides a Simple View (see FIG. 5) of the policy that shows options in terms of application features rather than application behavior. The policy group, on the other hand, likely has detailed knowledge of application behavior. It can use the Authoring Environment, with its more sophisticated Graphical View (see FIGS. 7A-8B) to understand a pre-defined policy or create a custom policy for the organization.
  • The policy group can customize a pre-defined policy in several ways. If some or all of the Simple View options could violate the organization's general policy, the policy group can select a safe choice for each option and remove them as options from the policy. This eliminates the possibility of the operational group making a wrong choice. If the operational group needs some additional options not provided by the pre-defined policy, the policy group can create new options in the policy. The Authoring Environment provides the ability to define options for the Simple View and define the detailed behavior controls to be used for each choice. The policy group would define these new options such that any choice is in accordance with the organization's policy. Finally, if the organization has custom applications, the policy group can create BCDs for these applications and include them in the custom policy. This ensures that the custom applications are controlled in a consistent way across the organization. [0285]
  • The resulting custom policy satisfies both groups. The policy group has defined the policy to support the organization's general security policy. Any choices that would violate the organization's policy have been removed and any special circumstances have been accounted for by additions to the policy. The operational group is satisfied because the custom policy contains the flexibility it needs to deal with operational issues and it does not contain options that might violate the organization's general policy. [0286]
  • By having a security solution that is independent of the means of attack, the operational group is no longer under severe pressure to deploy anti-virus signature updates or install patches immediately. It can establish a regular maintenance schedule for the updates and patches and be confident that the [0287] APPFIRE™ firewall 201 protects the un-patched systems in the meantime.
  • It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. Thus, the breadth and scope of the present invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents. [0288]
  • 9.5 Reducing the Time-Criticality of Patches [0289]
  • Many large organizations have written policies that require application of any security-related operating system or application patches as soon as they are released. Microsoft released [0290] 72 critical security patches during 2002. This means that administrators in a large organization may have had to apply more than one patch a week in order to comply with the written policies.
  • Typically patch descriptions released by vendors describe the problem, the possible consequences if an attacker exploits the problem and include a list of conditions under which the patch would or would not be required. For example, “If you don't have application A installed, you don't need this patch.” Administrators can use these conditions to determine whether any particular patch is relevant to their specific configurations and in this way reduce the number of patches they actually have to apply. [0291]
  • By installing [0292] APPFIRE™ Agents 304 on their critical systems, administrators can reduce the number of patch conditions that apply to those systems. The pre-defined APPFIRE™ policies confine many standard operating system services to only the behaviors necessary for their required features. Thus, a patch that fixes a problem that would allow an attacker to cause an operating system service to exhibit a non-normal behavior would not be critical on an APPFIRE™-protected system. APPFIRE™ would stop the undesired behavior.
  • This does not mean patches should never be applied to APPFIRE™ Agent systems. But it does mean that fewer patches are critical and would need to be applied immediately after being released. This allows administrators to group patches and schedule patch applications less frequently and at more convenient times. [0293]
  • It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. Thus, the breadth and scope of the present invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents. [0294]

Claims (36)

What is claimed is:
1. A method of protecting a system from unauthorized use comprising:
decomposing processes running on a system into a plurality of process sets, wherein each process set has a corresponding behavior control description; and
controlling access to system resources by each process based on a behavior control description for the process set to which the process belongs.
2. The method of claim 1, wherein each process is a thread.
3. The method of claim 1, wherein each process is an application.
4. The method of claim 1, wherein the behavior control description includes at least one grant access/deny access rule based on any one of: process parentage, pathname, file owner, file system type, encryption presence, object type, connection direction, protocol, port, and remote address.
5. The method of claim 1, wherein the behavior control description is based on a single action by the process.
6. The method of claim 1, wherein the behavior control description is based on a sequence of actions by the process.
7. The method of claim 1, wherein the controlling step includes any one of: accessing resources on another server, using a network socket, reading a file, and writing to a file.
8. The method of claim 1, wherein modifying a behavior control description for one process set does not affect other behavior control descriptions for other process sets.
9. A method of protecting a system from unauthorized use comprising:
identifying processes running on a system, wherein each process has an independent behavior control description; and
controlling access to system resources by each process based on the behavior control description for the process.
10. The method of claim 9, wherein the independent behavior control description includes at least one grant access/deny access rule based on any one of: process parentage, pathname, file owner, file system type, encryption presence, object type, connection direction, protocol, port, and remote address.
11. The method of claim 9, wherein the independent behavior control description is based on a single action by the process.
12. The method of claim 9, wherein the independent behavior control description is based on a sequence of actions by the process.
13. The method of claim 9, wherein the controlling step includes any one of: accessing resources on another server, using a network socket, reading a file, and writing to a file.
14. The method of claim 9, wherein modifying a behavior control description for one process set does not affect other behavior control descriptions for other process sets.
15. A method of protecting a system from attack comprising:
monitoring processes running on a system;
identifying behavior of the processes and attributes of the processes;
grouping the processes into process sets based on commonality of attributes; and
generating behavior control descriptions for each process set.
16. The method of claim 15, wherein each behavior control description includes at least one grant access/deny access rule based on any one of: process parentage, pathname, file owner, file system type, encryption presence, object type, connection direction, protocol, port, and remote address.
17. The method of claim 15, wherein each behavior control description is based on a single action by the process.
18. The method of claim 15, wherein each behavior control description is based on a sequence of actions by the process.
19. The method of claim 15, wherein modifying a behavior control description for one process set does not affect other behavior control descriptions for other process sets.
20. A system for protecting a system from unauthorized use comprising:
means for decomposing processes running on a system into a plurality of process sets, wherein each process set has a corresponding behavior control description; and
means for controlling access to system resources by each process based on a behavior control description for the process set to which the process belongs.
21. The system of claim 20, wherein each process is a thread.
22. The system of claim 20, wherein each process is an application.
23. The system of claim 20, wherein the behavior control description includes at least one grant access/deny access rule based on any one of: process parentage, pathname, file owner, file system type, encryption presence, object type, connection direction, protocol, port, and remote address.
24. The system of claim 20, wherein each behavior control description is based on a single action by the process.
25. The system of claim 20, wherein each behavior control description is based on a sequence of actions by the process.
26. The system of claim 20, wherein each controlling step includes any one of: accessing resources on another server, using a network socket, reading a file, and writing to a file.
27. The system of claim 20, wherein modifying a behavior control description for one process set does not affect other behavior control descriptions for other process sets.
28. A system for protecting a system from unauthorized use comprising:
means for identifying processes running on a system, wherein each process has an independent behavior control description; and
means for controlling access to system resources by each process based on the behavior control description for the process.
29. The system of claim 28, wherein the independent behavior control description includes at least one grant access/deny access rule based on any one of: process parentage, pathname, file owner, file system type, encryption presence, object type, connection direction, protocol, port, and remote address.
30. The system of claim 28, wherein the independent behavior control description is based on a single action by the process.
31. The system of claim 28, wherein the independent behavior control description is based on a sequence of actions by the process.
32. The system of claim 28, wherein modifying a behavior control description for one process set does not affect other behavior control descriptions for other process sets.
33. A system for protecting a system from attack comprising:
means for monitoring processes running on a system;
means for identifying behavior of the processes and attributes of the processes;
means for grouping the processes into process sets based on commonality of attributes; and
means for generating behavior control descriptions for each process set.
34. A computer program product for protecting a system from unauthorized use, the computer program product comprising a computer useable medium having computer program logic recorded thereon for controlling a processor, the computer program logic comprising:
means for enabling a processor to decompose processes running on a system into a plurality of process sets, wherein each process set has a corresponding behavior control description; and
means for enabling a processor to control access to system resources by each process based on a behavior control description for the process set to which the process belongs.
35. A system for protecting a system from unauthorized use comprising:
means for enabling a processor to identify processes running on a system, wherein each process has an independent behavior control description; and
means for enabling a processor to control access to system resources by each process based on the behavior control description for the process.
36. A system for protecting a system from attack comprising:
means for enabling a processor to monitor processes running on a system;
means for enabling a processor to identify behavior of the processes and attributes of the processes;
means for enabling a processor to group the processes into process sets based on commonality of attributes; and
means for enabling a processor to generate behavior control descriptions for each process set.
US10/345,137 2003-01-16 2003-01-16 Behavior-based host-based intrusion prevention system Abandoned US20040143749A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US10/345,137 US20040143749A1 (en) 2003-01-16 2003-01-16 Behavior-based host-based intrusion prevention system
PCT/US2004/000736 WO2004066112A2 (en) 2003-01-16 2004-01-14 Behavior-based host-based intrusion prevention system
US11/009,704 US7657927B2 (en) 2003-01-16 2004-12-13 Behavior-based host-based intrusion prevention system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US10/345,137 US20040143749A1 (en) 2003-01-16 2003-01-16 Behavior-based host-based intrusion prevention system

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US11/009,704 Continuation US7657927B2 (en) 2003-01-16 2004-12-13 Behavior-based host-based intrusion prevention system

Publications (1)

Publication Number Publication Date
US20040143749A1 true US20040143749A1 (en) 2004-07-22

Family

ID=32711886

Family Applications (2)

Application Number Title Priority Date Filing Date
US10/345,137 Abandoned US20040143749A1 (en) 2003-01-16 2003-01-16 Behavior-based host-based intrusion prevention system
US11/009,704 Active 2026-11-30 US7657927B2 (en) 2003-01-16 2004-12-13 Behavior-based host-based intrusion prevention system

Family Applications After (1)

Application Number Title Priority Date Filing Date
US11/009,704 Active 2026-11-30 US7657927B2 (en) 2003-01-16 2004-12-13 Behavior-based host-based intrusion prevention system

Country Status (2)

Country Link
US (2) US20040143749A1 (en)
WO (1) WO2004066112A2 (en)

