US 7,634,800 B2Grant
Method and apparatus for network assessment and authentication
Issue Date:2009-12-15
•20 Claims
•10 Drawing Sheets
Abstract
Providing a user with assurance that a networked computer is secure, typically before completion of the log-in operation. This can be accomplished by extending the local log-in process to perform a host assessment of the workstation prior to requesting the user's credentials. If the assessment finds a vulnerability, the log-in process can inform the user that the machine is or may be compromised, or repair the vulnerability, prior to completion of the log-in operation. By performing vulnerability assessment at the level of the workstation, a network server is able to determine whether the workstation is a “trusted” platform from which to accept authentication requests. If the vulnerability assessment shows that the workstation is compromised, or if the possibility of remote compromise is high, the network server can elect to fail the authentication on the grounds that the workstation cannot be trusted. Optionally, a vulnerability assessment tool may be able to repair the vulnerability of the workstation, and then allow the authentication to proceed.
Metadata
Assignee
- International Business Machines Corporation
Inventors
- Curtis E. Ide
- Philip C. Brass
- Theodore R. Doty
Application Information
Application Number:US 11/430,297
Filing Date:2006-05-08
Priority Date:2000-06-30
Art Unit:2439
Classifications
IPC:
G06F7/04G06F12/14H04L29/06
Patent Drawings (10 sheets)
Description
Priority and Related Applications
[0001] This application is a continuation of and claims priority under 35 U.S.C. §120 to application Ser. No. 09/607,375 filed Jun. 30, 2000, Now U.S. Pat. No. 7,162,649 entitled “Method and Apparatus for Network Assessment and Authentication.” the entire contents of which are incorporated by reference.
Field of the Invention
[0002] The present invention relates to network security for distributed computer systems and, more specifically, to granting network services and determining the level of supplied services based upon an assessment of the vulnerability of a network computer.
Background of the Invention
[0003] As use of network services becomes more prevalent in distributed computer networks, secure authentication of a computer user increases in importance. Authentication is required to prevent unauthorized use and abuse of network services. Authentication services typically require the user to verify his or her identity to the network service provider to determine whether that user is authorized to use a computer to access the network.
[0004] An authorization mechanism defines who is allowed to do what on a computer. Two computer authorization mechanisms for typical operating systems are privileges and object access control. Users granted a specific privilege can perform an action that is denied to users who do not have the privilege. Typically, privileges are not evaluated on a per-object basis. Instead, a privilege is applied in general to an action for a user. For example, the root user in most UNIX operating systems has a set of privileges associated with authorized actions. The “WINDOWS NT” operating system supports the grant of a set of privileges on a per-user or user group basis.
[0005] When access control is required for a particular object, such as a file, a form of authorization other than a general privilege can be used to define a permission to access the object on a per user basis. Object access control can specify, for each object, different access permissions for different users. For example, on a UNIX system, the “chmod” command allows the user to specify read, write, and execute permissions for the owner, the group, and the world. The “WINDOWS NT” operating system uses a discretionary access list that grants control permissions for different users.
[0006] Both authorization methods support the control of computer actions based on the identity of the user. The user's identity establishes the privileges and the objects that she can access via a computer. Establishing the identity of the user is crucial to security and control in a computer network and is the role of the authentication process.
[0007] There are three branches of authentication technology in common use today to assist verification of the identity of the user. Shared secret (password) technology is one; public key technology is a second; and biometric technology is a third. Conventional authentication involves confirming the user's identity by (1) verifying a shared secret, such as a password, (2) using public/private key encryption and verifying that the user knows the private key, or (3) using unique biometric information about the user, such as fingerprints, retinal patterns, or voice prints. All three technologies revolve around the fundamental principle of credentials. A credential is information useful to establish the identity of a computer user. An authenticating service requests credentials from the user to support a decision about the identity of the user based on the credentials.
[0008] In many organizations and homes today, users operate a workstation, which makes requests for a network service available on a computer network. The workstation is important in authentication for two reasons. First, the workstation is a platform from which the user can access resources, including network services, on the network. Users authenticate and connect to network services from their workstations. Second, the workstation can be silently compromised by an unauthorized party. A “silent” compromise is one that the user cannot easily detect without the aid of external security auditing tools. Silent compromise is typically accomplished by installing a compromise tool called a “root kit” or a “backdoor” on the workstation. For example, current “hacker” software can be used to obtain the customer's password by logging keystrokes or browser screenshots can be taken to intercept SSL-protected HTTP traffic.
[0009] An intruder may compromise the integrity of a workstation, or a workstation may be misconfigured so that compromise is possible. The use of a network service may be compromised when a user accesses a network service from a compromised workstation. This subjects the network service to unauthorized use and abuse by the intruder on a valid user's workstation.
[0010] The effect of a compromised workstation is the potential violation of security mechanism that assumes the workstation is “trusted”, including password-based authentication and some forms of biometric authentication. Smart card authentication implementations also can be subverted if the workstation's Trusted Computer Base is subverted. For example, a user's credentials, such as password and biometric credentials, can be stolen or rogue code can be executed that impersonates the logged-on user.
[0011] Host assessment and authentication is relevant to the Internet environment because most Web clients are currently desktop machines. These machines are capable of being compromised, and are frequent targets of compromising attacks. Some Web sites attempt to verify the security of the client host by performing a security assessment before allowing transactions from that host.
[0012] For example, online banking applications are typically implemented by Web sites that allow customers to view account balances and pay bills. Customers and insurers want assurances that only the customer can perform transactions, and that the transactions are confidential. Current techniques include password authentication to verify that only the customer has access to their account, and SSL or PCT encryption to verify that there is no “man in the middle” capable of intercepting the network traffic.
[0013] In view of the foregoing, there is a need for a way for verifying the integrity of the workstation prior to granting access to and determining the level of a network service. The present invention solves the security compromise problem by providing assurances to the Web site operator (and their insurer) that the user's workstation has not been compromised or is easily compromised. The invention can accomplish this desirable objective by scanning the user's workstation for evidence of compromise and vulnerabilities that could lead to compromise. For example, when a user signs on to a Web site, the scan can be completed as part of the authentication process.
Summary of the Invention
[0014] The disadvantages of the prior art are overcome by the present invention, which can restrict access to a network service based on information about the integrity and security posture of the workstation that originates the service request. A network service receives a request for service from a user on a workstation. Prior to authorizing access to the service, the network service requests or expects to receive credentials from the user and/or the workstation. Workstation credentials are presented as part of the authentication process, and typically include information about the current integrity of the workstation, and the security posture of the workstation. The security posture typically includes data that indicates the potential for the workstation to be compromised. The network service makes a decision about whether to process the service request based on the user credentials and/or the workstation credentials. If the network service decides to process the request, it may elect, based on the workstation credentials, to provide a degraded service that is consistent with the perceived risk of workstation compromise.
[0015] The present invention provides an authentication process that can refuse access by a workstation to a network service based on the integrity and security posture of the workstation that originates the service request. This inventive process can be integrated with other authentication processes, particularly user authentication processes, to enhance the security provided by the authentication process. This augments the authentication and authorization processes of existing network services.
[0016] The present invention can also perform workstation assessments from multiple security perspectives, store the different results, use the assessments to grant or deny service access, and issue a report of these results to authorized users. The term “multiple security perspectives” means that workstation assessments may be performed at different network locations, and with different levels of access to the workstation by a workstation assessment service.
[0017] More particularly described, the present invention provides a network authentication system comprising an assessment service for assessing the vulnerability of a workstation that can be connected to a network server. The network server provides network service(s) over a computer network and requires authentication to maintain secure operations. A workstation is assessed, either locally or over the network, for security vulnerabilities. A workstation assessment service produces workstation credentials comprising integrity information and security posture information. Integrity information describes whether the workstation is compromised, while security posture information describes the workstation's potential for compromise, or security risk. The results of an assessment are compared to a workstation security policy to decide whether to allow network service and to define a level of network service to be supplied to the workstation.
[0018] The workstation assessment service can be located on the workstation, thereby providing a local workstation assessment service. In the alternative, the workstation assessment service can operate on a network machine other than the workstation, thereby providing a network-based workstation assessment service. The network service, upon receiving the service request from a network client operating on a workstation, requests workstation credentials from a local workstation assessment service on the requesting workstation or via the network-based workstation assessment service. The network service can use a persistent store to cache workstation credentials and thereby prevent overly frequent reassessments of the workstation.
[0019] The workstation policy can be stored on a network server that hosts the network service. In the alternative, the workstation policy can be stored on a network server that is different from the server that hosts the network service. The workstation policy also can be stored on the workstation.
[0020] Typical distributed computing environment includes a workstation and a network server, each coupled to a computer network. A network client operates on the workstation, whereas a network service operates on the network server. For a representative scenario, the network service can request workstation credentials from a local workstation assessment service operating on the workstation. In turn, a network client, as part of the network client authentication process, can transmit the workstation credentials to the network service. The network service processes the workstation credentials based on workstation policy and decides whether to allow service to the network client.
[0021] For another aspect, the network service requests workstation credentials from a network-based workstation assessment service. In response, the network workstation assessment service provides workstation credentials to the network service to support the authentication process. The network service processes the workstation credentials and workstation policy to determine whether to allow service to a network client operating on the workstation.
[0022] For yet another aspect, the network service can transmit a security challenge to the network client. In response, the workstation assessment service transmits a reply that allows the network service to verify that the workstation assessment service has completed an assessment. This challenge/response may be implemented by the transmission of a shared secret, such as a pseudo-random number. The response may be generated by a one-way-function (such as MD5 or SHA1) performed on a concatenation of the challenge, the shared secret, and the results of the workstation assessment. The network service verifies that a program with knowledge of the shared secret produced the results of the workstation assessment. The network service can “trust” the results of a workstation assessment based on a positive verification result.
[0023] The network service may utilize the results of the workstation assessment to provide a degraded level of service to the workstation. The service level corresponds with the results in the workstation assessment result set. The level of service can be driven by a metric, such as a scalar score calculated by assigning a weight to each possible result, adding the weights for each result in the workstation assessment result set, and providing a score threshold for each possible level of service. If a score exceeds the score threshold for a particular level of service, then that level of service may not be granted by the network service. In the alternative, a scalar score can be calculated based upon a weighted average of a vulnerability for a workstation, each vulnerability assigned a predetermined priority. Consequently, the level of service can be associated with any conventional metric.
[0024] The service level also can be decided by utilizing techniques, such as artificial intelligence or expert systems, to make an intelligent analysis of the risk involved to the network service, service provider, and end user, given the workstation assessment results. For example, if a network service provides a service in distinct facets, each service facet may make a determination about degree of service provided, utilizing the results of the workstation assessment. When a network service provides data transport for network services, each higher-level network service may make a determination about the service level to be provided, utilizing the results of the workstation assessment, as provided by the data transport service.
[0025] In view of the foregoing, it will be understood that the present invention can grant access to the network services and determine the level of supplied services based upon an assessment of the vulnerability of a workstation coupled to a computer network. The advantages and implementation of the present invention will be described in more detail below in connection with the detailed description, the drawing set, and the attached claims.
Brief Description of the Drawings
[0026] FIG. 1 is a block diagram illustrating the primary components of a network security system, including a local workstation assessment service on a workstation, in accordance with an exemplary embodiment of the present invention.
[0027] FIG. 2 is a logical flowchart diagram illustrating an authentication process in accordance with an exemplary embodiment of the present invention.
[0028] FIG. 3 is a diagram showing interactions between a workstation having a local workstation assessment service and a network server having a network service in accordance with an alternative embodiment of the present invention.
[0029] FIG. 4 is a diagram illustrating a network security system including a workstation having a local workstation assessment service and a workstation security policy for completing a local authentication decision in accordance with an exemplary embodiment of the present invention.
[0030] FIG. 5 is a block diagram illustrating the primary components of a security system including a workstation assessment service co-located with a network service in accordance with an exemplary embodiment of the present invention.
[0031] FIG. 6 is a diagram showing interactions between a workstation, network server, and network workstation assessment server of a network security system in accordance with an exemplary embodiment of the present invention.
[0032] FIG. 7 is a diagram showing interactions between a browser and a Web server in a Web-based security system in accordance with an exemplary embodiment of the present invention.
[0033] FIG. 8 is a diagram showing multiple security perspective assessments invoked by network server through a workstation assessment proxy service in accordance with an exemplary embodiment of the present invention.
[0034] FIG. 9 is a diagram showing interactions between a workstation having a local workstation assessment and a network server having a network service in accordance with an exemplary embodiment of the present invention.
Detailed Description of the Exemplary Embodiments
[0035] In environments where computers are shared, users want an assurance that the computer they are logging-in to is secure, before completion of the log-in operation. This can be accomplished by extending the local log-in process to perform a local host assessment of the workstation prior to requesting the user's credentials. If the assessment finds a vulnerability, the log-in process can inform the user that the machine is or may be compromised, or repair an identified vulnerability, prior to completion of the log-in operation.
[0036] By performing vulnerability assessment at the level of the workstation, the network server is able to determine whether the workstation is a “trusted” platform from which to accept authentication requests. If the vulnerability assessment shows that the computer is compromised, or if the possibility of remote compromise is high, the network server can deny authentication because the workstation cannot be trusted. Optionally, a vulnerability assessment tool may be able to repair the vulnerability of the workstation, thereby allowing the authentication to proceed.
[0037] For example, corporations that implement Virtual Private Networks (VPNs) typically allow people physically located outside corporate facilities access to the corporate network. While corporate computer systems staff can secure the machines physically located in corporate facilities, they cannot control machines located outside corporate boundaries. These external machines present a security risk. Even if the users of the external machines are benevolent, the machines may have been compromised silently. If this happens, the intruder on the external machine may use the VPN connection as a stepping-stone to unauthorized use of the corporate network. This risk can be addressed by extending the log-in process to include vulnerability assessment of the external host. If the vulnerability assessment fails, the external host is not allowed to connect to the network and the user of the external host is notified of the security risk. Another alternative is to automatically address the vulnerability (with the user's approval) by repairing an identified vulnerability, prior to completing the VPN log-in process. This technology can also be used to secure dial-up networking. The dial-up networking authentication process can be extended to include vulnerability assessment of the dial-in host.
[0038] As used in the description herein and throughout the claims, the following terms take the meanings explicitly associated herein, unless the context clearly dictates otherwise: the meaning of “a”, “an”, and “the” includes plural references, the meaning of “in” includes “in” and “on.” Also, as used herein, “global computer network” includes the Internet. A “network service” includes any service that is made available over a distributed computer network. Exemplary embodiments of the invention are now described in detail in connection with the drawings. Referring to the drawings, like numbers indicate like parts throughout the views.
[0039] FIGS. 1 and 2 illustrate a client-invoked vulnerability assessment of a workstation in which the workstation credentials are generated locally at the workstation. In other words, the vulnerability assessment is invoked at the client and the assessment is completed by a local workstation assessment service on the workstation. As shown in FIG. 1 , an exemplary network security system 100 comprises a workstation 115 operating a local workstation assessment service in a network environment including a distributed computer network 125 and a network server 120. A network client 130 retrieves workstation credentials, typically including workstation integrity information and workstation security posture information, from the local workstation assessment service 135 on the workstation 115. The local workstation assessment service 135 generates the workstation credentials by completing a local examination of the workstation 115. The network client 130, which also resides on the workstation 115, presents these credentials to a network service 140 on the network server 120 during an authentication process. The network service 140 decides whether to provide service to the workstation 115 via the network 125 based on the workstation credentials. Specifically, the network service 140 completes this decision-making process by evaluating the workstation against a workstation security policy. This allows the network service 140 to determine the extent to which the workstation 115 complies with its security policy. The network service 140 typically uses a policy compliance measurement to decide what, if any, service level to be the supplied to the workstation 115.
[0040] Turning now to FIG. 2 , a logical flowchart diagram presents an illustration of the sequence of exemplary steps completed by an authentication process in connection with the local workstation assessment service in FIG. 1 . The authentication process is invoked at the client and the assessment is completed by the local workstation assessment service residing on the workstation. The exemplary authentication process 200 begins in step 205 in response to a user initiating a log-in operation on a workstation coupled to a computer network. The workstation includes a local workstation assessment service maintained in memory to support the local generation of workstation credentials. The local workstation assessment service can generate the workstation credentials by completing vulnerability assessment of the workstation. In step 210, a network client residing on the workstation retrieves the workstation credentials from the local workstation assessment service. In addition, the network client can obtain user credentials in step 215 from a user credential database. The network client can provide both the workstation credentials and the user credentials to a network service via a computer network. The network service operates on a network server and is operative to determine whether to provide service to a workstation coupled to the computer network based upon workstation credentials. In step 220, the network service accesses a workstation security policy to support a determination of whether to provide service to the requesting workstation. In a separate decision-making process, the user credentials can be compared to a user credential database to further support secure computing operations.
[0041] The network service completes an authentication decision in step 225 by applying the workstation credentials to the workstation security policy. In the event that the credentials satisfy the workstation security policy, the network service permits operation of the requested service by the workstation in step 230. If the credentials satisfy only a portion of the workstation security policy, the network service can elect to allow the workstation to access a degraded level of service, as shown in step 235. On the other hand, the network service can elect to deny service to the workstation, as shown in step 240.
[0042] FIG. 3 provides an illustration of another alternative exemplary network security system for a computer network comprising one or more workstations and a network server. Similar to FIGS. 1 and 2 , FIG. 3 illustrates a client-invoked vulnerability assessment with a local assessment of the workstation. A workstation 305 comprises a network client 310 and a local workstation assessment service 315. The network server 320 maintains one or more network services 325. Each workstation 305 can access the network service 325 via a distributed computer network. Prior to a service request, the network client 310 issues a request for workstation credentials to initiate an authentication process. In response, the local workstation assessment service 315 completes the vulnerability assessment of the workstation 305 and returns workstation credentials to the network client 310. In this manner, the workstation assessment is completed by a local assessment service operating on the host computer rather than by a server-based assessment service operable to complete a remote scan of the workstation.
[0043] The network client 310 can transmit the workstation credentials and/or user credentials to the network service 325 via the distributed computer network. A typical authentication process is completed by evaluating credentials for a workstation. The network service 325 accesses a workstation security policy to evaluate the workstation credentials and to determine the level of service, if any, to be provided to the workstation 305. The workstation security policy can be maintained on the network server 320 or on a separate server, such as a network policy server or a directory server. The network service 325 can determine whether to allow the workstation 305 to access a network service based upon a comparison of the workstation security policy to the workstation credentials. The network service 325 notifies the network client 310 of the authentication results generated by a comparison of the workstation security policy to the workstation credentials. Although the exemplary network security system 300 completes a local assessment of the host computer, the authentication decision is completed by a separate computer on the distributed computer network, namely the network server 320.
[0044] FIG. 4 illustrates an exemplary network security system 400 that makes a local authentication decision based on a vulnerability analysis completed on the host workstation. The network security system 400 operates in a traditional client-server environment to support the delivery of network services to a client via a remote server. The client invokes the vulnerability assessment, which results in a local assessment of the workstation to support an authentication decision at the client workstation. A workstation 405 has a local workstation assessment service 415 and a workstation security policy 420. The workstation 405 further includes a network client 410, which can be connected a network 425, such as the global Internet. A network server operating a network service 435 is also connected the network 425.
[0045] The network client 410 queries the local workstation assessment service 415 for workstation credentials. The network client 410 completes a policy compliance measurement by using the workstation security policy 420 and the workstation credentials. The network client 410 can then decide whether to use traditional user authentication with the network service 435. Other options include storing the workstation policy on a separate server and caching the workstation credentials on the network server. In this manner, there is no requirement to assess the workstation for each service request.
[0046] FIG. 5 illustrates an alternative exemplary network security system 500 for network service authentication comprising a network workstation assessment service resident at a network server. The architecture of the exemplary network security system of FIG. 5 is based upon a vulnerability assessment invoked by a network service and an assessment completed at the network server rather than at the local workstation. In contrast, the workstation assessment service operates on the host or local workstation in the exemplary network security system 100 of FIG. 1 . Turning now to FIG. 5 , a network client 530, operating on a workstation 515, presents user credentials and a request for service to a network server 520 via a distributed computer network 525. A network service 540, resident on the network server 520, requests workstation credentials from a network workstation assessment service 535. This service may reside on the network server 520, as shown in FIG. 5 , or on another server (not shown) connected to the network 525. The network workstation assessment service 535 generates the workstation credentials by remotely examining the workstation 515 for actual or potential vulnerabilities to security violations. In turn, the network service 540 can evaluate the workstation 515 by comparing the workstation credentials against a workstation security policy. Based upon this evaluation, the network service 540 will determine the level of service, if any, to be provided via the network 525 to the workstation 515. For example, if the network service 540 decides to allow service to the workstation 515, the network server 520 delivers the service via the network 525 for use by the network client 530.
[0047] An alternative exemplary network security system is shown in FIG. 6 . The exemplary network security system supports a network service-invoked vulnerability assessment of a client workstation where the network workstation assessment service is operating on a server other than the network server providing the network service. Turning now to FIG. 6 , the exemplary network security system 600 comprises a workstation 605, a network server 610, and a network workstation assessment server 615, each connected to a distributed computer network, such as the global Internet or an intranet. To obtain a service from the network server 610, a workstation 605 issues a request for service to the network server 610 via the distributed computer network. In response, a network service operating on the network server 610 issues a request for a workstation assessment. The network workstation assessment server 615 responds to the workstation assessment request by remotely completing a workstation assessment of the workstation 605 via the distributed computer network. The workstation assessment comprises a scan of the workstation 605 to identify possible security vulnerabilities of that computer and generates security credentials for the workstation 605. The network workstation assessment server 615 can send the workstation credentials to the network server 610 via the distributed computer network. In turn, the network server 610 compares the workstation credentials to a workstation security policy and decides whether to allow the workstation 605 to access the service available on the network server.
[0048] The exemplary network security system illustrated in FIG. 6 is similar to the network security system shown in FIG. 5 , with the exception that the network workstation assessment service is operating on a server other than the network server providing a network service. In other words, the network server 610 in FIG. 6 is not responsible for completing an assessment of the potential vulnerabilities of the workstation requesting access to network service. Instead, the network server 610 relies upon a workstation assessment service operating on a separate server, the network workstation assessment server 615, to complete a remote scan of the workstation 605 via the distributed computer network. The network service operating on the network server 610 uses the scan results provided by the network workstation assessment server 615 to determine whether to provide a particular service level to the requesting workstation 605.
[0049] An exemplary process 700 for Web-based network service authentication relying upon browser-based technology is shown in FIG. 7 . Turning to FIG. 7 , the process 700 is initiated by a browser 705, which operates on a workstation, requesting a log-in page from a Web server 710 via a distributed computer network, such as the Internet. The Web server 710 provides a service that requires authentication and log-in of a requesting workstation. The Web server 710 transmits a workstation assessment agent, which may be a Java applet, ActiveX control, browser plug-in, or other Web-based executable content, to the Web browser 705 in response to the log-in-request. Once installed at the browser 705, the workstation assessment agent generates workstation credentials based on a local examination of the workstation. For example, if the workstation assessment agent is implemented as a browser plug-in, the plug-in operates within the browser environment to complete a scan of the host computer. The results of this vulnerability scan represent workstation credentials. For the representative example shown in FIG. 7 , the workstation assessment agent is implemented by a browser plug-in 705′.
[0050] The workstation assessment agent, i.e., the browser plug-in 705′, transmits the workstation credentials to the Web server 710 via the computer network. An application on the Web server 710, typically a Web server CGI 715, compares the workstation credentials to a workstation security policy to decide whether the workstation is secure. Service by the Web server 710 is allowed if the Web server CGI 710 determines that the workstation is secure and the Web server 710 authenticates the user. If the Web server CGI 715 decides to continue, and the Web server 710 has not already authenticated the user, the server may now begin the user authentication process. There is a benefit to authenticating the user after completing a vulnerability analysis of the workstation—it is more difficult for an intruder to steal a user's credentials if the intrusion is detected and the user authentication process is terminated before the user presents their credentials.
[0051] Table I provides an overview of the primary network service authentication tasks completed for the Web-based operating environment of a workstation assessment agent operating on a workstation and a Web server, as shown in FIG. 7 . The workstation assessment agent completes vulnerability assessment tasks and transmits the assessment results to the Web server. In turn, the Web server determines whether to provide a network service to the workstation based on the assessment results.
[0052]
| TABLE I | |
|---|---|
| 1. | The user of a workstation requests a log-in |
| page from a Web server, typically by clicking a button or | |
| link on a Web page to begin the authentication process. | |
| 2. | A browser, operating at the workstation, |
| loads a host authentication page. The host authentication | |
| page contains a browser plug-in representing a workstation | |
| assessment agent. | |
| 3. | The browser plug-in performs a host |
| assessment scan of the workstation. | |
| 4. | The browser plug-in sends the scan results |
| via a secure link to a CGI script on the Web server. | |
| 5. | The CGI script uses the scan results to |
| decide whether to grant the host access to a network service | |
| at the Web server. | |
| 6. | If the host is granted access, the CGI script |
| redirects the browser to the next step in the authentication | |
| process, namely user authentication. If the host is denied | |
| access, the CGI script redirects the browser to a page that | |
| explains why the host cannot be granted access to the Web | |
| server. This page also describes what the user can do to | |
| bring the host into compliance so that access will be | |
| granted. | |
[0053] The exemplary Web-based process shown in FIG. 7 is supported by two separate components: (1) the browser plug-in 705′ that performs the workstation assessment; and (2) the CGI script 715, which evaluates the scan assessment results and determines whether the host satisfies authentication requirements. The browser plug-in and the CGI script are representative embodiments of software routines that operate on the workstation and the Web server, respectively. The workstation assessment service is provided by the browser plug-in and implemented by a variety of different software routines, including a Java applet or an ActiveX control. Likewise, the network service implemented by the CGI script can be implemented by other conventional Web-based executable software programs. Consequently, it will be understood that the present invention is not limited to a particular Web-based implementation, such as the representative exemplary embodiment illustrated in FIG. 7 .
[0054] The workstation assessment agent, implemented as a browser plug-in 705′, has two main functions: host assessment and communication of workstation assessment results. The host assessment is completed to determine whether the host is compromised. The browser plug-in 705′ runs a series of checks, each looking for a particular security risk. Each check generates a scan result, which indicates whether a vulnerability risk is present at the workstation. The browser plug-in 705′ then prepares assessment results for transmission to the Web server.
[0055] The browser plug-in 705′ communicates the assessment results to the CGI script 715 operating on the Web server 710. This communication is preferably completed in a secure manner, between the workstation and the Web server, so that results cannot be intercepted by a third party. The communication also should be secure in such a way as to prevent the transmission of false information to the CGI script 715. This can be accomplished by the use of authentication or encryption technologies
[0056] For example, the communication between the browser plug-in 705′ and the CGI script 715 can be completed by sending an HTTPS GET request with vulnerability assessment results stored as parameters of the GET request. The browser plug-in 705′ generates a URL that uses HTTPS for confidentiality and contains the scan results as parameters. These parameters can be obfuscated by using shared secret encryption to prevent reverse engineering of the communications channel and to insure transmission only to appropriate servers.
[0057] The CGI script 715 receives scan results from Web clients, and decides, based on the results, whether to continue the authentication process. The script 715 responds to the scan results by redirecting the Web client, i.e., the workstation, to one of two different Web pages based on this decision. If the script 715 decides to allow authentication to continue, it redirects the browser 705 to a page that continues or completes the log-on process. If the script 715 decides to deny access, it redirects the browser 705 to a page that explains that service access is denied, why access is denied, and what can be done to obtain access to the requested service.
[0058] The CGI script 715 is preferably capable of receiving encrypted data comprising scan results from the browser plug-in 705′, decrypting the data, and making a decision based on the results. The script 715 can assign a score to each different vulnerability identified by the browser plug-in 705′. When all results are received from the browser plug-in 705′, the script 715 calculates a total score by adding the score assigned to each vulnerability. The total score is then compared by the script 715 against a maximum allowable score. If the total score is less than or equal to the maximum allowable score, authentication is allowed to proceed. If the total score is greater than the maximum allowable score, access by the browser 705 to the Web server 710 is denied by the script 715.
[0059] The Web-based design illustrated in FIG. 7 requires the server to decide, based on security assessment information from the client, whether or not to grant access, or possibly grant restricted access to a client workstation. In the alternative, the client can make that decision, given sufficient decision-making information from the server. For example, a browser operating on a workstation can issue a request for a log-in page to a network server. In response, the network server can transmit the log-in page, an authentication plug-in, and a workstation policy to the workstation via the computer network. The authentication plug-in is installable within the browser and operative to generate workstation security credentials by completing a vulnerability assessment of the workstation to identify security vulnerabilities that would compromise the secure operation of the workstation on the computer network. The workstation security credentials can be compared to the workstation policy on the workstation to determine whether the workstation should be granted access to a software service of the network.