Cited By (171)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050039042A1 (en) * 2003-07-21 2005-02-17 Trend Micro Incorporated, A Japanese Corporation Adaptive computer worm filter and methods of use thereof
US20050108384A1 (en) * 2003-10-23 2005-05-19 Lambert John R. Analysis of message sequences
US20050165882A1 (en) * 2003-12-23 2005-07-28 Alcatel Terminal with means of protection against malfunctions of certain java applications
US20060018478A1 (en) * 2004-07-23 2006-01-26 Diefenderfer Kristopher G Secure communication protocol
US20060021051A1 (en) * 2004-07-23 2006-01-26 D Mello Kurt Determining technology-appropriate remediation for vulnerability
US20060026684A1 (en) * 2004-07-20 2006-02-02 Prevx Ltd. Host intrusion prevention system and method
US20060026678A1 (en) * 2004-07-29 2006-02-02 Zakas Phillip H System and method of characterizing and managing electronic traffic
US20060026683A1 (en) * 2004-07-30 2006-02-02 Lim Keng Leng A Intrusion protection system and method
US20060053475A1 (en) * 2004-09-03 2006-03-09 Bezilla Daniel B Policy-based selection of remediation
US20060053134A1 (en) * 2004-09-03 2006-03-09 Durham Roderick H Centralized data transformation
US20060053265A1 (en) * 2004-09-03 2006-03-09 Durham Roderick H Centralized data transformation
US20060053476A1 (en) * 2004-09-03 2006-03-09 Bezilla Daniel B Data structure for policy-based remediation selection
US20060117065A1 (en) * 2004-11-30 2006-06-01 Bezeau Jonathan R Methods and apparatuses for providing hosted tailored vertical applications
US20060206940A1 (en) * 2005-03-14 2006-09-14 Strauss Christopher J Computer security intrusion detection system for remote, on-demand users
US20070094725A1 (en) * 2005-10-21 2007-04-26 Borders Kevin R Method, system and computer program product for detecting security threats in a computer network
GB2432687A (en) * 2005-11-25 2007-05-30 Mcafee Inc Preventing spyware/malware from installing in a registry
WO2007091829A1 (en) 2006-02-10 2007-08-16 Samsung Electronics Co., Ltd. Apparatus and method for using information on malicious application behaviors among devices
US20070226031A1 (en) * 2004-11-30 2007-09-27 Manson Nicholas R Methods and apparatuses for grouped option specification
US20070239467A1 (en) * 2004-11-30 2007-10-11 Bezeau Jonathan R Methods and apparatuses for providing provisioned access control for hosted tailored vertical applications
US20070240106A1 (en) * 2004-11-30 2007-10-11 Manson Nicholas R Methods and apparatuses for tiered option specification
US20080034425A1 (en) * 2006-07-20 2008-02-07 Kevin Overcash System and method of securing web applications across an enterprise
US20080046964A1 (en) * 2004-12-22 2008-02-21 Nithya Muralidharan Enabling relational databases to incorporate customized intrusion prevention policies
US20080047009A1 (en) * 2006-07-20 2008-02-21 Kevin Overcash System and method of securing networks against applications threats
US20080098476A1 (en) * 2005-04-04 2008-04-24 Bae Systems Information And Electronic Systems Integration Inc. Method and Apparatus for Defending Against Zero-Day Worm-Based Attacks
US7603552B1 (en) 2005-05-04 2009-10-13 Mcafee, Inc. Piracy prevention using unique module translation
US7620983B1 (en) * 2004-03-16 2009-11-17 Symantec Corporation Behavior profiling
US20100100970A1 (en) * 2006-02-02 2010-04-22 Rahul Roy-Chowdhury Enforcing alignment of approved changes and deployed changes in the software change life-cycle
US20100153853A1 (en) * 2008-08-25 2010-06-17 Dawes Paul J Networked Touchscreen With Integrated Interfaces
US20100199353A1 (en) * 2004-07-23 2010-08-05 Fortinet, Inc. Vulnerability-based remediation selection
US7797752B1 (en) * 2003-12-17 2010-09-14 Vimal Vaidya Method and apparatus to secure a computing environment
US20100235915A1 (en) * 2009-03-12 2010-09-16 Nasir Memon Using host symptoms, host roles, and/or host reputation for detection of host infection
US7832005B1 (en) * 2004-11-29 2010-11-09 Symantec Corporation Behavioral learning based security
US20100293225A1 (en) * 2004-03-22 2010-11-18 Mcafee, Inc. Containment of network communication
US7840968B1 (en) 2003-12-17 2010-11-23 Mcafee, Inc. Method and system for containment of usage of language interfaces
US7856661B1 (en) 2005-07-14 2010-12-21 Mcafee, Inc. Classification of software on networked systems
US7870387B1 (en) * 2006-04-07 2011-01-11 Mcafee, Inc. Program-based authorization
US7873955B1 (en) 2004-09-07 2011-01-18 Mcafee, Inc. Solidifying the executable software set of a computer
US7895651B2 (en) 2005-07-29 2011-02-22 Bit 9, Inc. Content tracking in a network security system
US7895573B1 (en) 2006-03-27 2011-02-22 Mcafee, Inc. Execution environment file inventory
US7895448B1 (en) * 2004-02-18 2011-02-22 Symantec Corporation Risk profiling
US20110047542A1 (en) * 2009-08-21 2011-02-24 Amit Dang System and Method for Enforcing Security Policies in a Virtual Environment
US20110047543A1 (en) * 2009-08-21 2011-02-24 Preet Mohinder System and Method for Providing Address Protection in a Virtual Environment
US7950056B1 (en) * 2006-06-30 2011-05-24 Symantec Corporation Behavior based processing of a new version or variant of a previously characterized program
US20110179491A1 (en) * 2005-01-14 2011-07-21 Mcafee, Inc., A Delaware Corporation System, method and computer program product for context-driven behavioral heuristics
US8195931B1 (en) 2007-10-31 2012-06-05 Mcafee, Inc. Application change control
US8272058B2 (en) 2005-07-29 2012-09-18 Bit 9, Inc. Centralized timed analysis in a network security system
US8332929B1 (en) 2007-01-10 2012-12-11 Mcafee, Inc. Method and apparatus for process enforced configuration management
WO2013000079A1 (en) * 2011-06-28 2013-01-03 International Business Machines Corporation Systems and methods for fast detection and diagnosis of system outages
US8352930B1 (en) 2006-04-24 2013-01-08 Mcafee, Inc. Software modification by group to minimize breakage
EP2615792A1 (en) * 2012-01-12 2013-07-17 ARXCEO Corporation Methods and Systems for Providing Network Protection by Progressive Degradation of Service
US8515075B1 (en) 2008-01-31 2013-08-20 Mcafee, Inc. Method of and system for malicious software detection using critical address space protection
US8539063B1 (en) 2003-08-29 2013-09-17 Mcafee, Inc. Method and system for containment of networked application client software by explicit human input
US8544003B1 (en) 2008-12-11 2013-09-24 Mcafee, Inc. System and method for managing virtual machine configurations
US8549003B1 (en) 2010-09-12 2013-10-01 Mcafee, Inc. System and method for clustering host inventories
US8555404B1 (en) 2006-05-18 2013-10-08 Mcafee, Inc. Connectivity-based authorization
US20130276109A1 (en) * 2006-07-11 2013-10-17 Mcafee, Inc. System, method and computer program product for detecting activity in association with program resources that has at least a potential of an unwanted effect on the program
US8615502B2 (en) 2008-04-18 2013-12-24 Mcafee, Inc. Method of and system for reverse mapping vnode pointers
US8694738B2 (en) 2011-10-11 2014-04-08 Mcafee, Inc. System and method for critical address space protection in a hypervisor environment
US8713668B2 (en) 2011-10-17 2014-04-29 Mcafee, Inc. System and method for redirected firewall discovery in a network environment
US8739272B1 (en) 2012-04-02 2014-05-27 Mcafee, Inc. System and method for interlocking a host and a gateway
US8800024B2 (en) 2011-10-17 2014-08-05 Mcafee, Inc. System and method for host-initiated firewall discovery in a network environment
US20140325490A1 (en) * 2013-04-25 2014-10-30 Hewlett-Packard Development Company, L.P. Classifying Source Code Using an Expertise Model
US8925101B2 (en) 2010-07-28 2014-12-30 Mcafee, Inc. System and method for local protection against malicious software
US8938800B2 (en) 2010-07-28 2015-01-20 Mcafee, Inc. System and method for network level protection against malicious software
US8973144B2 (en) 2011-10-13 2015-03-03 Mcafee, Inc. System and method for kernel rootkit protection in a hypervisor environment
US8973146B2 (en) 2012-12-27 2015-03-03 Mcafee, Inc. Herd based scan avoidance system in a network environment
US8984636B2 (en) 2005-07-29 2015-03-17 Bit9, Inc. Content extractor and analysis system
US9069586B2 (en) 2011-10-13 2015-06-30 Mcafee, Inc. System and method for kernel rootkit protection in a hypervisor environment
US9075993B2 (en) 2011-01-24 2015-07-07 Mcafee, Inc. System and method for selectively grouping and managing program files
US9112830B2 (en) 2011-02-23 2015-08-18 Mcafee, Inc. System and method for interlocking a host and a gateway
US9287727B1 (en) 2013-03-15 2016-03-15 Icontrol Networks, Inc. Temporal voltage adaptive lithium battery charger
US9306809B2 (en) 2007-06-12 2016-04-05 Icontrol Networks, Inc. Security system with networked touchscreen
US9349276B2 (en) 2010-09-28 2016-05-24 Icontrol Networks, Inc. Automated reporting of account and sensor information
US9412248B1 (en) 2007-02-28 2016-08-09 Icontrol Networks, Inc. Security, monitoring and automation controller access and use of legacy security control panel information
US9424154B2 (en) 2007-01-10 2016-08-23 Mcafee, Inc. Method of and system for computer system state checks
US9450776B2 (en) 2005-03-16 2016-09-20 Icontrol Networks, Inc. Forming a security network including integrated security system components
US20160274759A1 (en) 2008-08-25 2016-09-22 Paul J. Dawes Security system with networked touchscreen and gateway
US9510065B2 (en) 2007-04-23 2016-11-29 Icontrol Networks, Inc. Method and system for automatically providing alternate network access for telecommunications
US9531593B2 (en) 2007-06-12 2016-12-27 Icontrol Networks, Inc. Takeover processes in security network integrated with premise security system
US9552497B2 (en) 2009-11-10 2017-01-24 Mcafee, Inc. System and method for preventing data loss using virtual machine wrapped applications
US20170041334A1 (en) * 2014-03-28 2017-02-09 Juniper Networks, Inc. Detecting past intrusions and attacks based on historical network traffic information
US9578052B2 (en) 2013-10-24 2017-02-21 Mcafee, Inc. Agent assisted malicious application blocking in a network environment
US9594881B2 (en) 2011-09-09 2017-03-14 Mcafee, Inc. System and method for passive threat detection using virtual memory inspection
US9609003B1 (en) 2007-06-12 2017-03-28 Icontrol Networks, Inc. Generating risk profile using data of home monitoring and security system
US9621408B2 (en) 2006-06-12 2017-04-11 Icontrol Networks, Inc. Gateway registry methods and systems
US9628440B2 (en) 2008-11-12 2017-04-18 Icontrol Networks, Inc. Takeover processes in security network integrated with premise security system
US9729342B2 (en) 2010-12-20 2017-08-08 Icontrol Networks, Inc. Defining and implementing sensor triggered response rules
US9867143B1 (en) 2013-03-15 2018-01-09 Icontrol Networks, Inc. Adaptive Power Modulation
US9928975B1 (en) 2013-03-14 2018-03-27 Icontrol Networks, Inc. Three-way switch
US9967283B2 (en) * 2014-09-14 2018-05-08 Sophos Limited Normalized indications of compromise
US20180191682A1 (en) * 2015-08-19 2018-07-05 Huawei Technologies Co., Ltd. Method and apparatus for deploying security access control policy
US10027689B1 (en) * 2014-09-29 2018-07-17 Fireeye, Inc. Interactive infection visualization for improved exploit detection and signature generation for malware and malware families
US10051078B2 (en) 2007-06-12 2018-08-14 Icontrol Networks, Inc. WiFi-to-serial encapsulation in systems
US10062245B2 (en) 2005-03-16 2018-08-28 Icontrol Networks, Inc. Cross-client sensor user interface in an integrated security network
US10062273B2 (en) 2010-09-28 2018-08-28 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US10078958B2 (en) 2010-12-17 2018-09-18 Icontrol Networks, Inc. Method and system for logging security event data
US10079839B1 (en) 2007-06-12 2018-09-18 Icontrol Networks, Inc. Activation of gateway device
US10091014B2 (en) 2005-03-16 2018-10-02 Icontrol Networks, Inc. Integrated security network with security alarm signaling system
US10127801B2 (en) 2005-03-16 2018-11-13 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US10142392B2 (en) 2007-01-24 2018-11-27 Icontrol Networks, Inc. Methods and systems for improved system performance
US10156959B2 (en) 2005-03-16 2018-12-18 Icontrol Networks, Inc. Cross-client sensor user interface in an integrated security network
US10156831B2 (en) 2004-03-16 2018-12-18 Icontrol Networks, Inc. Automation system with mobile interface
US10200504B2 (en) 2007-06-12 2019-02-05 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks
US10237237B2 (en) 2007-06-12 2019-03-19 Icontrol Networks, Inc. Communication protocols in integrated systems
US10313303B2 (en) 2007-06-12 2019-06-04 Icontrol Networks, Inc. Forming a security network including integrated security system components and network devices
US10339791B2 (en) 2007-06-12 2019-07-02 Icontrol Networks, Inc. Security network integrated with premise security system
US10339288B2 (en) * 2013-12-12 2019-07-02 Mcafee, Llc User authentication for mobile devices using behavioral analysis
US10348575B2 (en) 2013-06-27 2019-07-09 Icontrol Networks, Inc. Control system user interface
US10365810B2 (en) 2007-06-12 2019-07-30 Icontrol Networks, Inc. Control system user interface
US10382452B1 (en) 2007-06-12 2019-08-13 Icontrol Networks, Inc. Communication protocols in integrated systems
US10380871B2 (en) 2005-03-16 2019-08-13 Icontrol Networks, Inc. Control system user interface
US10389736B2 (en) 2007-06-12 2019-08-20 Icontrol Networks, Inc. Communication protocols in integrated systems
US10423309B2 (en) 2007-06-12 2019-09-24 Icontrol Networks, Inc. Device integration framework
US10498830B2 (en) 2007-06-12 2019-12-03 Icontrol Networks, Inc. Wi-Fi-to-serial encapsulation in systems
US10522026B2 (en) 2008-08-11 2019-12-31 Icontrol Networks, Inc. Automation system user interface with three-dimensional display
US10523689B2 (en) 2007-06-12 2019-12-31 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks
US10530839B2 (en) 2008-08-11 2020-01-07 Icontrol Networks, Inc. Integrated cloud system with lightweight gateway for premises automation
US10559193B2 (en) 2002-02-01 2020-02-11 Comcast Cable Communications, Llc Premises management systems
US10616075B2 (en) 2007-06-12 2020-04-07 Icontrol Networks, Inc. Communication protocols in integrated systems
US10645347B2 (en) 2013-08-09 2020-05-05 Icn Acquisition, Llc System, method and apparatus for remote monitoring
US10666523B2 (en) 2007-06-12 2020-05-26 Icontrol Networks, Inc. Communication protocols in integrated systems
US10721087B2 (en) 2005-03-16 2020-07-21 Icontrol Networks, Inc. Method for networked touchscreen with integrated interfaces
US10747216B2 (en) 2007-02-28 2020-08-18 Icontrol Networks, Inc. Method and system for communicating with and controlling an alarm system from a remote server
US10785319B2 (en) 2006-06-12 2020-09-22 Icontrol Networks, Inc. IP device discovery systems and methods
US10979389B2 (en) 2004-03-16 2021-04-13 Icontrol Networks, Inc. Premises management configuration and control
US10999254B2 (en) 2005-03-16 2021-05-04 Icontrol Networks, Inc. System for data routing in networks
US11089122B2 (en) 2007-06-12 2021-08-10 Icontrol Networks, Inc. Controlling data routing among networks
US11113950B2 (en) 2005-03-16 2021-09-07 Icontrol Networks, Inc. Gateway integrated with premises security system
US11140130B2 (en) 2014-09-14 2021-10-05 Sophos Limited Firewall techniques for colored objects on endpoints
US11146637B2 (en) 2014-03-03 2021-10-12 Icontrol Networks, Inc. Media content management
US20210336973A1 (en) * 2020-04-27 2021-10-28 Check Point Software Technologies Ltd. Method and system for detecting malicious or suspicious activity by baselining host behavior
US11182060B2 (en) 2004-03-16 2021-11-23 Icontrol Networks, Inc. Networked touchscreen with integrated interfaces
US11201755B2 (en) 2004-03-16 2021-12-14 Icontrol Networks, Inc. Premises system management using status signal
US11204952B2 (en) * 2012-12-28 2021-12-21 Microsoft Technology Licensing, Llc Detecting anomalies in behavioral network with contextual side information
US11212192B2 (en) 2007-06-12 2021-12-28 Icontrol Networks, Inc. Communication protocols in integrated systems
US11218878B2 (en) 2007-06-12 2022-01-04 Icontrol Networks, Inc. Communication protocols in integrated systems
US11237714B2 (en) 2007-06-12 2022-02-01 Control Networks, Inc. Control system user interface
US11244545B2 (en) 2004-03-16 2022-02-08 Icontrol Networks, Inc. Cross-client sensor user interface in an integrated security network
US11258625B2 (en) 2008-08-11 2022-02-22 Icontrol Networks, Inc. Mobile premises automation platform
US11277465B2 (en) 2004-03-16 2022-03-15 Icontrol Networks, Inc. Generating risk profile using data of home monitoring and security system
US11310199B2 (en) 2004-03-16 2022-04-19 Icontrol Networks, Inc. Premises management configuration and control
US11316753B2 (en) 2007-06-12 2022-04-26 Icontrol Networks, Inc. Communication protocols in integrated systems
US11316958B2 (en) 2008-08-11 2022-04-26 Icontrol Networks, Inc. Virtual device systems and methods
US11343380B2 (en) 2004-03-16 2022-05-24 Icontrol Networks, Inc. Premises system automation
US11368327B2 (en) 2008-08-11 2022-06-21 Icontrol Networks, Inc. Integrated cloud system for premises automation
US11405463B2 (en) 2014-03-03 2022-08-02 Icontrol Networks, Inc. Media content management
US11423756B2 (en) 2007-06-12 2022-08-23 Icontrol Networks, Inc. Communication protocols in integrated systems
US11424980B2 (en) 2005-03-16 2022-08-23 Icontrol Networks, Inc. Forming a security network including integrated security system components
US11451409B2 (en) 2005-03-16 2022-09-20 Icontrol Networks, Inc. Security network integrating security system and network devices
US11489812B2 (en) 2004-03-16 2022-11-01 Icontrol Networks, Inc. Forming a security network including integrated security system components and network devices
US11496568B2 (en) 2005-03-16 2022-11-08 Icontrol Networks, Inc. Security system with networked touchscreen
US20230008868A1 (en) * 2021-07-08 2023-01-12 Nippon Telegraph And Telephone Corporation User authentication device, user authentication method, and user authentication computer program
US11567847B2 (en) 2020-02-04 2023-01-31 International Business Machines Corporation Identifying anomolous device usage based on usage patterns
US11582065B2 (en) 2007-06-12 2023-02-14 Icontrol Networks, Inc. Systems and methods for device communication
US11601810B2 (en) 2007-06-12 2023-03-07 Icontrol Networks, Inc. Communication protocols in integrated systems
US11615697B2 (en) 2005-03-16 2023-03-28 Icontrol Networks, Inc. Premise management systems and methods
US11646907B2 (en) 2007-06-12 2023-05-09 Icontrol Networks, Inc. Communication protocols in integrated systems
US11677577B2 (en) 2004-03-16 2023-06-13 Icontrol Networks, Inc. Premises system management using status signal
US11700142B2 (en) 2005-03-16 2023-07-11 Icontrol Networks, Inc. Security network integrating security system and network devices
US11706045B2 (en) 2005-03-16 2023-07-18 Icontrol Networks, Inc. Modular electronic display platform
US11706279B2 (en) 2007-01-24 2023-07-18 Icontrol Networks, Inc. Methods and systems for data communication
US11729255B2 (en) 2008-08-11 2023-08-15 Icontrol Networks, Inc. Integrated cloud system with lightweight gateway for premises automation
US11750414B2 (en) 2010-12-16 2023-09-05 Icontrol Networks, Inc. Bidirectional security sensor communication for a premises security system
US11758026B2 (en) 2008-08-11 2023-09-12 Icontrol Networks, Inc. Virtual device systems and methods
US11792036B2 (en) 2008-08-11 2023-10-17 Icontrol Networks, Inc. Mobile premises automation platform
US11792330B2 (en) 2005-03-16 2023-10-17 Icontrol Networks, Inc. Communication and automation in a premises management system
US11811845B2 (en) 2004-03-16 2023-11-07 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks
US11816323B2 (en) 2008-06-25 2023-11-14 Icontrol Networks, Inc. Automation system user interface
US11831462B2 (en) 2007-08-24 2023-11-28 Icontrol Networks, Inc. Controlling data routing in premises management systems
US11916870B2 (en) 2004-03-16 2024-02-27 Icontrol Networks, Inc. Gateway registry methods and systems
US11916928B2 (en) 2008-01-24 2024-02-27 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks

Families Citing this family (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7926113B1 (en) 2003-06-09 2011-04-12 Tenable Network Security, Inc. System and method for managing network vulnerability analysis systems
CA2545916C (en) 2003-11-12 2015-03-17 The Trustees Of Columbia University In The City Of New York Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data
US7761918B2 (en) * 2004-04-13 2010-07-20 Tenable Network Security, Inc. System and method for scanning a network
US8359645B2 (en) * 2005-03-25 2013-01-22 Microsoft Corporation Dynamic protection of unpatched machines
US8516583B2 (en) * 2005-03-31 2013-08-20 Microsoft Corporation Aggregating the knowledge base of computer systems to proactively protect a computer from malware
US20060259967A1 (en) * 2005-05-13 2006-11-16 Microsoft Corporation Proactively protecting computers in a networking environment from malware
US9419981B2 (en) * 2005-10-31 2016-08-16 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for securing communications between a first node and a second node
US7983900B2 (en) * 2006-02-08 2011-07-19 Oracle International Corporation Method, computer program and apparatus for analysing symbols in a computer system
EP1830253A3 (en) * 2006-02-08 2009-03-18 Secerno Limited Method, computer program and apparatus for analysing symbols in a computer system
US8286238B2 (en) * 2006-09-29 2012-10-09 Intel Corporation Method and apparatus for run-time in-memory patching of code from a service processor
KR100874948B1 (en) * 2007-06-18 2008-12-19 한국전자통신연구원 Apparatus and method to detect and control processes which access lower privileged object
EP2023572B1 (en) * 2007-08-08 2017-12-06 Oracle International Corporation Method, computer program and apparatus for controlling access to a computer resource and obtaining a baseline therefor
CN101350052B (en) * 2007-10-15 2010-11-03 北京瑞星信息技术有限公司 Method and apparatus for discovering malignancy of computer program
US9338176B2 (en) * 2008-01-07 2016-05-10 Global Dataguard, Inc. Systems and methods of identity and access management
TW201006175A (en) * 2008-07-31 2010-02-01 Ibm Method, apparatus, and computer program product for testing a network system
WO2010084344A1 (en) 2009-01-20 2010-07-29 Secerno Ltd Method, computer program and apparatus for analysing symbols in a computer system
US8752180B2 (en) * 2009-05-26 2014-06-10 Symantec Corporation Behavioral engine for identifying patterns of confidential data use
US8666731B2 (en) * 2009-09-22 2014-03-04 Oracle International Corporation Method, a computer program and apparatus for processing a computer message
US8438270B2 (en) 2010-01-26 2013-05-07 Tenable Network Security, Inc. System and method for correlating network identities and addresses
US8302198B2 (en) 2010-01-28 2012-10-30 Tenable Network Security, Inc. System and method for enabling remote registry service security audits
US8707440B2 (en) * 2010-03-22 2014-04-22 Tenable Network Security, Inc. System and method for passively identifying encrypted and interactive network sessions
US8549650B2 (en) 2010-05-06 2013-10-01 Tenable Network Security, Inc. System and method for three-dimensional visualization of vulnerability and asset data
CN102663274B (en) * 2012-02-07 2015-12-02 北京奇虎科技有限公司 A kind of method and system detecting the behavior of long-range invasion computing machine
US9367707B2 (en) 2012-02-23 2016-06-14 Tenable Network Security, Inc. System and method for using file hashes to track data leakage and document propagation in a network
US9378390B2 (en) * 2012-03-30 2016-06-28 Nokia Technologies Oy Method and apparatus for policy adaption based on application policy compliance analysis
US9043920B2 (en) 2012-06-27 2015-05-26 Tenable Network Security, Inc. System and method for identifying exploitable weak points in a network
US9088606B2 (en) 2012-07-05 2015-07-21 Tenable Network Security, Inc. System and method for strategic anti-malware monitoring
US8938796B2 (en) 2012-09-20 2015-01-20 Paul Case, SR. Case secure computer architecture
US9467464B2 (en) 2013-03-15 2016-10-11 Tenable Network Security, Inc. System and method for correlating log data to discover network vulnerabilities and assets
US10171483B1 (en) 2013-08-23 2019-01-01 Symantec Corporation Utilizing endpoint asset awareness for network intrusion detection
US11165812B2 (en) 2014-12-03 2021-11-02 Splunk Inc. Containment of security threats within a computing environment
US10803172B2 (en) * 2017-05-02 2020-10-13 Crowdstrike, Inc. Malicious/benign computational behavior detection using canonic patterns of behavior
US11044200B1 (en) 2018-07-06 2021-06-22 F5 Networks, Inc. Methods for service stitching using a packet header and devices thereof
US11233801B1 (en) 2021-05-26 2022-01-25 Netskope, Inc. Session protocol update or upgrade web traffic