[0060] In most web service contexts, the result of a decision-making process for determining whether to grant access by a client to a network service can be expressed as making a choice between URL's. If the decision comes out one way, the browser points to one URL. If it comes out another way, the browser points to a different URL. This can be accomplished on the server side by instructing the client to submit scan information to the server, and having the server redirect the client to the appropriate URL after making the service access decision.
[0061] The client's decision-making procedure typically involves three types of information: vulnerability weights, used to calculate a host score based on found vulnerabilities, a “max score”, used to gate service, and two URLs, one for passing scores and one for failing scores. If the host's score exceeds the max score, the host is not granted access, and is redirected to the URL for failing scores. If the host's score is less than or equal to the max score, the host is allowed access, and is redirected to the URL for passing scores.
[0062] A network server can send vulnerability weights, max score, and URLs to the client, thereby allowing the client to calculate the host score, compare it to the max score, and redirect the browser to the appropriate URL. This delivery of information to the client via the computer network can be completed without compromising the consumer's privacy. However, if the URLs are transmitted to the client without protection, the consumer could intercept the transmitted URL and thereby circumvent the process.
[0063] By authenticating the control or plug-in transmitted to the web server, a verification can be completed so that only the control (or someone who knows the shared secret embedded within it) can request the “success” URL successfully. Assume that the “success” URL is actually the URL of a web script and that a crypto “challenge” is generated and passed to the control along with the URLs. The control can use this challenge, along with a shared secret known only to the control and the “success” URL web script, to generate a crypto “response”.
[0064] Instead of redirecting the browser directly to the web script, the control can redirect the browser to the web script and pass the crypto “response” to the script (typically by simply appending it to the end of the URL). If the crypto “response” does not match the crypto “challenge” that was sent to the control, the script could redirect the browser to the “failure” URL. This way, only those with knowledge of the shared secret (preferably only the control) can request the “success” URL and gain access. This client-based design requires the control to make the network service access decision, instead of sending information from the browser-based control to support a decision by the web server.
[0065] FIG. 8 illustrates an exemplary network security system having a workstation assessment proxy service for processing workstation assessment results. The exemplary network security system supports a vulnerability assessment invoked by a network service and a workstation assessment completed via a proxy service typically operating on a proxy server. As shown in FIG. 8 , a network workstation assessment proxy service 815 collects workstation assessment information from a variety of sources with security perspectives at the request of a network service 810 or a network client 820. This proxy service 815 communicates with different workstation assessment services, combines the assessment results, and returns the results to the network service. The different workstation assessment services can reside, for example, on a local workstation, on the Internet, on a LAN, or on a WAN. The assessment results can be cached in storage for subsequent use. These workstation assessment services provide assessments of the workstation that show security weaknesses visible for a particular level of authentication (i.e. administrative access, guest/anonymous access, normal user level access, etc.). This information can be used by the network service 810 to form a more complete estimate of the workstation's security posture and risk profile.
[0066] The exemplary network security 800 operates in a distributed computing environment comprising a workstation 805, a network service 810, a workstation assessment proxy service 815, a LAN-based network assessment service 830, and an Internet-based network assessment service 835. The distributed computing environment can include one or more workstations 805, each including a network client 820 and a local workstation assessment service 825. An authentication process is initiated in response to network client 820 generating a service request via the distributed computer network. The network service 810 responds to the service request by issuing a workstation assessment request to the workstation assessment proxy service 815. In turn, the workstation assessment proxy service 815 will issue multiple assessment requests to a variety of assessment services to evaluate the potential vulnerability of the workstation 805.
[0067] For example, the workstation assessment proxy service 815 can issue a local assessment request to the local workstation assessment service 825 via the distributed computing network. In addition, the workstation assessment proxy service 815 can issue a network assessment request to both the LAN-based network assessment service 830 and the Internet-based network assessment service 835. Each assessment service completes a scan of the workstation 805 and returns assessment results to the workstation assessment proxy service 815 via the distributed computing network.
[0068] In turn, the workstation assessment proxy service 815 can combine the assessment results and transmit the combined assessment results to the network service 810 via the distributed computer network. The network service 810 applies a workstation security policy to the combined assessment results to determine the level of service, if any, to be provided to the requesting workstation 805. The workstation security policy can be maintained on the network server hosting the network service or a separate server, such as a network policy service or a directory server. The network service 810 notifies the network client 820 of the authentication results via the distributed computing network.
[0069] Another alternative exemplary network security system is shown in FIG. 9 . The exemplary network security system supports a vulnerability assessment invoked by a network service and an assessment completed at the local workstation. The exemplary network security system 900 comprises a workstation 905 and a network server 910, each connected to a distributed computer network, such as the Internet or an intranet. The workstation 905 includes a network client 915 and a local workstation assessment service 920. The network server 910 includes one or more network services 925. To obtain a service from the network server 910, the network client 915 issues a service request to the network server 910 via the distributed computer network. In response, the network service 925 generates a request for an assessment of the workstation 905. The local workstation assessment service operating on the workstation 905 responds to the assessment request by completing a vulnerability scan of the workstation 905 and generating workstation credentials. In turn, the local workstation assessment service 920 transmits the workstation credentials to the network service 925 via the distributed computer network. The workstation credentials represent an evaluation of workstation integrity and security posture.
[0070] The network service 925 assesses a workstation security policy, typically maintained at the network server 910, to evaluate the workstation credentials. Specifically, the network service 925 compares the workstation credentials to the workstation security policy to determine the level of service to be provided, if any, to the workstation 905. Although the workstation security policy is preferably maintained on the network server 910, it will be appreciated that the security policy also can be maintained on a separate server, such as a network policy server or a directory server. Based upon the evaluation of workstation credentials, the network service 925 issues a message to notify the network client 915 of the service level to be provided by the network service 925.
[0071] In view of the foregoing, it will be appreciated that an authentication process can be implemented at a Web server, which evaluates the access of a Web service by a workstation based on workstation credentials (security posture and integrity information). The user can not log-on to the Web service unless the workstation's security posture and integrity comply with the Web service's security policy. Alternately, the user receives a level of access appropriate to the degree of compliance of the workstation's security posture and integrity with the Web service's security policy.
[0072] Alternatively, an authentication process can be implemented by a network connection. This prevents a workstation from joining a network without presenting workstation credentials for approval. This authentication process can be used when a workstation connects to a VPN or to a Microsoft Windows Domain.
[0073] The authentication process also can be implemented as an extension to an extensible authentication process, such as GSSAPI or Microsoft SSPI. Any network service that uses the extensible authentication process can validate the security of the workstation.
[0074] The authentication process can be implemented on a dial-up networking server. When a client dials up, the dial-up server validates the workstation credentials of the dialing up workstation, and decides whether to allow the call to continue or to allow degraded access to the dial-up services.
[0075] The present invention includes a Web-based system can be used for gathering, storing and presenting workstation assessment results. This system performs workstation assessments from multiple security perspectives, and stores the results in a database server. Authorized parties may later retrieve these results by connecting to the Web server. The Web server operates a Web application that grants access to the data in the database for each workstation, and provides Web reports to authorized parties. Because the system stores workstation assessment results from multiple network location and authentication perspectives, it is capable of presenting a comprehensive view of workstation security posture. This comprehensive view can include internal and external assessments of the workstation.
[0076] The present invention is directed to network security for distributed computer systems, including the client-server computing environment. Those skilled in the art will appreciate that a server can operate as a client in a server-to-server environment. In other words, the first server can be a “client” of another server in the distributed computer network. This being the case, the role of the “workstation” described throughout this document can be fulfilled by a server that is requesting access to a network service. Thus, that server would then be assessed via the workstation assessment process during the authentication process. Typically, when one server connects to another server, user credentials, if required, are provided by a computer program or process rather than by a computer user. This use of user authentication and credentials for allowing access by a computer program or process follows the same purpose and method as that of a computer user and, as such, fits within the confines of user authentication as described in this document. Moreover, a client can be implemented by a conventional desktop computing device, a mobile computing device, and other computing platforms, such as browser-enabled telephony devices and personal digital assistants (PDAs).
[0077] Significantly, the present invention can complete a vulnerability analysis of a workstation prior to completion of an authentication of the user of that workstation. A vulnerability analysis for the workstation is completed prior to user authentication because it is more difficult for an intruder to steal a user's credentials if the intrusion is detected and the user authentication process is terminated before the user presents their credentials to the workstation. Consequently, user credentials are preferably compared to a user credential database, which is typically maintained on a server separate from the workstation, only after completion of a vulnerability analysis of the workstation. Those skilled in the art will appreciate, however, that a vulnerability analysis of the workstation can also be completed after user authentication has been successfully completed. For example, the vulnerability assessment can be completed after user authentication and prior to substantive operation of a network service at the workstation.
[0078] The above-described embodiments are presented as illustrative examples. It will be readily appreciated that deviations may be made from the specific embodiments disclosed in this specification without departing from the invention. Accordingly, the scope of this invention is to be determined by the claims below rather than being limited to the specifically described embodiments above.
Claims
Certificate of Correction present
The claims shown below may not include correction changes. Use the corrected PDF for authoritative text.
What is claimed is:
1. A network security system for authenticating a workstation requesting a network service from a network server via a computer network, comprising:
the network service operative to generate workstation security credentials by completing a vulnerability assessment comprising a scan of the workstation to identity at least one of security vulnerabilities that would compromise the secure operation of the workstation on the computer network and evidence of a compromise, the workstation security credentials comprising one of integrity information describing whether the workstation has been compromised, and security posture information describing the workstation's potential for compromise;
the network service further operative to determine whether the workstation should be granted access to a software service of the network based on the workstation security credentials.
2. The network security system of claim 1, further comprising a workstation security policy at the network server, the workstation security policy operative to define security requirements for secure operation of the workstation on the computer network.
3. The network security system of claim 1, wherein the network service is further operative to compare the workstation security credentials to a workstation security policy to determine whether the workstation should be granted access to the software service, the network service operative to authorize access to the software service by the workstation if the workstation security credentials satisfy the workstation security policy.
4. The network security system of claim 1, wherein the network service is further operative to authorize access to a predetermined level of the software service if the workstation security credentials satisfy a portion of a workstation security policy.
5. The network security system of claim 1, wherein the network service is further operative to communicate a service decision from the network server to the workstation via the computer network, the service decision defining whether the workstation is allowed to access the software service or a degraded form of the software service.
6. The network security system of claim 1, wherein a workstation security policy is maintained on the network server and wherein the network service is further operative to compare the workstation security credentials to the workstation security policy to determine whether the workstation should be granted access to the software service or a degraded form of the software service.
7. The network security system of claim 1, wherein the network service is further operative to communicate a service decision from the network server to the workstation via the computer network, the service decision defining a degraded form of the software service.
8. The network security system of claim 1, wherein completing a vulnerability assessment comprising the scan of the workstation further comprises calculating a score associated with vulnerability of the workstation.
9. The network security system of claim 1, wherein completing a vulnerability assessment comprising a scan of the workstation further comprises calculating a score associated with vulnerability of the workstation and assigning a level of the network service based on the score.
10. A computer-implemented process for authenticating a workstation requesting a network service from a network server via a computer network, comprising the steps:
completing a vulnerability assessment comprising a scan of the workstation to identify at least one of security vulnerabilities that would compromise the secure operation of the workstation on the computer network and evidence of a compromise;
generating workstation security credentials based on the vulnerability assessment, the workstation security credentials comprising one of integrity information describing whether the workstation has been compromised, and security posture information describing the workstation's potential for compromise;
comparing the workstation security credentials to a workstation security policy to determine whether the workstation should be granted access to the network service; and
authorizing access to the network service by the workstation if the workstation security credentials satisfy the workstation security policy, otherwise denying access to the network service by the workstation.
11. The computer-implemented process of claim 10, further comprising the step of authorizing access to a predetermined level of the network service if the workstation security credentials satisfy a portion of the workstation security policy.
12. The computer-implemented process of claim 10, wherein completing the vulnerability assessment comprising the scan of the workstation further comprises calculating a score associated with vulnerability of the workstation and assigning a level of the network service based on the score.
13. The computer-implemented process of claim 10, wherein the step of generating the workstation security credentials comprises completing the vulnerability assessment of the workstation by a network workstation assessment service maintained on an assessment server coupled to the computer network, the assessment server operating as a remote server different from the network server, the network workstation assessment service operative to generate the workstation security credentials.
14. The computer-implemented process of claim 10, wherein the step of generating the workstation security credentials comprises completing the vulnerability assessment of the workstation by a local workstation assessment service maintained on the workstation, the local workstation assessment service operative to generate the workstation security credentials.
15. The computer-implemented process of claim 10, wherein the workstation security policy is maintained on the network server, the process further comprising the steps of:
transmitting the workstation security credentials from the network workstation assessment service on an assessment server to the network service on the network server via the computer network; and
comparing at the network server the workstation security credentials to the workstation security policy to determine whether the workstation should be granted access to the network service.
16. The computer-implemented process of claim 10, further comprising the step of communicating a service decision from the network server to the workstation via the computer network, the service decision defining whether the workstation is allowed to access the network service or a degraded form of the network service.
17. The computer-implemented process of claim 10, wherein the step of generating the workstation security credentials comprises completing the vulnerability assessment of the workstation by the network service on the network server in response to receiving a request for the network service from the workstation via the computer network.
18. The computer-implemented process of claim 10, wherein the workstation security policy is maintained on the network server, the process further comprising the step of comparing at the network server the workstation security credentials to the workstation security policy to determine whether the workstation should be granted access to the network service or a degraded form of the network service.
19. A network security system for authenticating a workstation requesting a network service from a network server via a computer network, comprising:
a local workstation assessment service, operative on the workstation, for generating workstation security credentials by completing a vulnerability assessment of the workstation comprising a scan to identify at least one of security vulnerabilities that would compromise the secure operation of the workstation on the computer network and evidence of a compromise, the workstation security credentials comprising one of integrity information describing whether the workstation has been compromised, and security posture information describing the workstation's potential for compromise; and
a workstation security policy, operative on the workstation, for defining security policy requirements for secure operations by the workstation;
the local workstation assessment service further operative for comparing the workstation security credentials to the workstation security policy to determine whether the workstation should be granted access to the network service,
the local workstation assessment service further operative to authorize access to the network service by the workstation if the workstation security credentials satisfy the workstation security policy.