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5412717A (en) * 1992-05-15 1995-05-02 Fischer; Addison M. Computer system security method and apparatus having program authorization information data structures
US20020147923A1 (en) * 2001-01-19 2002-10-10 Eyal Dotan Method for protecting computer programs and data from hostile code
US6505300B2 (en) * 1998-06-12 2003-01-07 Microsoft Corporation Method and system for secure running of untrusted content

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0549104B1 (en) * 1991-12-20 1998-05-06 International Computers Limited Program attribute control in a computer system
US5978484A (en) * 1996-04-25 1999-11-02 Microsoft Corporation System and method for safety distributing executable objects
US6158010A (en) * 1998-10-28 2000-12-05 Crosslogix, Inc. System and method for maintaining security in a distributed computer network
US7103914B2 (en) * 2002-06-17 2006-09-05 Bae Systems Information Technology Llc Trusted computer system

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5412717A (en) * 1992-05-15 1995-05-02 Fischer; Addison M. Computer system security method and apparatus having program authorization information data structures
US6505300B2 (en) * 1998-06-12 2003-01-07 Microsoft Corporation Method and system for secure running of untrusted content
US20020147923A1 (en) * 2001-01-19 2002-10-10 Eyal Dotan Method for protecting computer programs and data from hostile code

Cited By (343)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10559193B2 (en) 2002-02-01 2020-02-11 Comcast Cable Communications, Llc Premises management systems
US20050039042A1 (en) * 2003-07-21 2005-02-17 Trend Micro Incorporated, A Japanese Corporation Adaptive computer worm filter and methods of use thereof
US7523501B2 (en) * 2003-07-21 2009-04-21 Trend Micro, Inc. Adaptive computer worm filter and methods of use thereof
US8539063B1 (en) 2003-08-29 2013-09-17 Mcafee, Inc. Method and system for containment of networked application client software by explicit human input
US20050108384A1 (en) * 2003-10-23 2005-05-19 Lambert John R. Analysis of message sequences
US8549546B2 (en) 2003-12-17 2013-10-01 Mcafee, Inc. Method and system for containment of usage of language interfaces
US8561082B2 (en) 2003-12-17 2013-10-15 Mcafee, Inc. Method and system for containment of usage of language interfaces
US8595820B1 (en) * 2003-12-17 2013-11-26 Rpx Corporation Surround security system
US8762928B2 (en) 2003-12-17 2014-06-24 Mcafee, Inc. Method and system for containment of usage of language interfaces
US7840968B1 (en) 2003-12-17 2010-11-23 Mcafee, Inc. Method and system for containment of usage of language interfaces
US7797752B1 (en) * 2003-12-17 2010-09-14 Vimal Vaidya Method and apparatus to secure a computing environment
US20050165882A1 (en) * 2003-12-23 2005-07-28 Alcatel Terminal with means of protection against malfunctions of certain java applications
US7784052B2 (en) * 2003-12-23 2010-08-24 Alcatel Lucent Terminal with means of protection against malfunctions of certain java applications
US7895448B1 (en) * 2004-02-18 2011-02-22 Symantec Corporation Risk profiling
US11310199B2 (en) 2004-03-16 2022-04-19 Icontrol Networks, Inc. Premises management configuration and control
US10691295B2 (en) 2004-03-16 2020-06-23 Icontrol Networks, Inc. User interface in a premises network
US10754304B2 (en) 2004-03-16 2020-08-25 Icontrol Networks, Inc. Automation system with mobile interface
US10796557B2 (en) 2004-03-16 2020-10-06 Icontrol Networks, Inc. Automation system user interface with three-dimensional display
US10890881B2 (en) 2004-03-16 2021-01-12 Icontrol Networks, Inc. Premises management networking
US10979389B2 (en) 2004-03-16 2021-04-13 Icontrol Networks, Inc. Premises management configuration and control
US10992784B2 (en) 2004-03-16 2021-04-27 Control Networks, Inc. Communication protocols over internet protocol (IP) networks
US11037433B2 (en) 2004-03-16 2021-06-15 Icontrol Networks, Inc. Management of a security system at a premises
US11043112B2 (en) 2004-03-16 2021-06-22 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US11082395B2 (en) 2004-03-16 2021-08-03 Icontrol Networks, Inc. Premises management configuration and control
US11153266B2 (en) 2004-03-16 2021-10-19 Icontrol Networks, Inc. Gateway registry methods and systems
US11159484B2 (en) 2004-03-16 2021-10-26 Icontrol Networks, Inc. Forming a security network including integrated security system components and network devices
US10692356B2 (en) 2004-03-16 2020-06-23 Icontrol Networks, Inc. Control system user interface
US11175793B2 (en) 2004-03-16 2021-11-16 Icontrol Networks, Inc. User interface in a premises network
US7620983B1 (en) * 2004-03-16 2009-11-17 Symantec Corporation Behavior profiling
US11184322B2 (en) 2004-03-16 2021-11-23 Icontrol Networks, Inc. Communication protocols in integrated systems
US11182060B2 (en) 2004-03-16 2021-11-23 Icontrol Networks, Inc. Networked touchscreen with integrated interfaces
US11201755B2 (en) 2004-03-16 2021-12-14 Icontrol Networks, Inc. Premises system management using status signal
US11244545B2 (en) 2004-03-16 2022-02-08 Icontrol Networks, Inc. Cross-client sensor user interface in an integrated security network
US11277465B2 (en) 2004-03-16 2022-03-15 Icontrol Networks, Inc. Generating risk profile using data of home monitoring and security system
US11810445B2 (en) 2004-03-16 2023-11-07 Icontrol Networks, Inc. Cross-client sensor user interface in an integrated security network
US11343380B2 (en) 2004-03-16 2022-05-24 Icontrol Networks, Inc. Premises system automation
US11811845B2 (en) 2004-03-16 2023-11-07 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks
US11916870B2 (en) 2004-03-16 2024-02-27 Icontrol Networks, Inc. Gateway registry methods and systems
US11368429B2 (en) 2004-03-16 2022-06-21 Icontrol Networks, Inc. Premises management configuration and control
US11378922B2 (en) 2004-03-16 2022-07-05 Icontrol Networks, Inc. Automation system with mobile interface
US11410531B2 (en) 2004-03-16 2022-08-09 Icontrol Networks, Inc. Automation system user interface with three-dimensional display
US11782394B2 (en) 2004-03-16 2023-10-10 Icontrol Networks, Inc. Automation system with mobile interface
US10735249B2 (en) 2004-03-16 2020-08-04 Icontrol Networks, Inc. Management of a security system at a premises
US10142166B2 (en) 2004-03-16 2018-11-27 Icontrol Networks, Inc. Takeover of security network
US11893874B2 (en) 2004-03-16 2024-02-06 Icontrol Networks, Inc. Networked touchscreen with integrated interfaces
US11449012B2 (en) 2004-03-16 2022-09-20 Icontrol Networks, Inc. Premises management networking
US11489812B2 (en) 2004-03-16 2022-11-01 Icontrol Networks, Inc. Forming a security network including integrated security system components and network devices
US11757834B2 (en) 2004-03-16 2023-09-12 Icontrol Networks, Inc. Communication protocols in integrated systems
US11537186B2 (en) 2004-03-16 2022-12-27 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US10156831B2 (en) 2004-03-16 2018-12-18 Icontrol Networks, Inc. Automation system with mobile interface
US11588787B2 (en) 2004-03-16 2023-02-21 Icontrol Networks, Inc. Premises management configuration and control
US11601397B2 (en) 2004-03-16 2023-03-07 Icontrol Networks, Inc. Premises management configuration and control
US10447491B2 (en) 2004-03-16 2019-10-15 Icontrol Networks, Inc. Premises system management using status signal
US11625008B2 (en) 2004-03-16 2023-04-11 Icontrol Networks, Inc. Premises management networking
US11626006B2 (en) 2004-03-16 2023-04-11 Icontrol Networks, Inc. Management of a security system at a premises
US11656667B2 (en) 2004-03-16 2023-05-23 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US11677577B2 (en) 2004-03-16 2023-06-13 Icontrol Networks, Inc. Premises system management using status signal
US20100293225A1 (en) * 2004-03-22 2010-11-18 Mcafee, Inc. Containment of network communication
US7987230B2 (en) 2004-03-22 2011-07-26 Mcafee, Inc. Containment of network communication
US20060026684A1 (en) * 2004-07-20 2006-02-02 Prevx Ltd. Host intrusion prevention system and method
US8635702B2 (en) 2004-07-23 2014-01-21 Fortinet, Inc. Determining technology-appropriate remediation for vulnerability
US8561197B2 (en) 2004-07-23 2013-10-15 Fortinet, Inc. Vulnerability-based remediation selection
US20060021051A1 (en) * 2004-07-23 2006-01-26 D Mello Kurt Determining technology-appropriate remediation for vulnerability
US20060018478A1 (en) * 2004-07-23 2006-01-26 Diefenderfer Kristopher G Secure communication protocol
US20100199353A1 (en) * 2004-07-23 2010-08-05 Fortinet, Inc. Vulnerability-based remediation selection
US9349013B2 (en) 2004-07-23 2016-05-24 Fortinet, Inc. Vulnerability-based remediation selection
US8171555B2 (en) 2004-07-23 2012-05-01 Fortinet, Inc. Determining technology-appropriate remediation for vulnerability
US20060026678A1 (en) * 2004-07-29 2006-02-02 Zakas Phillip H System and method of characterizing and managing electronic traffic
US20060026683A1 (en) * 2004-07-30 2006-02-02 Lim Keng Leng A Intrusion protection system and method
US20100257585A1 (en) * 2004-09-03 2010-10-07 Fortinet, Inc. Data structure for policy-based remediation selection
US7672948B2 (en) * 2004-09-03 2010-03-02 Fortinet, Inc. Centralized data transformation
US20060053475A1 (en) * 2004-09-03 2006-03-09 Bezilla Daniel B Policy-based selection of remediation
US20060053134A1 (en) * 2004-09-03 2006-03-09 Durham Roderick H Centralized data transformation
US20060053265A1 (en) * 2004-09-03 2006-03-09 Durham Roderick H Centralized data transformation
US20060053476A1 (en) * 2004-09-03 2006-03-09 Bezilla Daniel B Data structure for policy-based remediation selection
US7761920B2 (en) 2004-09-03 2010-07-20 Fortinet, Inc. Data structure for policy-based remediation selection
US9154523B2 (en) 2004-09-03 2015-10-06 Fortinet, Inc. Policy-based selection of remediation
US8336103B2 (en) 2004-09-03 2012-12-18 Fortinet, Inc. Data structure for policy-based remediation selection
US8341691B2 (en) 2004-09-03 2012-12-25 Colorado Remediation Technologies, Llc Policy based selection of remediation
US8001600B2 (en) 2004-09-03 2011-08-16 Fortinet, Inc. Centralized data transformation
US20100153490A1 (en) * 2004-09-03 2010-06-17 Fortinet, Inc. Centralized data transformation
US20100138897A1 (en) * 2004-09-03 2010-06-03 Secure Elements, Inc. Policy-based selection of remediation
US9392024B2 (en) 2004-09-03 2016-07-12 Fortinet, Inc. Policy-based selection of remediation
US7703137B2 (en) 2004-09-03 2010-04-20 Fortinet, Inc. Centralized data transformation
US8561134B2 (en) 2004-09-03 2013-10-15 Colorado Remediation Technologies, Llc Policy-based selection of remediation