20. The network security system of claim 19, wherein the local workstation assessment service is further operative to authorize access to a predetermined level of the network service if the workstation security credentials satisfy a portion of the workstation security policy.
Patent Citations (258)
| Patent | Date | Inventor | Cited By |
|---|---|---|---|
| US4223380(A) | 1980-09-01 | Antonaccio et al. | Applicant |
| US4400769(A) | 1983-08-01 | Kaneda et al. | Applicant |
| US4672609(A) | 1987-06-01 | Humphrey et al. | Applicant |
| US4773028(A) | 1988-09-01 | Tallman | Applicant |
| US4819234(A) | 1989-04-01 | Huber | Applicant |
| US4975950(A) | 1990-12-01 | Lentz | Applicant |
| US5032979(A) | 1991-07-01 | Hecht et al. | Applicant |
| US5121345(A) | 1992-06-01 | Lentz | Applicant |
| US5204966(A) | 1993-04-01 | Wittenberg et al. | Applicant |
| US5210704(A) | 1993-05-01 | Husseiny | Applicant |
| US5274824(A) | 1993-12-01 | Howarth | Applicant |
| US5278901(A) | 1994-01-01 | Shieh et al. | Applicant |
| US5309562(A) | 1994-05-01 | Li | Applicant |
| US5311593(A) | 1994-05-01 | Carmi | Applicant |
| US5345595(A) | 1994-09-01 | Johnson et al. | Applicant |
| US5347450(A) | 1994-09-01 | Nugent | Applicant |
| US5353393(A) | 1994-10-01 | Bennett et al. | Applicant |
| US5359659(A) | 1994-10-01 | Rosenthal | Applicant |
| US5371852(A) | 1994-12-01 | Attanasio et al. | Applicant |
| US5398196(A) | 1995-03-01 | Chambers | Applicant |
| US5414833(A) | 1995-05-01 | Hershey et al. | Applicant |
| US5440723(A) | 1995-08-01 | Arnold et al. | Applicant |
| US5452442(A) | 1995-09-01 | Kephart | Applicant |
| US5454074(A) | 1995-09-01 | Hartel et al. | Applicant |
| US5475839(A) | 1995-12-01 | Watson et al. | Applicant |
| US5511184(A) | 1996-04-01 | Lin | Applicant |
| US5515508(A) | 1996-05-01 | Pettus et al. | Applicant |
| US5522026(A) | 1996-05-01 | Records et al. | Applicant |
| US5539659(A) | 1996-07-01 | McKee et al. | Applicant |
| US5557742(A) | 1996-09-01 | Smaha et al. | Applicant |
| US5586260(A) | 1996-12-01 | Hu | Applicant |
| US5590331(A) | 1996-12-01 | Lewis et al. | Applicant |
| US5606668(A) | 1997-02-01 | Shwed | Applicant |
| US5623600(A) | 1997-04-01 | Ji et al. | Applicant |
| US5623601(A) | 1997-04-01 | Vu | Applicant |
| US5630061(A) | 1997-05-01 | Richter et al. | Applicant |
| US5649095(A) | 1997-07-01 | Cozza | Applicant |
| US5649185(A) | 1997-07-01 | Antognini et al. | Applicant |
| US5675711(A) | 1997-10-01 | Kephart et al. | Applicant |
| US5696486(A) | 1997-12-01 | Poliquin et al. | Applicant |
| US5696822(A) | 1997-12-01 | Nachenberg | Applicant |
| US5706210(A) | 1998-01-01 | Kumano et al. | Applicant |
| US5734697(A) | 1998-03-01 | Jabbarnezhad | Applicant |
| US5745692(A) | 1998-04-01 | Lohmann, II et al. | Applicant |
| US5748098(A) | 1998-05-01 | Grace | Applicant |
| US5761504(A) | 1998-06-01 | Corrigan et al. | Applicant |
| US5764887(A) | 1998-06-01 | Kells et al. | Applicant |
| US5764890(A) | 1998-06-01 | Glasser et al. | Applicant |
| US5765030(A) | 1998-06-01 | Nachenberg et al. | Applicant |
| US5774727(A) | 1998-06-01 | Walsh et al. | Applicant |
| US5787177(A) | 1998-07-01 | Leppek | Applicant |
| US5790799(A) | 1998-08-01 | Mogul | Applicant |
| US5796942(A) | 1998-08-01 | Esbensen | Applicant |
| US5798706(A) | 1998-08-01 | Kraemer et al. | Applicant |
| US5812763(A) | 1998-09-01 | Teng | Applicant |
| US5815574(A) | 1998-09-01 | Fortinsky | Applicant |
| US5822517(A) | 1998-10-01 | Dotan | Applicant |
| US5826013(A) | 1998-10-01 | Nachenberg | Applicant |
| US5828833(A) | 1998-10-01 | Belville et al. | Applicant |
| US5832208(A) | 1998-11-01 | Chen et al. | Applicant |
| US5832211(A) | 1998-11-01 | Blakley, III et al. | Applicant |
| US5835726(A) | 1998-11-01 | Shwed et al. | Applicant |
| US5838903(A) | 1998-11-01 | Blakely, III et al. | Applicant |
| US5842002(A) | 1998-11-01 | Schnurer et al. | Applicant |
| US5845067(A) | 1998-12-01 | Porter et al. | Applicant |
| US5848233(A) | 1998-12-01 | Radia et al. | Applicant |
| US5854916(A) | 1998-12-01 | Nachenberg | Applicant |
| US5857191(A) | 1999-01-01 | Blackwell, Jr. et al. | Applicant |
| US5864665(A) | 1999-01-01 | Tran | Applicant |
| US5864803(A) | 1999-01-01 | Nussbaum | Applicant |
| US5872978(A) | 1999-02-01 | Hoskins | Applicant |
| US5875296(A) | 1999-02-01 | Shi et al. | Applicant |
| US5878420(A) | 1999-03-01 | de la Salle | Applicant |
| US5881236(A) | 1999-03-01 | Dickey | Applicant |
| US5884033(A) | 1999-03-01 | Duvall et al. | Applicant |
| US5892903(A) | 1999-04-01 | Klaus | Applicant |
| US5899999(A) | 1999-05-01 | De Bonet | Applicant |
| US5907834(A) | 1999-05-01 | Kephart et al. | Applicant |
| US5919257(A) | 1999-07-01 | Trostle | Applicant |
| US5919258(A) | 1999-07-01 | Kayashima et al. | Applicant |
| US5922051(A) | 1999-07-01 | Sidey | Applicant |
| US5925126(A) | 1999-07-01 | Hsieh | Applicant |
| US5931946(A) | 1999-08-01 | Terada et al. | Applicant |
| US5940591(A) | 1999-08-01 | Boyle et al. | Applicant |
| US5950012(A) | 1999-09-01 | Shiell et al. | Applicant |
| US5961644(A) | 1999-10-01 | Kurtzberg et al. | Applicant |
| US5964839(A) | 1999-10-01 | Johnson et al. | Applicant |
| US5964889(A) | 1999-10-01 | Nachenberg | Applicant |
| US5974237(A) | 1999-10-01 | Shurmer et al. | Applicant |
| US5974457(A) | 1999-10-01 | Waclawsky et al. | Applicant |
| US5978917(A) | 1999-11-01 | Chi | Applicant |
| US5983270(A) | 1999-11-01 | Abraham et al. | Applicant |
| US5983348(A) | 1999-11-01 | Ji | Applicant |
| US5983350(A) | 1999-11-01 | Minear et al. | Applicant |
| US5987606(A) | 1999-11-01 | Cirasole et al. | Applicant |
| US5987610(A) | 1999-11-01 | Franczek et al. | Applicant |
| US5987611(A) | 1999-11-01 | Freund | Applicant |
| US5991856(A) | 1999-11-01 | Spilo et al. | Applicant |
| US5991881(A) | 1999-11-01 | Conklin et al. | Applicant |
| US5999711(A) | 1999-12-01 | Misra et al. | Applicant |
| US5999723(A) | 1999-12-01 | Nachenberg | Applicant |
| US6003132(A) | 1999-12-01 | Mann | Applicant |
| US6006016(A) | 1999-12-01 | Faigon et al. | Applicant |
| US6009467(A) | 1999-12-01 | Ratcliff et al. | Applicant |
| US6014645(A) | 2000-01-01 | Cunningham | Applicant |
| US6016553(A) | 2000-01-01 | Schneider et al. | Applicant |
| US6021510(A) | 2000-02-01 | Nachenberg | Applicant |
| US6026442(A) | 2000-02-01 | Lewis et al. | Applicant |
| US6029256(A) | 2000-02-01 | Kouznetsov | Applicant |
| US6035323(A) | 2000-03-01 | Narayen et al. | Applicant |
| US6035423(A) | 2000-03-01 | Hodges et al. | Applicant |
| US6041347(A) | 2000-03-01 | Harsham et al. | Applicant |
| US6052709(A) | 2000-04-01 | Paul | Applicant |
| US6061795(A) | 2000-05-01 | Dircks et al. | Applicant |
| US6067410(A) | 2000-05-01 | Nachenberg | Applicant |
| US6070190(A) | 2000-05-01 | Reps et al. | Applicant |
| US6070244(A) | 2000-05-01 | Orchier et al. | Applicant |
| US6073172(A) | 2000-06-01 | Frailong et al. | Applicant |
| US6081894(A) | 2000-06-01 | Mann | Applicant |
| US6085224(A) | 2000-07-01 | Wagner | Applicant |
| US6088803(A) | 2000-07-01 | Tso et al. | Applicant |
| US6088804(A) | 2000-07-01 | Hill et al. | Applicant |
| US6092194(A) | 2000-07-01 | Touboul | Applicant |
| US6094731(A) | 2000-07-01 | Waldin et al. | Applicant |
| US6098173(A) | 2000-08-01 | Elgressy et al. | Applicant |
| US6104783(A) | 2000-08-01 | DeFino | Applicant |
| US6108799(A) | 2000-08-01 | Boulay et al. | Applicant |
| US6118940(A) | 2000-09-01 | Alexander, III et al. | Applicant |
| US6119165(A) | 2000-09-01 | Li et al. | Applicant |
| US6119234(A) | 2000-09-01 | Aziz et al. | Applicant |
| US6122738(A) | 2000-09-01 | Millard | Applicant |
| US6144961(A) | 2000-11-01 | de la Salle | Applicant |
| US6154844(A) | 2000-11-01 | Touboul et al. | Applicant |
| US6161109(A) | 2000-12-01 | Matamoros et al. | Applicant |
| US6167520(A) | 2000-12-01 | Touboul | Applicant |
| US6173413(B1) | 2001-01-01 | Slaughter et al. | Applicant |
| US6185689(B1) | 2001-02-01 | Todd et al. | Examiner |
| US6195687(B1) | 2001-02-01 | Greaves et al. | Applicant |
| US6199181(B1) | 2001-03-01 | Rechef et al. | Applicant |
| US6205552(B1) | 2001-03-01 | Fudge | Applicant |
| US6226372(B1) | 2001-05-01 | Beebe et al. | Examiner |
| US6230288(B1) | 2001-05-01 | Kuo et al. | Applicant |
| US6266773(B1) | 2001-07-01 | Kisor et al. | Applicant |
| US6266774(B1) | 2001-07-01 | Sampath et al. | Applicant |
| US6271840(B1) | 2001-08-01 | Finseth et al. | Applicant |
| US6272641(B1) | 2001-08-01 | Ji | Applicant |
| US6275938(B1) | 2001-08-01 | Bond et al. | Applicant |
| US6275942(B1) | 2001-08-01 | Bernhard et al. | Applicant |
| US6278886(B1) | 2001-08-01 | Hwang | Applicant |
| US6279113(B1) | 2001-08-01 | Vaidya | Applicant |
| US6282546(B1) | 2001-08-01 | Gleichauf et al. | Applicant |
| US6298445(B1) | 2001-10-01 | Shostack et al. | Applicant |
| US6301668(B1) | 2001-10-01 | Gleichauf et al. | Examiner |
| US6314520(B1) | 2001-11-01 | Schell et al. | Applicant |
| US6314525(B1) | 2001-11-01 | Mahalingham et al. | Applicant |
| US6321338(B1) | 2001-11-01 | Porras et al. | Applicant |
| US6324627(B1) | 2001-11-01 | Kricheff et al. | Applicant |
| US6324647(B1) | 2001-11-01 | Bowman-Amuah | Applicant |
| US6324656(B1) | 2001-11-01 | Gleichauf et al. | Applicant |
| US6338141(B1) | 2002-01-01 | Wells | Applicant |
| US6347374(B1) | 2002-02-01 | Drake et al. | Applicant |
| US6353385(B1) | 2002-03-01 | Molini et al. | Applicant |
| US6357008(B1) | 2002-03-01 | Nachenberg | Applicant |
| US6377994(B1) | 2002-04-01 | Ault et al. | Applicant |
| US6396845(B1) | 2002-05-01 | Sugita | Applicant |
| US6397242(B1) | 2002-05-01 | Devine et al. | Applicant |
| US6397245(B1) | 2002-05-01 | Johnson, II et al. | Applicant |
| US6405318(B1) | 2002-06-01 | Rowland | Applicant |
| US6405364(B1) | 2002-06-01 | Bowman-Amuah | Applicant |
| US6408391(B1) | 2002-06-01 | Huff et al. | Applicant |
| US6415321(B1) | 2002-07-01 | Gleichauf et al. | Applicant |
| US6429952(B1) | 2002-08-01 | Olbricht | Applicant |
| US6434615(B1) | 2002-08-01 | Dinh et al. | Examiner |
| US6438600(B1) | 2002-08-01 | Greenfield et al. | Applicant |
| US6445822(B1) | 2002-09-01 | Crill et al. | Applicant |
| US6453345(B2) | 2002-09-01 | Trcka et al. | Applicant |
| US6453346(B1) | 2002-09-01 | Garg et al. | Applicant |
| US6460141(B1) | 2002-10-01 | Olden | Applicant |
| US6463426(B1) | 2002-10-01 | Lipson et al. | Applicant |
| US6470449(B1) | 2002-10-01 | Blandford | Applicant |
| US6477585(B1) | 2002-11-01 | Cohen et al. | Applicant |
| US6477648(B1) | 2002-11-01 | Schell et al. | Applicant |
| US6477651(B1) | 2002-11-01 | Teal | Applicant |
| US6484203(B1) | 2002-11-01 | Porras et al. | Applicant |
| US6487666(B1) | 2002-11-01 | Shanklin et al. | Applicant |
| US6496858(B1) | 2002-12-01 | Frailong et al. | Applicant |
| US6499107(B1) | 2002-12-01 | Gleichauf et al. | Applicant |
| US6510523(B1) | 2003-01-01 | Perlman et al. | Examiner |
| US6517587(B2) | 2003-02-01 | Satyavolu et al. | Applicant |
| US6519647(B1) | 2003-02-01 | Howard et al. | Applicant |
| US6519703(B1) | 2003-02-01 | Joyce | Applicant |
| US6530024(B1) | 2003-03-01 | Proctor | Examiner |
| US6535227(B1) | 2003-03-01 | Fox et al. | Examiner |
| US6546493(B1) | 2003-04-01 | Magdych et al. | Applicant |
| US6563959(B1) | 2003-05-01 | Troyanker | Applicant |
| US6574737(B1) | 2003-06-01 | Kingsford et al. | Applicant |
| US6578147(B1) | 2003-06-01 | Shanklin et al. | Applicant |
| US6584454(B1) | 2003-06-01 | Hummel, Jr. et al. | Applicant |
| US6601190(B1) | 2003-07-01 | Meyer et al. | Applicant |
| US6606744(B1) | 2003-08-01 | Mikurak | Applicant |
| US6618501(B1) | 2003-09-01 | Osawa et al. | Applicant |
| US6628824(B1) | 2003-09-01 | Belanger | Applicant |
| US6647139(B1) | 2003-11-01 | Kunii et al. | Applicant |
| US6647400(B1) | 2003-11-01 | Moran | Applicant |
| US6661904(B1) | 2003-12-01 | Sasich et al. | Applicant |
| US6668082(B1) | 2003-12-01 | Davison et al. | Applicant |
| US6668084(B1) | 2003-12-01 | Minami | Applicant |
| US6681331(B1) | 2004-01-01 | Munson et al. | Applicant |
| US6691232(B1) | 2004-02-01 | Wood et al. | Applicant |
| US6704874(B1) | 2004-03-01 | Porras et al. | Applicant |
| US6708212(B2) | 2004-03-01 | Porras et al. | Applicant |
| US6711127(B1) | 2004-03-01 | Gorman et al. | Applicant |
| US6711615(B2) | 2004-03-01 | Porras et al. | Applicant |
| US6718383(B1) | 2004-04-01 | Hebert | Applicant |
| US6721806(B2) | 2004-04-01 | Boyd et al. | Applicant |
| US6725377(B1) | 2004-04-01 | Kouznetsov | Applicant |
| US6725378(B1) | 2004-04-01 | Schuba et al. | Applicant |
| US6775780(B1) | 2004-08-01 | Muttik | Applicant |
| US6792144(B1) | 2004-09-01 | Yan et al. | Applicant |
| US6792546(B1) | 2004-09-01 | Shanklin et al. | Applicant |
| US6816973(B1) | 2004-11-01 | Gleichauf et al. | Applicant |
| US6839850(B1) | 2005-01-01 | Campbell et al. | Applicant |
| US6871284(B2) | 2005-03-01 | Cooper et al. | Applicant |
| US6883101(B1) | 2005-04-01 | Fox et al. | Examiner |
| US7096502(B1) | 2006-08-01 | Fox et al. | Examiner |
| US2001/0034847(A1) | 2001-10-01 | Gaul, Jr. | Applicant |
| US2002/0032717(A1) | 2002-03-01 | Malan et al. | Applicant |
| US2002/0032793(A1) | 2002-03-01 | Malan et al. | Applicant |
| US2002/0032880(A1) | 2002-03-01 | Poletto et al. | Applicant |
| US2002/0035698(A1) | 2002-03-01 | Malan et al. | Applicant |
| US2002/0083331(A1) | 2002-06-01 | Krumel | Applicant |
| US2002/0083334(A1) | 2002-06-01 | Rogers et al. | Applicant |
| US2002/0138753(A1) | 2002-09-01 | Munson | Applicant |
| US2002/0144156(A1) | 2002-10-01 | Copeland, III | Applicant |
| US2003/0037136(A1) | 2003-02-01 | Labovitz et al. | Applicant |
| US2003/0088791(A1) | 2003-05-01 | Porras et al. | Applicant |
| US2003/0212903(A1) | 2003-11-01 | Porras et al. | Applicant |
| US2004/0010718(A1) | 2004-01-01 | Porras et al. | Applicant |
| EP636977 | 2001-05-01 | Applicant | |
| EP985995 | 2003-08-01 | Applicant | |
| WO93/25024 | 1993-12-01 | Applicant | |
| WO98/41919 | 1998-09-01 | Applicant | |
| WO99/00720 | 1999-01-01 | Applicant | |
| WO99/13427 | 1999-03-01 | Applicant | |
| WO99/15966 | 1999-04-01 | Applicant | |
| WO99/50734 | 1999-10-01 | Applicant | |
| WO99/53391 | 1999-10-01 | Applicant | |
| WO99/57626 | 1999-11-01 | Applicant | |
| WO/02115 | 2000-01-01 | Applicant | |
| WO/10278 | 2000-02-01 | Applicant | |
| WO/25214 | 2000-05-01 | Applicant | |
| WO/25527 | 2000-05-01 | Applicant | |
| WO/34867 | 2000-06-01 | Applicant | |
| WO/54458 | 2000-09-01 | Applicant | |
| WO1/84285 | 2001-11-01 | Applicant | |
| WO2/06928 | 2002-01-01 | Applicant | |
| WO2/056152 | 2002-07-01 | Applicant | |
| WO2/101516 | 2002-12-01 | Applicant |
Non-Patent Literature (345)
- Crosbie, Mark, et al., “Active Defense of a Computer System Using Autonomous Agents,” Coast Group Dept. of Computer Sciences Purdue, 1995 n95-008, “citeseer.ist.psu.edu/138521.html”, pp. 1-14.Applicant
- Munson, J.C., et al., “Watcher: the missing piece of the security puzzle,” Computer Security Applications Conference, 2001. ACSAC 2001. Proceedings 17th Annual, pp. 230-239.Applicant
- Kosoresow, Andrew, P., et al., “Intrusion Detection via System Call Traces,” Software, IEEE, vol. 14, Issue 5, Sep.-Oct. 1997, pp. 35-42.Applicant
- “Understanding Heuristics: Symantec's Bloodhound Technology Symantec White Paper Series,” vol. XXXIV. 16 pgs.Applicant
- “Update on Network “Sniffing” Security Vulnerabilities Nasirc Bulletin,” #94-10, Mar. 29, 1994, http://csrc.nist.gov/secalert/nasa/nassa9410.txt. 6 pgs.Applicant
- Essex, David, E-Sleuths Make Net Safe for E-Commerce, Computerworld, Jun. 2000, pp. 1-2.Applicant
- Newman, David, Intrusion Detection Systems, Data Communications, 1998, pp. 1-9.Applicant
- International Search Report for PCT/US02/17161 of Dec. 31, 2002.Applicant
- Hyland, et al., Concentric Supervision of Security Applications: A New Security Management Paradigm Computer Security Applications Conference, 1998, pp. 59-68.Applicant
- Koilpillai et al., Recon-A Tool for Incident Detection, Tracking and Response, Darpa Information Survivability Conference and Exposition, 2000, pp. 199-206.Applicant
- Alves-Foss, J., an Overview of SNIF: A Tool for Surveying Network Information Flow, Network and Distributed System Security, 1995, pp. 94-101.Applicant
- Mansouri-Samani et al., A Configurable Event Service for Distributed Systems Configurable Distributed Systems, 1996, pp. 210-217.Applicant
- International Search Report for PCT/US01/13769 of Mar. 8, 2002.Applicant
- Jagannathan et al., System Design Document: Next-Generation Intrusion Detection Expert Systems (NIDES), Internet Citation, Mar. 9, 1993, XP002136082, pp. 1-66.Applicant
- Koilpillai, Adaptive Network Security Management, DARPA NGI PI Conference, Oct. 1998, pp. 1-27.Applicant
- Hiverworld Continuous Adaptive Risk Management, Hiverworld, Inc., 1999-2000, pp. 1-14.Applicant
- International Search Report for PCT/US02/04989of Sep. 19, 2002.Applicant
- International Search Report for PCT/US02/02917 of Aug. 8, 2002.Applicant
- International Search Report for PCT/US03/00155 of May 15, 2003.Applicant
- NXI Communications, Inc., White Paper, NTS Security Issues, Oct. 15, 2001, pp. 1-12.Applicant
- Mounji et al., Distributed Audit Trail Analysis, Proceedings of the Symposium of Network and Distributed System Security, San Diego, CA, Feb. 16-17, 1995, pp. 102-112.Applicant
- Wobber et al., Authentication in the Taos Operating System, ACM Transactions on Computer Systems, vol. 12, No. 1, Feb. 1994, pp. 3-32.Applicant
- Mayer et al., The Design of the Trusted Workstation: A True Infosec Product, 13th National Computer Security Conference, Washing, DC, Oct. 1-4, 1990, pp. 827-839.Applicant
- Dawson, Intrusion Protection for Networks, Byte, Apr. 1995, pp. 171-172.Applicant
- Buhkan, Checkpoint Charlie, PC Week Network, Nov. 27, 1995, pp. N1, N6-N7.Applicant
- Process Software Technical Support Page, found on http://www.process.com/techsupport/whitesec.html, printed off of the Process Software website on Feb. 26, 2003, pp. 1-5.Applicant
- Ganesan, BAfirewall: A Modern Firewall Design, Proceedings Internet Society Symposium on Network and Distributed System Security 1994, Internet Soc., 1994, pp. 99-108.Applicant
- Lee, Trusted Systems, Chapter II-1-6 of Handbook of Information Security Management, Ed. Zella G. Ruthberg and Harold F. Tipton, Auerbach, Boston and New York, 1993, pp. 345-362.Applicant
- Lunt, Automated Intrusion Detection, Chapter II-4-4 of Handbook of Information Security Management, Ed. Zella G. Ruthberg and Harold F. Tipton, Auerbach, Boston and New York, 1993, pp. 551-563.Applicant
- Guha et al., Network Security via Reverse Engineering of TCP Code: Vulnerability Analysis and Proposed Solution, IEEE, Mar. 1996, pp. 603-610.Applicant
- Garg et al., High Level Communication Primitives for Concurrent Systems, IEEE, 1988, pp. 92-99.Applicant
- Hastings et al., TCP/IP Spoofing Fundamentals, IEEE, May 1996, pp. 218-224.Applicant
- Snapp, Signature Analysis and Communication Issues in a Distributed Intrusion Detection System, Master Thesis, University of California, Davis, California, 1991, pp. 1-40.Applicant
- Guha et al., Network Security via Reverse Engineering of TCP Code: Vulnerability Analysis and Proposed Solutions, IEEE, Jul. 1997, pp. 40-48.Applicant
- Djahandari et al., An MBone for an Application Gateway Firewall, IEEE, Nov. 1997, pp. 72-81.Applicant
- Kim et al., Implementing a Secure Login Environment: A Case Study of Using a Secure Network Layer Protocol, Department of Computer Science, University of Alabama, Jun. 1995, pp. 1-9.Applicant
- Satyanarayanan, Integrating Security in a Large Distributed System, Acm Transaction on Computer Systems, vol. 7, No. 3, Aug. 1989, pp. 47-280.Applicant
- Sammons, Nathaniel, “Multi-platform Interrogation and Reporting with Rscan,” The Ninth Systems Administration Conference, LISA 1995, Monterrey, California, Sep. 17-22, 1995, pp. 75-87.Applicant
- Dean et al., “Java Security: From HotJava to Netscape and Beyond,” Proceedings of the 1996 IEEE Symposium on Security and Privacy, May 6-8, 1996, Oakland, California, pp. 190-200.Applicant
- Fisch et al., “The Design of an Audit Trail Analysis Tool,” Proceedings of the 10th Annual Computer Security Applications Conference, Dec. 5-9, 1994, Orlando, Florida, pp. 126-132.Applicant
- Safford et al., “The TAMU Security Package: An Ongoing Response to Internet Intruders in an Academic Environment,” USENIX Symposium Proceedings, UNIX Security IV, Oct. 4-6, 1993, Santa Clara, California, pp. 91-118.Applicant
- Sugawara, Toshiharu, “A Cooperative LAN Diagnostic and Observation Expert System,” Ninth Annual Phoenix Conference on Computers and Communications, 1990 Conference Proceedings, Mar. 21-23, 1990, Scottsdale, Arizona, pp. 667-674.Applicant
- Casella, Karen A., “Security Administration in an Open Networking Environment,” The Ninth Systems Administration Conference, LISA 1995, Monterrey, California, Sep. 17-22, 1995, pp. 67-73.Applicant
- Burchell, Jonathan, “Vi-SPY: Universal NIM?” Virus Bulletin, Jan. 1995, pp. 20-22.Applicant
- Benzel et al., “Identification of Subjects and Objects in a Trusted Extensible Client Server Architecture,” 18th National Information Systems Security Conference, Oct. 10-13, 1995, Baltimore, Maryland, pp. 83-99.Applicant
- Epstein et al., “Component Architectures for Trusted Netware,” 18th National Information Systems Security Conference, Oct. 10-13, 1995, Baltimore, Maryland, pp. 455-463.Applicant
- Varadharajan, Vijay, “Design and Management of a Secure Networked Administration System: A Practical Approach,” 19th National Information Systems Security Conference, Oct. 22-25, 1996, Baltimore, Maryland, pp. 570-580.Applicant
- Snapp et al., “DIDS (Distributed Intrusion Detection System)—Motivation, Architecture, and An Early Prototype,” 14th National Computer Security Conference, Oct. 1-4, 1991, Washington, DC, pp. 167-176.Applicant
- Broner et al., “IntelligentI/O Rule-Based Input/Output Processing for Operating Systems,” Operating Systems Review, vol. 25, No. 3, Jul. 1991, pp. 10-26.Applicant
- Drews et al., “Special Delivery—Automatic Software Distribution Can Make You A Hero,” Network Computing, Aug. 1, 1994, pp. 80, 82-86, 89, 91-95.Applicant
- Morrissey, Peter, “Walls,” Network Computing, Feb. 15, 1996, pp. 55-59, 65-67.Applicant
- Harlander, Dr. Magnus, “Central System Administration in a Heterogenous Unix Environment: GeNUAdmin,” Proceedings of the Eighth Systems Administration Conference (LISA VIII), Sep. 19-23, 1994, San Diego, California, pp. 1-8.Applicant
- Shaddock et al., “How to Upgrade 1500 Workstations on Saturday, and Still Have Time to Mow the Yard on Sunday,” The Ninth Systems Administration Conference LISA '95, Sep. 17-22, 1995, Monterrey, California, pp. 59-65.Applicant
- Anderson, Paul, “Towards a High-Level Machine Configuration System,” Proceedings of the Eighth Systems Administration Conference (LISA VIII), Sep. 19-23, 1994, San Diego, California, pp. 19-26.Applicant
- Cooper, Michael A., “Overhauling Rdist for the '90s,” Proceedings of the Sixth Systems Administration Conference (LISA VI), Oct. 19-23, 1992, Long Beach, California, pp. 175-188.Applicant
- Vangala et al., “Software Distribution and Management in a Networked Environment,” Proceedings of the Sixth Systems Administration Conference, Oct. 19-23, 1992, Long Beach, California, pp. 163-170.Applicant
- Kim et al., “The Design and Implementation of Tripwire: A File System Integrity Checker,” 2nd ACM Conference on Computer and Communications Security, Nov. 2-4, 1994, Fairfax, Virginia, pp. 18-29.Applicant
- Winn Schwartau, “e.Security™-Solving ‘Dumb Days’ With Security Visualization,” e-Security, Inc., Naples, FL 34103, 2000.Applicant
- Anita D'Amico, Ph.D., “Assessment of Open e-Security Platform™: Vendor-Independent Central Management of Computer Security Resources,” Applied Visions, Inc., 1999.Applicant
- “e.Security™-Open Enterprise Security Management: Delivering an integrated, automated, centrally Managed Solution You Can Leverage Today and Tomorrow,” e-Security, Inc., Naples, FL 34102, 1999.Applicant