US7665119B2 (en) 2004-09-03 2010-02-16 Secure Elements, Inc. Policy-based selection of remediation
US9602550B2 (en) 2004-09-03 2017-03-21 Fortinet, Inc. Policy-based selection of remediation
US8561051B2 (en) 2004-09-07 2013-10-15 Mcafee, Inc. Solidifying the executable software set of a computer
US7873955B1 (en) 2004-09-07 2011-01-18 Mcafee, Inc. Solidifying the executable software set of a computer
US7832005B1 (en) * 2004-11-29 2010-11-09 Symantec Corporation Behavioral learning based security
US20070226031A1 (en) * 2004-11-30 2007-09-27 Manson Nicholas R Methods and apparatuses for grouped option specification
US8751328B2 (en) 2004-11-30 2014-06-10 Siebel Systems, Inc. Methods and apparatuses for providing provisioned access control for hosted tailored vertical applications
US7841011B2 (en) * 2004-11-30 2010-11-23 Siebel Systems, Inc. Methods and apparatuses for tiered option specification
US20070240106A1 (en) * 2004-11-30 2007-10-11 Manson Nicholas R Methods and apparatuses for tiered option specification
US7958161B2 (en) 2004-11-30 2011-06-07 Siebel Systems, Inc. Methods and apparatuses for providing hosted tailored vertical applications
US20060117065A1 (en) * 2004-11-30 2006-06-01 Bezeau Jonathan R Methods and apparatuses for providing hosted tailored vertical applications
US20070239467A1 (en) * 2004-11-30 2007-10-11 Bezeau Jonathan R Methods and apparatuses for providing provisioned access control for hosted tailored vertical applications
US20080046964A1 (en) * 2004-12-22 2008-02-21 Nithya Muralidharan Enabling relational databases to incorporate customized intrusion prevention policies
US8392994B2 (en) 2005-01-14 2013-03-05 Mcafee, Inc. System, method and computer program product for context-driven behavioral heuristics
US20110179491A1 (en) * 2005-01-14 2011-07-21 Mcafee, Inc., A Delaware Corporation System, method and computer program product for context-driven behavioral heuristics
US20060206940A1 (en) * 2005-03-14 2006-09-14 Strauss Christopher J Computer security intrusion detection system for remote, on-demand users
US7657939B2 (en) * 2005-03-14 2010-02-02 International Business Machines Corporation Computer security intrusion detection system for remote, on-demand users
US20100011440A1 (en) * 2005-03-14 2010-01-14 International Business Machines Corporation Computer Security Intrusion Detection System For Remote, On-Demand Users
US7954160B2 (en) 2005-03-14 2011-05-31 International Business Machines Corporation Computer security intrusion detection system for remote, on-demand users
US11367340B2 (en) 2005-03-16 2022-06-21 Icontrol Networks, Inc. Premise management systems and methods
US10999254B2 (en) 2005-03-16 2021-05-04 Icontrol Networks, Inc. System for data routing in networks
US11700142B2 (en) 2005-03-16 2023-07-11 Icontrol Networks, Inc. Security network integrating security system and network devices
US10380871B2 (en) 2005-03-16 2019-08-13 Icontrol Networks, Inc. Control system user interface
US11706045B2 (en) 2005-03-16 2023-07-18 Icontrol Networks, Inc. Modular electronic display platform
US11113950B2 (en) 2005-03-16 2021-09-07 Icontrol Networks, Inc. Gateway integrated with premises security system
US11615697B2 (en) 2005-03-16 2023-03-28 Icontrol Networks, Inc. Premise management systems and methods
US9450776B2 (en) 2005-03-16 2016-09-20 Icontrol Networks, Inc. Forming a security network including integrated security system components
US11595364B2 (en) 2005-03-16 2023-02-28 Icontrol Networks, Inc. System for data routing in networks
US10930136B2 (en) 2005-03-16 2021-02-23 Icontrol Networks, Inc. Premise management systems and methods
US11792330B2 (en) 2005-03-16 2023-10-17 Icontrol Networks, Inc. Communication and automation in a premises management system
US11496568B2 (en) 2005-03-16 2022-11-08 Icontrol Networks, Inc. Security system with networked touchscreen
US10156959B2 (en) 2005-03-16 2018-12-18 Icontrol Networks, Inc. Cross-client sensor user interface in an integrated security network
US11451409B2 (en) 2005-03-16 2022-09-20 Icontrol Networks, Inc. Security network integrating security system and network devices
US10841381B2 (en) 2005-03-16 2020-11-17 Icontrol Networks, Inc. Security system with networked touchscreen
US10062245B2 (en) 2005-03-16 2018-08-28 Icontrol Networks, Inc. Cross-client sensor user interface in an integrated security network
US11424980B2 (en) 2005-03-16 2022-08-23 Icontrol Networks, Inc. Forming a security network including integrated security system components
US10127801B2 (en) 2005-03-16 2018-11-13 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US10091014B2 (en) 2005-03-16 2018-10-02 Icontrol Networks, Inc. Integrated security network with security alarm signaling system
US11824675B2 (en) 2005-03-16 2023-11-21 Icontrol Networks, Inc. Networked touchscreen with integrated interfaces
US10721087B2 (en) 2005-03-16 2020-07-21 Icontrol Networks, Inc. Method for networked touchscreen with integrated interfaces
US20080098476A1 (en) * 2005-04-04 2008-04-24 Bae Systems Information And Electronic Systems Integration Inc. Method and Apparatus for Defending Against Zero-Day Worm-Based Attacks
US7603552B1 (en) 2005-05-04 2009-10-13 Mcafee, Inc. Piracy prevention using unique module translation
US20090320140A1 (en) * 2005-05-04 2009-12-24 Mcafee, Inc. Piracy Prevention Using Unique Module Translation
US8028340B2 (en) 2005-05-04 2011-09-27 Mcafee, Inc. Piracy prevention using unique module translation
US8307437B2 (en) 2005-07-14 2012-11-06 Mcafee, Inc. Classification of software on networked systems
US8763118B2 (en) 2005-07-14 2014-06-24 Mcafee, Inc. Classification of software on networked systems
US7856661B1 (en) 2005-07-14 2010-12-21 Mcafee, Inc. Classification of software on networked systems
US8984636B2 (en) 2005-07-29 2015-03-17 Bit9, Inc. Content extractor and analysis system
US8272058B2 (en) 2005-07-29 2012-09-18 Bit 9, Inc. Centralized timed analysis in a network security system
US7895651B2 (en) 2005-07-29 2011-02-22 Bit 9, Inc. Content tracking in a network security system
US8079080B2 (en) * 2005-10-21 2011-12-13 Mathew R. Syrowik Method, system and computer program product for detecting security threats in a computer network
US20070094725A1 (en) * 2005-10-21 2007-04-26 Borders Kevin R Method, system and computer program product for detecting security threats in a computer network
GB2432687B (en) * 2005-11-25 2011-06-01 Mcafee Inc Product for preventing spyware/malware from installing in a registry
GB2432687A (en) * 2005-11-25 2007-05-30 Mcafee Inc Preventing spyware/malware from installing in a registry
US8234713B2 (en) 2006-02-02 2012-07-31 Mcafee, Inc. Enforcing alignment of approved changes and deployed changes in the software change life-cycle
US20100100970A1 (en) * 2006-02-02 2010-04-22 Rahul Roy-Chowdhury Enforcing alignment of approved changes and deployed changes in the software change life-cycle
US9134998B2 (en) 2006-02-02 2015-09-15 Mcafee, Inc. Enforcing alignment of approved changes and deployed changes in the software change life-cycle
US9602515B2 (en) 2006-02-02 2017-03-21 Mcafee, Inc. Enforcing alignment of approved changes and deployed changes in the software change life-cycle
US8707446B2 (en) 2006-02-02 2014-04-22 Mcafee, Inc. Enforcing alignment of approved changes and deployed changes in the software change life-cycle
US7757269B1 (en) 2006-02-02 2010-07-13 Mcafee, Inc. Enforcing alignment of approved changes and deployed changes in the software change life-cycle
EP2002346A1 (en) * 2006-02-10 2008-12-17 Samsung Electronics Co., Ltd. Apparatus and method for using information on malicious application behaviors among devices
US8640240B2 (en) * 2006-02-10 2014-01-28 Samsung Electronics Co., Ltd. Apparatus and method for using information on malicious application behaviors among devices
WO2007091829A1 (en) 2006-02-10 2007-08-16 Samsung Electronics Co., Ltd. Apparatus and method for using information on malicious application behaviors among devices
US20070192866A1 (en) * 2006-02-10 2007-08-16 Samsung Electronics Co., Ltd. Apparatus and method for using information on malicious application behaviors among devices
EP2002346A4 (en) * 2006-02-10 2010-12-08 Samsung Electronics Co Ltd Apparatus and method for using information on malicious application behaviors among devices
US10360382B2 (en) 2006-03-27 2019-07-23 Mcafee, Llc Execution environment file inventory
US7895573B1 (en) 2006-03-27 2011-02-22 Mcafee, Inc. Execution environment file inventory
US9576142B2 (en) 2006-03-27 2017-02-21 Mcafee, Inc. Execution environment file inventory
US8321932B2 (en) 2006-04-07 2012-11-27 Mcafee, Inc. Program-based authorization
US7870387B1 (en) * 2006-04-07 2011-01-11 Mcafee, Inc. Program-based authorization
US20110093950A1 (en) * 2006-04-07 2011-04-21 Mcafee, Inc., A Delaware Corporation Program-based authorization
US8352930B1 (en) 2006-04-24 2013-01-08 Mcafee, Inc. Software modification by group to minimize breakage
US8555404B1 (en) 2006-05-18 2013-10-08 Mcafee, Inc. Connectivity-based authorization
US10616244B2 (en) 2006-06-12 2020-04-07 Icontrol Networks, Inc. Activation of gateway device
US10785319B2 (en) 2006-06-12 2020-09-22 Icontrol Networks, Inc. IP device discovery systems and methods
US11418518B2 (en) 2006-06-12 2022-08-16 Icontrol Networks, Inc. Activation of gateway device
US9621408B2 (en) 2006-06-12 2017-04-11 Icontrol Networks, Inc. Gateway registry methods and systems
US7950056B1 (en) * 2006-06-30 2011-05-24 Symantec Corporation Behavior based processing of a new version or variant of a previously characterized program
US20130276109A1 (en) * 2006-07-11 2013-10-17 Mcafee, Inc. System, method and computer program product for detecting activity in association with program resources that has at least a potential of an unwanted effect on the program
US7934253B2 (en) * 2006-07-20 2011-04-26 Trustwave Holdings, Inc. System and method of securing web applications across an enterprise
US20080047009A1 (en) * 2006-07-20 2008-02-21 Kevin Overcash System and method of securing networks against applications threats
US20080034425A1 (en) * 2006-07-20 2008-02-07 Kevin Overcash System and method of securing web applications across an enterprise
US8332929B1 (en) 2007-01-10 2012-12-11 Mcafee, Inc. Method and apparatus for process enforced configuration management
US9864868B2 (en) 2007-01-10 2018-01-09 Mcafee, Llc Method and apparatus for process enforced configuration management
US9424154B2 (en) 2007-01-10 2016-08-23 Mcafee, Inc. Method of and system for computer system state checks
US8701182B2 (en) 2007-01-10 2014-04-15 Mcafee, Inc. Method and apparatus for process enforced configuration management