- “e.Security™-Vision,” e-Security, Inc., Naples, FL, 1999.Applicant
- “e.Security™-Administrator Workbench™,” e-Security, Inc. Naples, FL, 1999.Applicant
- “e.Security™-Fact Sheet,” e-Security, Inc., Naples, FL, 1999.Applicant
- “e.Security™-Open e-Security Platform™,” e-Security, Inc. Naples, FL, 1999.Applicant
- Babcock, “E-Security Tackles The Enterprise,” Jul. 28, 1999; Inter@ctive Week, www.Zdnet.com.Applicant
- Kay Blough, “In Search of More-Secure Extranets,” Nov. 1, 1999, www.InformationWeek.com.Applicant
- Paul H. Desmond, “Making Sense of Your Security Tools,” Software Magazine and Wiesner Publishing, www.softwaremag.com, 1999.Applicant
- Kay Blough, “Extra Steps Can Protect Extranets,” Nov. 1, 1999, www.InformationWeek.com.Applicant
- Sean Hao, “Software protects e-commerce—e-Security's product alerts networks when hackers attack,” Florida Today, Florida.Applicant
- Scott Weiss, “Security Strategies—E-Security, Inc.,” product brief, Hurwitz Group, Inc., Mar. 24, 2000.Applicant
- Sean Adee, CISA, “Managed Risk, Enhanced Response—The Positive Impact of Real-Time Security Awareness,” Information Systems Control Journal, vol. 2, 2000.Applicant
- “Reprint Review—The Information Security Portal—Open e-Security Platform Version 1.0”, Feb. 2000, West Coast Publishing, SC Magazine, 1999.Applicant
- “e.Security—Introducing the First Integrated, Automated, and Centralized Enterprise Security Management System,” white paper, e-Security, Inc., Naples, FL 34102, 1999.Applicant
- Ann Harrison, “Computerworld—Integrated Security Helps Zap Bugs,” Feb. 21, 2000, Computerworld, vol. 34, No. 8, Framingham, MA.Applicant
- Shruti Daté, “Justice Department Will Centrally Monitor Its Systems For Intrusions,” Apr. 3, 2000, Post-Newsweek Business Information, Inc., www.gcn.com.Applicant
- e.Security™, website pages (pp. 1-83), www.esecurityinc.com, e-Security, Inc., Naples, FL 34103, Sep. 14, 2000.Applicant
- Peter Sommer, “Intrusion Detection Systems as Evidence,” Computer Security Research Centre, United Kingdom.Applicant
- Musman et al., System or Security Managers Adaptive Response Tool, DARPA Information Survivability Conference and Exposition, Jan. 25, 2000, pp. 56-68.Applicant
- Gibson Research Corporation Web Pages, Shields Up!—Internet Connection Security Analysis, grc.com/default.htm, Laguna Hills, California, 2000.Applicant
- Rouse et al., Design and Evaluation of an Onboard Computer-Based Information System fro Aircraft, IEEE Transactions of Systems, Man, and Cybernetics, vol. SMC-12, No. 4, Jul./Aug. 1982, pp. 451-463.Applicant
- Hammer, An Intelligent Flight-Management Aid for Procedure Execution, IEEE Transactions on Systems, Man, and Cybernetics, vol. SMC-14, No. 6, Nov./Dec. 1984, pp. 885-888.Applicant
- Mann et al., Analysis of User Procedural Compliance in Controlling a Simulated Process, IEEE Transactions on Systems, Man, and Cybernetics, vol. SMC-16, No. 4, Jul./Aug. 1986.Applicant
- Todd, Signed and Delivered: An Introduction to Security and Authentication, Find Out How the Jave Security API Can Help you Secure your Code, Javaworld, Web Publishing, Inc., San Francisco, Dec. 1, 1998, pp. 1-5.Applicant
- Arvind, Secure This. Inform, Association for Information and Image Management, Silver Spring, Sep./Oct. 1999, pp. 1-4.Applicant
- Stevens, TCP/IP Illustrated, vol. 1, 1994, pp. 247.Applicant
- Lee et al., A Generic Virus Detection Agent on the Internet, IEEE, 30th Annual Hawaii International Conference on System Sciences, 1997, vol. 4.Applicant
- Cutler, Inside Windows NT, 1993, Microsoft Press.Applicant
- Duncan, Advanced MS-Dos, 1986, Microsoft Press.Applicant
- McDaniel, IBM Dictionary of Computing, 1994, International Business Machines Corporation.Applicant
- Burd, Systems Architecture, 1998, Course Technology, Second Edition.Applicant
- Programmer's Guide PowerJ, 1997, Sybase.Applicant
- Swimmer et al., Dynamic detection and classification of computer viruses using general behavior patterns, 1995, Proceedings of the Fifth International Virus Bulletin Conference, Boston.Applicant
- Advanced Virus Detection Technology for the Next Millennium, Aug. 1999, Network Associates, A Network Associates Executive White Paper, pp. 1-14.Applicant
- Enterprise-Grade Anti-Virus Automation in the 21st Century, Jun. 2000, Symantec, Technology Brief, pp. 1-17.Applicant
- Kephart et al., Blueprint for a Computer Immune System, 1997, Retrieved from Internet, URL: http//www.research.ibm.com/antivirus/scipapers/kephart/VB97, pp. 1-15.Applicant
- Richardson, Enterprise Antivirus Software, Feb. 2000, Retrieved from Internet, URL: http://www.networkmagazine.com/article/nmg20000426S0006, pp. 1-6.Applicant
- Understanding and Managing Polymorphic Viruses, 1996, Symantec, The Symantec Enterprise Papers, vol. XXX, pp. 1-13.Applicant
- Gong, JavaTM Security Architecture (JDK1.2), Oct. 2, 1998, Sun Microsystems, Inc., Version 1.0, pp. i-iv, 1-62.Applicant
- Softworks Limited VBVM Whitepaper, Nov. 3, 1998, Retrieved from the Internet, URL: htpp//web.archive.org/web/19981203105455/http://softworksltd.com/vbvm.html, pp. 1-4.Applicant
- Kephart, A Biologically Inspired Immune System for Computers, 1994, Artificial Life IV, pp. 130-139.Applicant
- International Search Report for PCT/US01/26804 of Mar. 21, 2002.Applicant
- Kosoresow et al., Intrusion Detection via System Call Traces, IEEE Software, pp. 35-42, Sep./Oct. 1997.Applicant
- Veldman, Heuristic Anti-Virus Technology, Proceedings, 3rd International Virus Bulletin Conference, pp. 67-76, Sep. 1993.Applicant
- Symantec, Understanding Heuristics: Symantec's Bloodhound Technology, Symantec White Paper Series, vol. XXXIV, pp. 1-14, Sep. 1997.Applicant
- Nachenberg, A New Technique for Detecting Polymorphic Computer Viruses, A thesis submitted in partial satisfaction of the requirements for the degree Master of Science in Computer Science, University of California Los Angeles, pp. 1-127, 1995.Applicant
- Microsoft P-Code Technology, http://msdn.microsoft.com/archive/default.asp?url=/archive/enus/dnarvc/html/msdn—c7pcode2.asp, pp. 1-6, Apr. 1992.Applicant
- DJGPP Coff Spec, http://delorie.com/digpp/doc/coff/, pp. 1-15, Oct. 1996.Applicant
- Natvig, Sandbox Technology Inside AV Scanners, Virus Bulletin Conference, Sep. 2001, pp. 475-488.Applicant
- Norman introduces a new technique for eliminating new computer viruses, found on Norman's website, file://c:/documents%20and%20settings\7489\local%20settings\temporary%20internet%20files\olk, pp. 1-2, published Oct. 25, 2001, printed from website Dec. 27, 2002.Applicant
- International Search Report for PCT/US01/19142 of Jan. 17, 2003.Applicant
- Using the CamNet BBS FAQ, http://www.cam.net.uk/manuals/bbsfaq/bbsfaq.htm, Jan. 17, 1997.Applicant
- Express Storehouse Ordering System, “Accessing ESOS through the Network”, http://www-bfs.ucsd.edu/mss/esos/man3.htm, Sep. 3, 1996.Applicant
- NASIRE, NASIRC Bulletin #94-10, http://cs-www.ncsI.nist.gov/secalert/nasa/nasa9410.txt, Mar. 29, 1994.Applicant
- Packages in the net directory, http://linux4u.jinr.ru/usoft/WWW/www—debian.org/FTP/net.html, Mar. 20, 1997.Applicant
- Sundaram, An Introduction to Intrusion Detection, Copyright 1996, published at www.acm.org/crossroads/xrds2-4/intrus.html, pp. 1-12.Applicant
- Samfat, IDAMN: An Intrusion Detection Architecture for Mobile Networks, IEEE Journal on Selected Areas in Communications, vol. 15, No. 7, Sep. 1997, pp. 1373-1380.Applicant
- Info: Visual Basic Supports P-Code and Native Code Compilation (Q229415), http://support.micorsoft.com/support/kb/articles/Q229/4/15.ASP, pp. 1-2, Apr. 28, 1999.Applicant
- International Search Report for PCT/US99/29117 of May 2, 2000.Applicant
- Nordin, U of MN OIT Security and Assurance, Feb. 9, 2000.Applicant
- Internet Security Systems, RealSecure SiteProtector, SAFEsuite Decisions to SiteProtector Migration, Aug. 8, 2003, pp. 1-42.Applicant
- Internet Security Systems, SAFEsuite Enterprise, SAFEsuite Decisions, 1998.Applicant
- Internet Security Systems, SAFEsuite Enterprise, Recognizing the Need for Enterprise Security: An Introduction to SAFEsuite Decisions, Aug. 1998, pp. 1-9.Applicant
- Internet Security Systems, SAFEsuite Decisions 2.6, Frequently Asked Questions, Feb. 21, 2001, pp. 1-10.Applicant
- Internet Security Systems, SAFEsuite Decisions Version 1.0, User's Guide, 1998, pp. 1-78.Applicant
- Porras et al., Emerald: Event Monitoring Enabling Responses to Anomalous Live Disturbances, Computer Science Laboratory, SRI International, Menlo Park, CA, Oct. 1997, pp. 353-365.Applicant
- Cisco Systems, Empowering the Internet Generation, 1998.Applicant
- Messmer, Start-Up Puts Hackers on BlackICE, Network World Fusion, http://www.nwfusion.com/cgi-bin/mailto/x/cgi, Apr. 21, 1999, p. 1-2.Applicant
- NeworkICE Corporation, Can You Explain How Your Product Can Protect a Remote User with a VPN Client?, 1998-1999, pp. 1-2, http://wwvv.webarchive.org/web/20000304071415/advice.networkice.com/advice/support/kb/q000003/default.Applicant
- Yasin, Start-Up Puts Network Intruders on Ice, pp. 1-2 http://www.internetweek.com/story/INWI9990505S0001, May 5, 1999, pp. 1-2.Applicant
- Morency, NetworkWorldFusion, http://nwfusion.com/cgi-bin/mailto/x.cgi, Jun. 28, 1999, pp. 1-2.Applicant
- Rogers, Network ICE Touts Security Wares, Apr. 23, 1999, San Mateo, California, http://www.crn.com/showArticle.jhtml?articleID=18829106&flatPage=true, pp. 1-2.Applicant
- Rogers, Network ICE Signs Resellers, May 26, 1999, San Mateo, California, http://www.crn.com/showArticle.jhtml?articlelD=18805302&flatPage=true, pp. 1-2.Applicant
- Internet Security Systems, I've Been Attacked! Now What?, Aug. 27, 1999, http://www.iss.net/security—center/advice/Support/KB/q000033/default.htm, pp. 1-2.Applicant
- Internet Security Systems, What is the Format of “Attack-List.CSV”?, Aug. 21, 1999, http://www.iss.net/security—center/advice/Support/KB/q000018/default.htm, pp. 1-2.Applicant
- Neumann et al., Experience with Emerald to Date, Apr. 11-12, 1999, 1st USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, California, pp. 1-9.Applicant
- Lindqvist et al., Detecting Computer and Network Misuse Through the Production-Based Expert System Toolset (P-BEST), May 9-12, 1999, Proceedings of the 1999 IEEE Symposium on Security and Privacy, Oakland, California, pp. 1-16.Applicant
- Kendall, A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems, Jun. 1999, Department of Defense Advanced Research Projects Agency, pp. 1-124.Applicant
- Neumann, Computer Security and the U.S. Infrastructure, Nov. 6, 1997, Congressional Testimony, pp. 1-11.Applicant
- Porras et al., Life Traffic Analysis of TCP/IP Gateways, Nov. 10, 1997, Internet Society's Networks and Distributed Systems Security Systems Symposium, Mar. 1998, http://www.sdl.sri.com/projects/emerald/live-traffic.html, pp. 1-16.Applicant
- Raynaud et al., Integrated Network Management IV, 1995, Proceedings of the 4th International Symposium on Integrated Network Management, pp. 1-2 and 5-16.Applicant
- Heberlein et al., A Method to Detect Intrusive Activity in a Networked Environment, Oct. 1-4, 1991, 14th National Computer Security Conference, Washington, D.C., pp. 362-363 and 365-371.Applicant
- Ko et al., Execution Monitoring of Security-Critical Programs in Distributed Systems: A Specification-Based Approach, 1997, Proceedings of the 1997 IEEE Symposium on Security and Privacy, pp. 175-187.Applicant
- Crosbie et al., Active Defense of a Computer System Using Autonomous Agents, Technical Report No. 95-008, Feb. 15, 1995, Purdue University, West Lafayette, Indiana, pp. 1-14.Applicant
- Mansouri-Samani et al., Monitoring Distributed Systems, Nov. 1993, IEEE Network, pp. 20-30.Applicant
- Jakobson et al., Alarm Correlation, Nov. 1993, IEEE Network, pp. 52-59.Applicant
- Anderson et al., Next-Generation Intrusion Detection Expert (NIDES), A Summary, May 1995, SRI International, pp. 1-37.Applicant