US8707422B2 (en) 2007-01-10 2014-04-22 Mcafee, Inc. Method and apparatus for process enforced configuration management
US10142392B2 (en) 2007-01-24 2018-11-27 Icontrol Networks, Inc. Methods and systems for improved system performance
US10225314B2 (en) 2007-01-24 2019-03-05 Icontrol Networks, Inc. Methods and systems for improved system performance
US11418572B2 (en) 2007-01-24 2022-08-16 Icontrol Networks, Inc. Methods and systems for improved system performance
US11412027B2 (en) 2007-01-24 2022-08-09 Icontrol Networks, Inc. Methods and systems for data communication
US11706279B2 (en) 2007-01-24 2023-07-18 Icontrol Networks, Inc. Methods and systems for data communication
US10747216B2 (en) 2007-02-28 2020-08-18 Icontrol Networks, Inc. Method and system for communicating with and controlling an alarm system from a remote server
US10657794B1 (en) 2007-02-28 2020-05-19 Icontrol Networks, Inc. Security, monitoring and automation controller access and use of legacy security control panel information
US11809174B2 (en) 2007-02-28 2023-11-07 Icontrol Networks, Inc. Method and system for managing communication connectivity
US9412248B1 (en) 2007-02-28 2016-08-09 Icontrol Networks, Inc. Security, monitoring and automation controller access and use of legacy security control panel information
US11194320B2 (en) 2007-02-28 2021-12-07 Icontrol Networks, Inc. Method and system for managing communication connectivity
US10672254B2 (en) 2007-04-23 2020-06-02 Icontrol Networks, Inc. Method and system for providing alternate network access
US10140840B2 (en) 2007-04-23 2018-11-27 Icontrol Networks, Inc. Method and system for providing alternate network access
US11663902B2 (en) 2007-04-23 2023-05-30 Icontrol Networks, Inc. Method and system for providing alternate network access
US11132888B2 (en) 2007-04-23 2021-09-28 Icontrol Networks, Inc. Method and system for providing alternate network access
US9510065B2 (en) 2007-04-23 2016-11-29 Icontrol Networks, Inc. Method and system for automatically providing alternate network access for telecommunications
US10079839B1 (en) 2007-06-12 2018-09-18 Icontrol Networks, Inc. Activation of gateway device
US10142394B2 (en) 2007-06-12 2018-11-27 Icontrol Networks, Inc. Generating risk profile using data of home monitoring and security system
US10313303B2 (en) 2007-06-12 2019-06-04 Icontrol Networks, Inc. Forming a security network including integrated security system components and network devices
US11212192B2 (en) 2007-06-12 2021-12-28 Icontrol Networks, Inc. Communication protocols in integrated systems
US10339791B2 (en) 2007-06-12 2019-07-02 Icontrol Networks, Inc. Security network integrated with premise security system
US11218878B2 (en) 2007-06-12 2022-01-04 Icontrol Networks, Inc. Communication protocols in integrated systems
US9609003B1 (en) 2007-06-12 2017-03-28 Icontrol Networks, Inc. Generating risk profile using data of home monitoring and security system
US10237237B2 (en) 2007-06-12 2019-03-19 Icontrol Networks, Inc. Communication protocols in integrated systems
US10365810B2 (en) 2007-06-12 2019-07-30 Icontrol Networks, Inc. Control system user interface
US11237714B2 (en) 2007-06-12 2022-02-01 Control Networks, Inc. Control system user interface
US10382452B1 (en) 2007-06-12 2019-08-13 Icontrol Networks, Inc. Communication protocols in integrated systems
US11894986B2 (en) 2007-06-12 2024-02-06 Icontrol Networks, Inc. Communication protocols in integrated systems
US10389736B2 (en) 2007-06-12 2019-08-20 Icontrol Networks, Inc. Communication protocols in integrated systems
US10423309B2 (en) 2007-06-12 2019-09-24 Icontrol Networks, Inc. Device integration framework
US11089122B2 (en) 2007-06-12 2021-08-10 Icontrol Networks, Inc. Controlling data routing among networks
US10444964B2 (en) 2007-06-12 2019-10-15 Icontrol Networks, Inc. Control system user interface
US10498830B2 (en) 2007-06-12 2019-12-03 Icontrol Networks, Inc. Wi-Fi-to-serial encapsulation in systems
US11316753B2 (en) 2007-06-12 2022-04-26 Icontrol Networks, Inc. Communication protocols in integrated systems
US10523689B2 (en) 2007-06-12 2019-12-31 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks
US9306809B2 (en) 2007-06-12 2016-04-05 Icontrol Networks, Inc. Security system with networked touchscreen
US11423756B2 (en) 2007-06-12 2022-08-23 Icontrol Networks, Inc. Communication protocols in integrated systems
US10200504B2 (en) 2007-06-12 2019-02-05 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks
US10616075B2 (en) 2007-06-12 2020-04-07 Icontrol Networks, Inc. Communication protocols in integrated systems
US11582065B2 (en) 2007-06-12 2023-02-14 Icontrol Networks, Inc. Systems and methods for device communication
US11601810B2 (en) 2007-06-12 2023-03-07 Icontrol Networks, Inc. Communication protocols in integrated systems
US11611568B2 (en) 2007-06-12 2023-03-21 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks
US11625161B2 (en) 2007-06-12 2023-04-11 Icontrol Networks, Inc. Control system user interface
US11632308B2 (en) 2007-06-12 2023-04-18 Icontrol Networks, Inc. Communication protocols in integrated systems
US10666523B2 (en) 2007-06-12 2020-05-26 Icontrol Networks, Inc. Communication protocols in integrated systems
US9531593B2 (en) 2007-06-12 2016-12-27 Icontrol Networks, Inc. Takeover processes in security network integrated with premise security system
US11722896B2 (en) 2007-06-12 2023-08-08 Icontrol Networks, Inc. Communication protocols in integrated systems
US11646907B2 (en) 2007-06-12 2023-05-09 Icontrol Networks, Inc. Communication protocols in integrated systems
US10051078B2 (en) 2007-06-12 2018-08-14 Icontrol Networks, Inc. WiFi-to-serial encapsulation in systems
US11815969B2 (en) 2007-08-10 2023-11-14 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US11831462B2 (en) 2007-08-24 2023-11-28 Icontrol Networks, Inc. Controlling data routing in premises management systems
US8195931B1 (en) 2007-10-31 2012-06-05 Mcafee, Inc. Application change control
US11916928B2 (en) 2008-01-24 2024-02-27 Icontrol Networks, Inc. Communication protocols over internet protocol (IP) networks
US8701189B2 (en) 2008-01-31 2014-04-15 Mcafee, Inc. Method of and system for computer system denial-of-service protection
US8515075B1 (en) 2008-01-31 2013-08-20 Mcafee, Inc. Method of and system for malicious software detection using critical address space protection
US8615502B2 (en) 2008-04-18 2013-12-24 Mcafee, Inc. Method of and system for reverse mapping vnode pointers
US11816323B2 (en) 2008-06-25 2023-11-14 Icontrol Networks, Inc. Automation system user interface
US11729255B2 (en) 2008-08-11 2023-08-15 Icontrol Networks, Inc. Integrated cloud system with lightweight gateway for premises automation
US11641391B2 (en) 2008-08-11 2023-05-02 Icontrol Networks Inc. Integrated cloud system with lightweight gateway for premises automation
US11616659B2 (en) 2008-08-11 2023-03-28 Icontrol Networks, Inc. Integrated cloud system for premises automation
US11758026B2 (en) 2008-08-11 2023-09-12 Icontrol Networks, Inc. Virtual device systems and methods
US11190578B2 (en) 2008-08-11 2021-11-30 Icontrol Networks, Inc. Integrated cloud system with lightweight gateway for premises automation
US11792036B2 (en) 2008-08-11 2023-10-17 Icontrol Networks, Inc. Mobile premises automation platform
US10530839B2 (en) 2008-08-11 2020-01-07 Icontrol Networks, Inc. Integrated cloud system with lightweight gateway for premises automation
US11368327B2 (en) 2008-08-11 2022-06-21 Icontrol Networks, Inc. Integrated cloud system for premises automation
US11316958B2 (en) 2008-08-11 2022-04-26 Icontrol Networks, Inc. Virtual device systems and methods
US10522026B2 (en) 2008-08-11 2019-12-31 Icontrol Networks, Inc. Automation system user interface with three-dimensional display
US11258625B2 (en) 2008-08-11 2022-02-22 Icontrol Networks, Inc. Mobile premises automation platform
US11711234B2 (en) 2008-08-11 2023-07-25 Icontrol Networks, Inc. Integrated cloud system for premises automation
US9047753B2 (en) * 2008-08-25 2015-06-02 Icontrol Networks, Inc. Networked touchscreen with integrated interfaces
US10375253B2 (en) 2008-08-25 2019-08-06 Icontrol Networks, Inc. Security system with networked touchscreen and gateway
US20100153853A1 (en) * 2008-08-25 2010-06-17 Dawes Paul J Networked Touchscreen With Integrated Interfaces
US20160274759A1 (en) 2008-08-25 2016-09-22 Paul J. Dawes Security system with networked touchscreen and gateway
US9628440B2 (en) 2008-11-12 2017-04-18 Icontrol Networks, Inc. Takeover processes in security network integrated with premise security system
US8544003B1 (en) 2008-12-11 2013-09-24 Mcafee, Inc. System and method for managing virtual machine configurations
US20100235915A1 (en) * 2009-03-12 2010-09-16 Nasir Memon Using host symptoms, host roles, and/or host reputation for detection of host infection
US11601865B2 (en) 2009-04-30 2023-03-07 Icontrol Networks, Inc. Server-based notification of alarm event subsequent to communication failure with armed security system
US11356926B2 (en) 2009-04-30 2022-06-07 Icontrol Networks, Inc. Hardware configurable security, monitoring and automation controller having modular communication protocol interfaces
US10332363B2 (en) 2009-04-30 2019-06-25 Icontrol Networks, Inc. Controller and interface for home security, monitoring and automation having customizable audio alerts for SMA events
US11553399B2 (en) 2009-04-30 2023-01-10 Icontrol Networks, Inc. Custom content for premises management
US10275999B2 (en) 2009-04-30 2019-04-30 Icontrol Networks, Inc. Server-based notification of alarm event subsequent to communication failure with armed security system
US10237806B2 (en) 2009-04-30 2019-03-19 Icontrol Networks, Inc. Activation of a home automation controller
US11856502B2 (en) 2009-04-30 2023-12-26 Icontrol Networks, Inc. Method, system and apparatus for automated inventory reporting of security, monitoring and automation hardware and software at customer premises
US10813034B2 (en) 2009-04-30 2020-10-20 Icontrol Networks, Inc. Method, system and apparatus for management of applications for an SMA controller
US11665617B2 (en) 2009-04-30 2023-05-30 Icontrol Networks, Inc. Server-based notification of alarm event subsequent to communication failure with armed security system
US10674428B2 (en) 2009-04-30 2020-06-02 Icontrol Networks, Inc. Hardware configurable security, monitoring and automation controller having modular communication protocol interfaces
US11284331B2 (en) 2009-04-30 2022-03-22 Icontrol Networks, Inc. Server-based notification of alarm event subsequent to communication failure with armed security system
US9426720B2 (en) 2009-04-30 2016-08-23 Icontrol Networks, Inc. Controller and interface for home security, monitoring and automation having customizable audio alerts for SMA events
US11223998B2 (en) 2009-04-30 2022-01-11 Icontrol Networks, Inc. Security, monitoring and automation controller access and use of legacy security control panel information
US11778534B2 (en) 2009-04-30 2023-10-03 Icontrol Networks, Inc. Hardware configurable security, monitoring and automation controller having modular communication protocol interfaces
US11129084B2 (en) 2009-04-30 2021-09-21 Icontrol Networks, Inc. Notification of event subsequent to communication failure with security system
US9652607B2 (en) 2009-08-21 2017-05-16 Mcafee, Inc. System and method for enforcing security policies in a virtual environment
US8381284B2 (en) 2009-08-21 2013-02-19 Mcafee, Inc. System and method for enforcing security policies in a virtual environment
US8341627B2 (en) 2009-08-21 2012-12-25 Mcafee, Inc. Method and system for providing user space address protection from writable memory area in a virtual environment
US20110047543A1 (en) * 2009-08-21 2011-02-24 Preet Mohinder System and Method for Providing Address Protection in a Virtual Environment
US8869265B2 (en) 2009-08-21 2014-10-21 Mcafee, Inc. System and method for enforcing security policies in a virtual environment
US20110047542A1 (en) * 2009-08-21 2011-02-24 Amit Dang System and Method for Enforcing Security Policies in a Virtual Environment
US9552497B2 (en) 2009-11-10 2017-01-24 Mcafee, Inc. System and method for preventing data loss using virtual machine wrapped applications
US8938800B2 (en) 2010-07-28 2015-01-20 Mcafee, Inc. System and method for network level protection against malicious software
US9467470B2 (en) 2010-07-28 2016-10-11 Mcafee, Inc. System and method for local protection against malicious software
US9832227B2 (en) 2010-07-28 2017-11-28 Mcafee, Llc System and method for network level protection against malicious software
US8925101B2 (en) 2010-07-28 2014-12-30 Mcafee, Inc. System and method for local protection against malicious software
US8549003B1 (en) 2010-09-12 2013-10-01 Mcafee, Inc. System and method for clustering host inventories
US8843496B2 (en) 2010-09-12 2014-09-23 Mcafee, Inc. System and method for clustering host inventories
US10062273B2 (en) 2010-09-28 2018-08-28 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US10127802B2 (en) 2010-09-28 2018-11-13 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US10223903B2 (en) 2010-09-28 2019-03-05 Icontrol Networks, Inc. Integrated security system with parallel processing architecture
US9349276B2 (en) 2010-09-28 2016-05-24 Icontrol Networks, Inc. Automated reporting of account and sensor information
US11398147B2 (en) 2010-09-28 2022-07-26 Icontrol Networks, Inc. Method, system and apparatus for automated reporting of account and sensor zone information to a central station
US11900790B2 (en) 2010-09-28 2024-02-13 Icontrol Networks, Inc. Method, system and apparatus for automated reporting of account and sensor zone information to a central station
US11750414B2 (en) 2010-12-16 2023-09-05 Icontrol Networks, Inc. Bidirectional security sensor communication for a premises security system
US10078958B2 (en) 2010-12-17 2018-09-18 Icontrol Networks, Inc. Method and system for logging security event data
US11341840B2 (en) 2010-12-17 2022-05-24 Icontrol Networks, Inc. Method and system for processing security event data
US10741057B2 (en) 2010-12-17 2020-08-11 Icontrol Networks, Inc. Method and system for processing security event data
US11240059B2 (en) 2010-12-20 2022-02-01 Icontrol Networks, Inc. Defining and implementing sensor triggered response rules
US9729342B2 (en) 2010-12-20 2017-08-08 Icontrol Networks, Inc. Defining and implementing sensor triggered response rules
US9075993B2 (en) 2011-01-24 2015-07-07 Mcafee, Inc. System and method for selectively grouping and managing program files
US9866528B2 (en) 2011-02-23 2018-01-09 Mcafee, Llc System and method for interlocking a host and a gateway
US9112830B2 (en) 2011-02-23 2015-08-18 Mcafee, Inc. System and method for interlocking a host and a gateway
WO2013000079A1 (en) * 2011-06-28 2013-01-03 International Business Machines Corporation Systems and methods for fast detection and diagnosis of system outages
US8972783B2 (en) 2011-06-28 2015-03-03 International Business Machines Corporation Systems and methods for fast detection and diagnosis of system outages
US8990621B2 (en) 2011-06-28 2015-03-24 International Business Machines Corporation Fast detection and diagnosis of system outages
US9594881B2 (en) 2011-09-09 2017-03-14 Mcafee, Inc. System and method for passive threat detection using virtual memory inspection
US8694738B2 (en) 2011-10-11 2014-04-08 Mcafee, Inc. System and method for critical address space protection in a hypervisor environment
US8973144B2 (en) 2011-10-13 2015-03-03 Mcafee, Inc. System and method for kernel rootkit protection in a hypervisor environment
US9465700B2 (en) 2011-10-13 2016-10-11 Mcafee, Inc. System and method for kernel rootkit protection in a hypervisor environment
US9069586B2 (en) 2011-10-13 2015-06-30 Mcafee, Inc. System and method for kernel rootkit protection in a hypervisor environment
US9946562B2 (en) 2011-10-13 2018-04-17 Mcafee, Llc System and method for kernel rootkit protection in a hypervisor environment
US8800024B2 (en) 2011-10-17 2014-08-05 Mcafee, Inc. System and method for host-initiated firewall discovery in a network environment
US9882876B2 (en) 2011-10-17 2018-01-30 Mcafee, Llc System and method for redirected firewall discovery in a network environment
US9356909B2 (en) 2011-10-17 2016-05-31 Mcafee, Inc. System and method for redirected firewall discovery in a network environment
US8713668B2 (en) 2011-10-17 2014-04-29 Mcafee, Inc. System and method for redirected firewall discovery in a network environment
US10652210B2 (en) 2011-10-17 2020-05-12 Mcafee, Llc System and method for redirected firewall discovery in a network environment
EP2615792A1 (en) * 2012-01-12 2013-07-17 ARXCEO Corporation Methods and Systems for Providing Network Protection by Progressive Degradation of Service
US8739272B1 (en) 2012-04-02 2014-05-27 Mcafee, Inc. System and method for interlocking a host and a gateway
US9413785B2 (en) 2012-04-02 2016-08-09 Mcafee, Inc. System and method for interlocking a host and a gateway
US8973146B2 (en) 2012-12-27 2015-03-03 Mcafee, Inc. Herd based scan avoidance system in a network environment
US10171611B2 (en) 2012-12-27 2019-01-01 Mcafee, Llc Herd based scan avoidance system in a network environment
US11204952B2 (en) * 2012-12-28 2021-12-21 Microsoft Technology Licensing, Llc Detecting anomalies in behavioral network with contextual side information
US11553579B2 (en) 2013-03-14 2023-01-10 Icontrol Networks, Inc. Three-way switch
US9928975B1 (en) 2013-03-14 2018-03-27 Icontrol Networks, Inc. Three-way switch
US9287727B1 (en) 2013-03-15 2016-03-15 Icontrol Networks, Inc. Temporal voltage adaptive lithium battery charger
US10659179B2 (en) 2013-03-15 2020-05-19 Icontrol Networks, Inc. Adaptive power modulation
US9867143B1 (en) 2013-03-15 2018-01-09 Icontrol Networks, Inc. Adaptive Power Modulation
US10117191B2 (en) 2013-03-15 2018-10-30 Icontrol Networks, Inc. Adaptive power modulation
US20140325490A1 (en) * 2013-04-25 2014-10-30 Hewlett-Packard Development Company, L.P. Classifying Source Code Using an Expertise Model
US10348575B2 (en) 2013-06-27 2019-07-09 Icontrol Networks, Inc. Control system user interface
US11296950B2 (en) 2013-06-27 2022-04-05 Icontrol Networks, Inc. Control system user interface
US10841668B2 (en) 2013-08-09 2020-11-17 Icn Acquisition, Llc System, method and apparatus for remote monitoring
US10645347B2 (en) 2013-08-09 2020-05-05 Icn Acquisition, Llc System, method and apparatus for remote monitoring
US11722806B2 (en) 2013-08-09 2023-08-08 Icn Acquisition, Llc System, method and apparatus for remote monitoring
US11438553B1 (en) 2013-08-09 2022-09-06 Icn Acquisition, Llc System, method and apparatus for remote monitoring
US11432055B2 (en) 2013-08-09 2022-08-30 Icn Acquisition, Llc System, method and apparatus for remote monitoring
US11171984B2 (en) 2013-10-24 2021-11-09 Mcafee, Llc Agent assisted malicious application blocking in a network environment
US10205743B2 (en) 2013-10-24 2019-02-12 Mcafee, Llc Agent assisted malicious application blocking in a network environment
US10645115B2 (en) 2013-10-24 2020-05-05 Mcafee, Llc Agent assisted malicious application blocking in a network environment
US9578052B2 (en) 2013-10-24 2017-02-21 Mcafee, Inc. Agent assisted malicious application blocking in a network environment
US10339288B2 (en) * 2013-12-12 2019-07-02 Mcafee, Llc User authentication for mobile devices using behavioral analysis
US11146637B2 (en) 2014-03-03 2021-10-12 Icontrol Networks, Inc. Media content management
US11405463B2 (en) 2014-03-03 2022-08-02 Icontrol Networks, Inc. Media content management
US20170041334A1 (en) * 2014-03-28 2017-02-09 Juniper Networks, Inc. Detecting past intrusions and attacks based on historical network traffic information
US9848006B2 (en) * 2014-03-28 2017-12-19 Juniper Networks, Inc. Detecting past intrusions and attacks based on historical network traffic information
US11140130B2 (en) 2014-09-14 2021-10-05 Sophos Limited Firewall techniques for colored objects on endpoints
US10841339B2 (en) 2014-09-14 2020-11-17 Sophos Limited Normalized indications of compromise
US9967283B2 (en) * 2014-09-14 2018-05-08 Sophos Limited Normalized indications of compromise
US10868818B1 (en) 2014-09-29 2020-12-15 Fireeye, Inc. Systems and methods for generation of signature generation using interactive infection visualizations
US10027689B1 (en) * 2014-09-29 2018-07-17 Fireeye, Inc. Interactive infection visualization for improved exploit detection and signature generation for malware and malware families
US11570148B2 (en) * 2015-08-19 2023-01-31 Huawei Cloud Computing Technologies Co., Ltd. Method and apparatus for deploying security access control policy
US20180191682A1 (en) * 2015-08-19 2018-07-05 Huawei Technologies Co., Ltd. Method and apparatus for deploying security access control policy
US11567847B2 (en) 2020-02-04 2023-01-31 International Business Machines Corporation Identifying anomolous device usage based on usage patterns
US20210336973A1 (en) * 2020-04-27 2021-10-28 Check Point Software Technologies Ltd. Method and system for detecting malicious or suspicious activity by baselining host behavior
US20230008868A1 (en) * 2021-07-08 2023-01-12 Nippon Telegraph And Telephone Corporation User authentication device, user authentication method, and user authentication computer program