- Veritas Software, Press Release, Robust Enhancements in Version 6.0 Maintain Seagate WI as the De Facto Standard for Software Distribution, Oct. 6, 1997, Press Releases, pp. 1-4, http://216.239.39.104/search?q=cache:HS9kmK1m2QoJ:www.veritas.com/us/aboutus/pressroom/199 . . . .Applicant
- Yasin, Network-Based IDS are About to Stop Crying Wolf, Security Mandate: Silence False Alarms, Apr. 9, 1999, http://lists.jammed.com/ISN/1999/04/002l.html, pp. 1-3.Applicant
- Internet Security Systems, Press Release, ISS Reports Record Revenues and Net Income for Second Quarter, Jul. 19, 1999, http://bvlive01.iss.net/issEn/delivery/prdetail.jsp?type=Financial&oid=14515, pp. 1-5.Applicant
- LaPadula, State of the Art in CyberSecurity Monitoring, A Supplement, Sep. 2001, Mitre Corporation, pp. 1-15.Applicant
- Balasubramaniyan et al., An Architecture for Intrusion Detection Using Autonomous Agents, Jun. 11, 1998, Purdue University, West Lafayette, Indiana, pp. 1-4, http://gunther.smeal.psu.edu/images/b9/f3/bb/9e/ba7f39c3871dcedeb9abd0f70cb84607/1.png.Applicant
- Crosbie et al., Active Defense of a Computer System Using Autonomous Agents, Feb. 15, 1995, Technical Report No. 95-008, Purdue University, West Lafayette, Indiana, pp. 1-14.Applicant
- Crosbie et al., Defending a Computer System Using Autonomous Agents, Mar. 11, 1994, Technical Report No. 95-022, Purdue University, West Lafayette, Indiana, pp. 1-11.Applicant
- Denning, An Intrusion-Detection Model, Feb. 1987, IEEE Transactions on Software Engineering, vol. SE-13, No. 2, pp. 1-17.Applicant
- Lunt, A Survey of Intrusion Detection Techniques, 1993, Computers & Security, 12 (1993), pp. 405-418.Applicant
- Porras et al., Penetration State Transition Analysis A Rule-Based Intrusion Detection Approach, 1992, pp. 220-229.Applicant
- Javitz et al., The NIDES Statistical Component: Description and Justification, SRI International, Menlo Park, California, SRI Project 3131, Mar. 7, 1994.Applicant
- Lindqvist et al., Detecting Computer and Network Misuses Through the Production-Based Expert System Toolset (P-BEST), Oct. 25, 1998, pp. 1-20.Applicant
- Javitz et al., The SRI IDES Statistical Anomaly Detector, SRI Interntiona, Menlo Park, California, May 1991, IEEE Symposium on Security and Privacy, pp. 1-11.Applicant
- Porras et al., Live Traffic Analysis of TCP/IP Gateways, Nov. 10, 1997, SRI International, Menlo Park, California, pp. 1-16.Applicant
- Porras et al., Live Traffic Analysis of TCP/IP Gateways, Dec. 12, 1997, SRI International, Menlo Park, California, Proceedings of the 1998 ISOC Symposium on Network and Distributed Systems Security, pp. 1-13.Applicant
- Information & Computing Sciences: System Design Laboratory: Programs: Intrusion Detection, SRI International, http://www.sdl.sri.com/programs/intrusion/, Jun. 17, 2004, pp. 1-2.Applicant
- Lindqvist et al., eXpert-BSM: A Host-based Intrusion Detection Solution for Sun Solaris, SRI International, Menlo Park, California, Dec. 10-14, 2001, Proceedings of the 17th Annual Computer Security Applications Conference, pp. 1-12.Applicant
- Almgren et al., Application-Integrated Data Collection for Security Monitoring, Oct. 10-12, 2001, SRI International, Menlo Park, California, pp. 1-15.Applicant
- Debar et al., Research Report: A Revised Taxonomy for Intrusion-Detection Systems, Oct. 25, 1999, IBM Research, Switzerland, pp. 1-23.Applicant
- Porras et al., Emerald: Event Monitoring Enabling Responses to Anomalous Live Disturbances, Computer Science Laboratory, SRI International, Menlo Park, CA, Dec. 18, 1996, pp. 1-3.Applicant
- Frequently-Asked Questions about RealSecure, pp. 1-14, http://web.archive.org/web/19970721183227/iss.net/prod/rs—faq.html, May 30, 1997.Applicant
- Cisco Systems, Inc., Empowering the Internet Generation, 1998.Applicant
- Internet Security Systems, Inc., RealSecure Release 1.2 for UNIX, A User Guide and Reference Manual, 1997.Applicant
- Internet Security Systems, Inc., Real-time attack recognition and response: A solution for tightening network security, Jan. 1997, pp. 1-13.Applicant
- Internet Security Systems, Inc., SAFEsuite Decisions User Guide, Version 1.0, 1998, pp. 1-78.Applicant
- NetworkICE Corporation, ICEcap Administrator's Guide, Version 1.0 Beta, 1999, pp. 1-142.Applicant
- Debar, Herve et al., A Neural Network Component for an Intrusion Detection System, 1992, pp. 240-250.Applicant
- SRI International, A Prototype IDES: A Real-Time Intrusion-Detection Expert System, Aug. 1987, p. 1-63.Applicant
- SRI International, Requirements and Model for IDES-A Real-Time Intrusion-Detection Expert System, Aug. 1985, pp. 1-70.Applicant
- SRI International, An Intrusion-Detection Model, Nov. 1985, pp. 1-29.Applicant
- Dowell et al., The ComputerWatch Data Reduction Tool, Proc. of the 1313 National Computer Security Conference, Washington, D.C., Oct. 1990, pp. 99-108.Applicant
- Fox et al., A Neural Network Approach Towards Intrusion Detection, Jul. 2, 1990, pp. 125-134.Applicant
- Garvey et al., Model-Based Intrusion Detection, Oct. 1991, pp. 1-14.Applicant
- Ilgun et al., State Transition Analysis: A Rule-Based Intrusion Detection Approach, Mar. 1995, pp. 181-199.Applicant
- Javitz et al., The SRI IDES Statistical Anomaly Detector, May 1991, pp. 1-11.Applicant
- SRI International, The NIDES Statistical Component Description and Justification, Mar. 7, 1994, pp. 1-46.Applicant
- Karen, Oliver, PC Magazine, The Digital Doorman, Nov. 16, 1999, p. 68.Applicant
- Liepins et al., Anomaly Detection: Purpose and Frameowrk, 1989, pp. 495-504.Applicant
- Lindqvist et al., Detecting Computer and Network Misuse Through the Production-Bases Expert System Toolset (P-BEST), Oct. 25, 1998, pp. 1-20.Applicant
- Lunt, Teresa, A survey of intrusion detection techniques, 1993, pp. 405-418.Applicant
- Lunt, Teresa, Automated Audit Trail Analysis and Intrusion Detection: A Survey, Oct. 1988, pp. 1-8.Applicant
- Porras et al., Penetration State Transition Analysis A Rule-Based Intrusion Detection Approach, 1992, pp. 220-229.Applicant
- Sebring et al., Expert Systems in Intrusion Detection: A Case Study, Oct. 1988, pp. 74-81.Applicant
- Shieh et al., A Pattern-Oriented Intrusion-Detection Model and Its Applications, 1991, pp. 327-342.Applicant
- Smaha, Stephen, Haystack: An Intrusion Detection System, 1988.Applicant
- Snapp, Steven Ray, Signature Analysis and Communication Issues in a Distributed Intrusion Detection System, 1991, pp. 1-40.Applicant
- Porras et al., EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances, Oct. 1997, pp. 353-365.Applicant
- Lunt et al., Knowledge-Based Intrusion Detection, Mar. 1989, pp. 102-107.Applicant
- Lunt et al., An Expert System to Classify and Sanitize Text, Dec. 1987, pp. 1-5.Applicant
- Tener, William, Computer Security in the Age of Information, AI & 4GL: Automated Detection and Investigation Tools, 1989, pp. 23-29.Applicant
- Teng et al., Adaptive Real-time Anomaly Detection Using Inductively Generated Sequential Patterns, 1990, pp. 278-284.Applicant
- Vaccaro et al., Detection of Anomalous Computer Session Activity, 1989, pp. 280-289.Applicant
- Winkler, J.R., A UNIX Prototype for Intrusion and Anomaly Detection in Secure Networks, 1990, pp. 115-124.Applicant
- Boyen et al. Tractable Inference for Complex Stochastic Process, Jul. 24-26, 1998.Applicant
- Copeland, Observing Network Traffic—Techniques to Sort Out the Good, the Bad, and the Ugly, 2000, pp. 1-7.Applicant
- Goan, Terrance, Communications of the ACM, A Cop on the Beat Collecting and Appraising Intrusion Evidence, Jul. 1999, pp. 47-52.Applicant
- Heberlein et al., A network Security Monitor, 1990, pp. 296-304.Applicant
- Jackson et al., An Expert System Applications for Network Intrusion Detection, Oct. 1991, pp. 1-8.Applicant
- Lankewicz et al., Real-Time Anomaly Detection Using a Nonparametric Pattern Recognition Approach, 1991, pp. 80-89.Applicant
- Lippmann et al., Evaluating Intrusion Detection Systems: The 1998 DARPA Off-line Intrusion Detection Evaluation, 1999.Applicant
- Munson et al., Watcher: The Missing Piece of the Security Puzzle, Dec. 2001.Applicant
- Pearl, Judea, Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference, Sep. 1988.Applicant
- Porras et al., Live Traffic Analysis of TCP/IP Gateways, Dec. 12, 1997, pp. 1-13.Applicant
- EMERALD TCP Statitical Analyzer 1998 Evaluation Results, http://www.sdl.sri.com/projects/emerald/98-eval-estat/index.html, Jul. 9, 1999, pp. 1-15.Applicant
- Staniford-Chen, GrIDS—A Graph Based Intrusion Detection System for Large Networks, Oct. 1996.Applicant
- Tener, William, Discovery: An Expert System in the Commercial Data Security Environment, Dec. 1986, pp. 45-53.Applicant
- Valdes et al., Adaptive, Model-Based Monitoring for Cyber Attack Detection, 2000, pp. 1-19.Applicant
- SRI International, Blue Sensors, Sensor Correlation, and Alert Fusion, Oct. 4, 2000.Applicant
- Valdes et al., Statistical Methods for Computer Usage Anomaly Detection Using NIDES, Jan. 27, 1995, pp. 306-311.Applicant
- Wimer, Scott, The Core of CylantSecure, http://www.cylant.com/products/core.html, 1999, pp. 1-4.Applicant
- Zhang et al., A Hierarchical Anomaly Network Intrusion Detection System using Neural Network Classification, Feb. 2001.Applicant
- Cisco Secure Intrusion Detection System 2.1.1 Release Notes, http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids3/nr211new.htm, Jun.10, 2003, pp. 1-29.Applicant
- Linux Weekly News, http://lwn.net/1998/0910shadow.html, Sep. 8, 1998, pp. 1-38.Applicant
- Cracker Tracking: Tighter Security with Intrucsion Detection, http://www.bvte.com/art/9805/sec20/artl.htm, May 1998, pp. 1-8.Applicant
- Cisco Systems, Inc., Newtork RS: Intrusion Detection and Scanning with Active Audit Session 1305, 1998.Applicant
- Business Security Advisor Magazine, Intrusion Detection Systems: What You Need to Know, http://advisor.com/doc/0527, Sep. 1998, pp. 1-7.Applicant
- Garvey et al., An Inference Technique for Integrating Knowledge from Disparate Sources, Multisensor Integration and Fusion for Intelligenct Machines and Systems, 1995, pp. 458-464.Applicant
- Power et al., CSI Intrusion Detection System Resource, Jul. 1998, pp. 1-7.Applicant
- Cisco Systems, Inc., NetRanger User's Guide Version 2.1.1, 1998.Applicant
- Internet Security Systems, Real-Time Attack Recognition and Response: A Solution for Tightening Network Security, http://www.iss.net, 1997, pp. 1-13.Applicant
- Network ICE Corporation, Network ICE Product Documentation, pp. 1-3, http://www.web.archive.org/web/20011005080013/www.networkice.com/support/documentation.html, Jul. 6, 2004.Applicant
- Network ICE Corporation, Network ICE Documentation, p. 1, http://www.web.archive.org/web/19991109050852/www.networkice.com/support/docs.htm, Jul. 6, 2004.Applicant
- Network ICE Corporation, Network ICE Press Releases, p. 1, http://www.web.archive.org/web/19990903214428/www.netice.com/company/pressrelease/press.htm, Jul. 7, 2004.Applicant
- Network ICE Corporation, Network ICE Press Releases, p. 1, httri://www.web.archive.org/web/20000304074934/www.netice.com/company/pressrelease/press.htm, Jul. 7, 2004.Applicant
- Brentano et al., An Architecture for Distributed Intrusion Detection System, Department of Energy Computer Security Group, 14th Annual Conference Proceedings, pp. (17)25-17(45), May 1991.Applicant
- Staniford-Chen et al., GrIDS-A Graph Based Intrusion Detection System for Large Networks, University of California, Davis, California, 19th National Information Systems Security Conference, 1996, pp. 1-10.Applicant
- Ricciulli et al., Modeling Correlated Alarms in Network Management Systems, SRI International, Menlo Park, California,, Proceedings of the Conference on Communication Networks and Distributed System Modeling and Simulation, 1997, pp. 1-8.Applicant
- Porras et al., Emerald: Event Monitoring Enabling Responses to Anomalous Live Disturbances, SRI International, Menlo Park, California, 20th National Information Systems Security Conference, Oct. 1997, pp. 1-24.Applicant
- Porras et al., A Mission-Impact Based Approach to INFOSEC Alarm Correlation, SRI International, Menlo Park, California, Oct. 2002, pp. 1-33.Applicant