Also Published As

Publication number Publication date
US20050108578A1 (en) 2005-05-19
WO2004066112A2 (en) 2004-08-05
WO2004066112A3 (en) 2004-11-25
US7657927B2 (en) 2010-02-02

Similar Documents

Publication Publication Date Title
US7657927B2 (en) Behavior-based host-based intrusion prevention system
US11722521B2 (en) Application firewall
US10657277B2 (en) Behavioral-based control of access to encrypted content by a process
US10691824B2 (en) Behavioral-based control of access to encrypted content by a process
US10834061B2 (en) Perimeter enforcement of encryption rules
US20210334359A1 (en) Mobile device policy enforcement
US10686827B2 (en) Intermediate encryption for exposed content
US10628597B2 (en) Just-in-time encryption
US10263966B2 (en) Perimeter enforcement of encryption rules
GB2565735A (en) Labeling computing objects for improved threat detection
GB2411988A (en) Preventing programs from accessing communication channels withut user permission
US11929992B2 (en) Encrypted cache protection
Barlev et al. Secure yet usable: Protecting servers and Linux containers
WO2019122832A1 (en) Electronic mail security using a user-based inquiry
Turnbull Hardening Linux
WO2022208045A1 (en) Encrypted cache protection
Souppaya et al. Guidance for Securing Microsoft Windows XP Systems for IT Professionals: A NIST Security Configuration Checklist
Badger et al. Guide to Securing Apple OS X 10.10 Systems for IT Professionals
Allen et al. SECURITY IMPROVEMENT MODULE CMU/SEI-SIM-010

Legal Events

Date Code Title Description
AS Assignment

Owner name: PLATFORMLOGIC, INC., MARYLAND

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:TAJALLI, HOMAYOON;GRAHAM, JEFFREY J.;FRASER, TIMOTHY J.;REEL/FRAME:013675/0016

Effective date: 20030116

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION

AS Assignment

Owner name: SYMANTEC CORPORATION, CALIFORNIA

Free format text: MERGER;ASSIGNOR:PLATFORM LOGIC, INC.;REEL/FRAME:050235/0700

Effective date: 20041203