- Phrack 55 Download (234 kb, Sep. 9, 2009), http://www.phrack.org/show.php?p=55&a=9, pp. 1-6.Applicant
- Porras et al., A Mission-Impact-Based Approach to INFOSEC Alarm Correlation, SRI International, Menlo Park, California, Oct. 2002, pp. 1-19.Applicant
- Bace, An Introduction to Intrusion Detection and Assessment for System and Network Security Management, 1999, pp. 1-38.Applicant
- Hunteman, Automated Information System—(AIS) Alarm System, University of California, Los Alamos National Laboratory, 20th National Information System Security Conference, Oct. 1997, pp. 1-12.Applicant
- Janakiraman et al., Indra: A Peer-to-Peer Approach to Network Intrusion Detection and Prevention, Proceedings of the 12th International Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, 2003, pp. 1-5.Applicant
- Innella, Intrusion Detection Systems (IDS), Navy Information Assurance, Jun. 28, 2004, pp. 1-4, http://www.infosec.navy.mil/ps/?t =infosecprodsservices/infosecprodsservices.tag&bc=/infosecprodsservices/b..Applicant
- Curry, Intrusion Detection Systems, IBM Emergency Response Service, Coast Laboratory, http://www.cerias.purdue.edu/about/history/coast—resources/idcontent/ids.html, Jul. 19, 2004, pp. 1-28.Applicant
- Lunt et al., Knowledge-Based Intrusion Detection, SRI International, Menlo Park, California, Conference on AI Systems in Government, Washington, D.C., Mar. 1989, pp. 102-107.Applicant
- A. Information Assurance BAA 98-34 Cover Sheet, SRI International, Nov. 1, 2000, pp. 2-35.Applicant
- NetScreen Products, FAQ, http://www.netscreen.com/products/faq.html, Feb. 28, 2003, pp. 1-6.Applicant
- Miller, A Network Under Attack: Leverage Your Existing Instrumentation to Recognize and Respond to Hacker Attacks, NetScout Systems, Westford, MA, Apr. 2003, pp. 1-8.Applicant
- Technology Brief: Intrusion Detection for the Millennium, Internet Security Systems, 2000, pp. 1-6.Applicant
- Weiss et al., Analysis of Audit and Protocol Data using Methods from Artificial Intelligence, Siemens AG, Munich, Germany, Proc. of the 13th National Computer Security Conference, Washington, D.C., Oct. 1990, pp. 109-114.Applicant
- Snapp et al., DIDS (Distributed Intrusion Detection System)—Motivation, Architecture, and an Early Protype), University of California,, Davis California Proc. 14th National Computer Security Conference, Washington, D.C., Oct. 1991, pp. 167-176.Applicant
- Internet Security Systems, Inc., SAFEsuite Enterprise Edition, Project “Gatekeeper” 1.0, Market Requirements Document, Mar. 30, 1998, pp. 1-12.Applicant
- Internet Security Systems, SAFEsuite Decisions, 2000, pp. 1-2.Applicant
- Internet Security Systems, Dynamic Threat Protection, Presse-Roundtable, Munich, Germany, Apr. 10, 2003, pp. 1-63.Applicant
- Internet Security Systems, Preliminary ODM 1.0 Functional Specification, Aug. 1997, pp. 1-7.Applicant
- Internet Security Systems, Inc., Scanner-ISSDK Interface, Design Specification, Jun. 2, 2000, Draft 1.07, pp. 1-7.Applicant
- RealSecure, Adaptive Network Security Manager Module Programmer's Reference Manual, pp. 1-74.Applicant
- Advanced Concept Technology Demonstrations (ACTD), 2005, pp. 1-28.Applicant
- Frank, Sounding the Alarm, Sep. 6, 1999, Federal Computer Week, pp. 1-2.Applicant
- Crumb, Intrusion Detection Systems to be Integrated at AFRL, Air Force Research Laboratory, News@AFRL, Fall 1999, pp. 1.Applicant
- Temin, Case Study: The IA: AIDE System at Two, 15th Annual Computer Security Applications Conference, Dec. 6-10, 1999, Phoenix, Arizona, pp. 1-26.Applicant
- Spink, Automated Intrusion Detection Environment (AIDE), Intrusion Detection Sensor Fusion, Sep. 7, 1999, pp. 1-25.Applicant
- Frincke et al., A Framework for Cooperative Intrusion Detection, 21st National Information Systems Security Conference, Oct. 6-9, 1998, Crystal City, Virginia, pp. 1-20.Applicant
- Anderson et al., In Athena's Camp: Preparing for Conflict in the Information Age, An Exploration of Cyberspace Security R&D Investment Strategies for DARPA: The Day After-in Cyberspace II, Chaper Eleven, 1996, pp. 253-271.Applicant
- Valdes et al., SRI International, Probabilistic Alert Correlation, 2001, pp. 1-15.Applicant
- Bass, Multisensor Data Fusion for Next Generation Distributed Intrusion Detection Systems, Apr. 28, 1999, Iris National Symposium, pp. 1-6.Applicant
- Perrochon et al., Enlisting Event Patterns for Cyber Battlefield Awareness, No Date, Stanford University, pp. 1-12.Applicant
- Perrochon, Using Context-Based Correlation in Network Operations and Management, Jul. 2, 1999, Stanford University, pp. 1-20.Applicant
- Perrochon, Real Time Event Based Analysis of Complex Systems, Jun. 1998, pp. 1-9.Applicant
- Luckham et al., Complex Event Processing in Distributed Systems, Aug. 18, 1988, Stanford University, pp. 1-26.Applicant
- Pettigrew, US Southcom United States Southern Command's Information Sharing Projects, Summer 1999, IAnewsletter, vol. 3, No. 1, pp. 1-24.Applicant
- Levitt et al., CMAD IV, Computer Misuse & Anomaly Detection, Session Summaries, Nov. 12-14, 1996, Proceedings of the Fourth Workshop on Future Directions in Computer Misuse and Anomaly Detection, Monterey, California, pp. 1-86.Applicant
- Cheung et al., The Design of GrIDS: A Graph-Based Intrusion Detection System, Jan. 26, 1999, University of California, pp. 1-51.Applicant
- Cohen et al., Report of the Reporting and Analysis Track, Detection of Malicious Code, Intrusions, and Anomalous Activities Workshop, Feb. 22-23, 1999, pp. 1-47.Applicant
- Garofalakis et al., Network Mining and Analysis: The Nemesis Project, Bell Labs, Lucent Technologies, No Date, pp. 1-12.Applicant
- RealSecure ICEcap Manager User Guide Version 3.6, Internet Security Systems, Inc., 1998-2002, pp. 1-228.Applicant
- Cuppens, Cooperative Intrusion Detection, Date Unknown, pp. 1-10.Applicant
- Mukherjee et al., Network Intrusion Detection, IEEE Network, May/Jun. 1994, pp. 26-41.Applicant
- Machlis, Net Monitoring Tools Gain Real-Time Alerts, Apr. 14, 1997, http://www.computerworld.com, pp. 1-12.Applicant
- OmniGuard/ITA Intruder Alert, AXENT Technologies, Inc., Nov. 17, 2004, http://www.web.archive.org, pp. 1-10.Applicant
- NetRanger Overview, Chapter 1, Date Unknown, pp. 1-16.Applicant
- Sutterfield, Large-Scale Network Intrusion Detection, 1997, WheelGroup Corporation, pp. 1-10.Applicant
- Kumar et al., An Application of Pattern Matching in Intrusion Detection, Technical Report No. CSD-TR-94-013, Jun. 17, 1994, Purdue University, pp. 1-55.Applicant
- Huang et al., A Large-Scale Distributed Intrusion Detection Framework Based on Attack Strategy Analysis, Date Unknown, The Boeing Company, pp. 1-12.Applicant
- Perrochon et al., Event Mining with Event Processing Networks, Date Unknown, Stanford University, pp. 1-4.Applicant
- Gruschke, Integrated Event Management: Event Correlation Using Dependency Graphs, presented at DSOM 1998, University of Munich, pp. 1-12.Applicant
- Bass, Intrusion Detection System and Multisensor Data Fusion, Apr. 2000, Communications of the ACM, vol. 43, No. 4, pp. 99-105.Applicant
- Bass et al., A Glimpse into the Future of ID, Date Unknown, Usenix, pp. 1-10.Applicant
- LaPadula, State of the Art in Anomaly Detection and Reaction, Jul. 1999, Mitre Corporation, pp. 1-36.Applicant
- Rationalizing Security Events with Three Dimensions of Correlation, Date Unknown, NetForensics, Tech Brief, pp. 1-6.Applicant
- Jou et al., Design and Implementation of a Scalable Intrusion Detection System for the Protection of Network Infrastructure, Date Unknown, MCNC, pp. 1-15.Applicant
- Caldwell, Event Correlation: Security's Holy Grail?, Aug. 1, 2002, GuardedNet, pp. 1-21.Applicant
- Metcalf et al., Intrusion Detection System Requirements, Sep. 2000, Mitre Corporation, pp. 1-33.Applicant
- Jou et al., Architecture Design of a Scalable Intrusion Detection System for the Emerging Network Infrastructure, Technical Report CDRL A005, Apr. 1997, MCNC, pp. 1-42.Applicant
- Security Manager for UNIX Systems Version 3.2.1 User's Guide, Feb. 1998, Internet Security Systems, pp. 1-162.Applicant
- RealSecure Release 1.2 for UNIX A User Guide and Reference Manual, 1997, Internet Security Systems, Inc., pp. 1-92.Applicant
- Internet Scanner SAFE SAFEsuite 4.0 User Guide and Reference Manual, 1996, Internet Security Systems, Inc., pp. 1-158.Applicant
- Internet Scanner 3.3 User Guide and Reference Manual, 1996, Internet Security Systems, Inc., pp. 1-119.Applicant
- Landwehr et al., Newsletter of the IEEE Computer Society's TC on Security and Privacy Electronics, Electronic CIPHER, Nov. 25, 1997, Issue 25, pp. 1-34.Applicant
- 20th National Information Systems Security Conference, Oct. 6-10, 1997, Baltimore, Maryland, pp. 1-44.Applicant
- EMERALD Alert Management Interface User's Guide Version 1.2, Dec. 6, 2000, SRI International, pp. 1-11.Applicant
- Anderson et al., Detecting Unusual Program Behavior Using the Statistical Component of the Next-Generation Intrusion Detection Expert System (NIDES), May 1995, SRI International, pp. 1-89.Applicant
- Lunt et al., Detecting Intruders in Computer Systems, 1993 Conference on Auditing and Computer Technology, SRI International, pp. 1-17.Applicant
- Network ICE Products—ICEcap, Date Unknown, pp. 1-2.Applicant
- Forlanda, The Secrets to Driving on BlackICE, Jan. 12, 2000, Network ICE, pp. 1-35.Applicant
- BlackICE User's Guide Version 1.0 Beta Draft, 1999, Network ICE Corporation, pp. 1-59.Applicant
- ICEcap Administrator's Guide Version 1.0 Beta Draft, 1999, Network ICE Corporation, pp. 1-25.Applicant
- Shulak et al., ICEcap Advanced Administration Guide Version 3.0, 2001, Internet Security Systems Corporation, pp. 1-51.Applicant
- “Real Secure, OS Sensor User Guide,” Version 5.0, ©Internet Security Systems, Inc. 199?-2000; Sep. 2000, pp. 1-64.Applicant
- “Real Secure, User's Guide,” Version 3.0, © 1992-1998, Internet Security Systems, Inc., pp. 1-128.Applicant
- “System Security Scanner, User Guide,” Version 1.6, © 1996-1998, Internet Security Systems, Inc., pp. 1-164.Applicant
- “Real Secure™, Network Engine User Guide,” Version 3.2.1, © 1999 by Internet Security Systems, Inc., pp. 1-38.Applicant
- “Real Secure™, User Guide,” Version 3.2.1, © 1999 by Internet Security Systems, Inc., pp. 1-38.Applicant
- “Real Secure™, Manager for HP OpenView User Guide,” Version 1.3, © 1999 by Internet Security Systems, Inc., pp. 1-48.Applicant
- “Database Scanner, User Guide,” Version 2.0, ® 1992-1999, Internet Security Systems, Inc., pp. 1-112.Applicant
- “Database Scanner™, User Guide,” Version 4.0, © 2000 by Internet Security Systems, Inc., pp. 1-122.Applicant
- “Database Scanner™, User Guide,” Version 3.0.1, , © 1999 by Internet Security Systems, Inc., pp. 1-164.Applicant
- “Real Secure™, Network Sensor User Guide,” Version 5.0, © 2000 by Internet Security Systems, Inc., pp. 1-42.Applicant
- “Real Secure, Server Sensor User Guide,” Version 5.5, © Internet Security Systems, Inc. 2000, pp. 1-56.Applicant
- “Internet Scanner™, User Guide,” Version 6.0, Copyright © 1999 by Internet Security Systems, Inc., pp. 1-182.Applicant
- “Internet Scanner™, User Guide,” Version 6.1, © 2000 by Internet Security Systems, Inc., pp. 1-226.Applicant
- “Internet Scanner™, User Guide,” Version 5.6, © 1992-1998, Internet Security Systems, Inc., pp. 1-162.Applicant
- “Internet Scanner™, User Guide,” Version 5.3, © 1992-1998, Internet Security Systems, Inc. pp. 1-173.Applicant
- “Real Secure, Console User Guide,” Version 5.5, © 199?-2000, Internet Security Systems, Inc., pp. 1-162.Applicant
- “Internet Scanner™, User Guide,” Version 5.8, © 1999 by Internet Security Systems, Inc., pp. 1-148.Applicant
- “SAFEsuite Decisions, User Guide,” Version 1.0, © 1992-1998, Internet Security Systems, Inc., pp. 1-88.Applicant
- “Real Secure™, Console User Guide,” Version 5.0, © 2000 by Internet Security Systems, Inc., pgs. 1-114.Applicant
- “SAFEsuite Decisions, User Guide,” Version 2.5, © 2000 by Internet Security Systems, Inc., pp. 1-194.Applicant
- “System Scanner, User Guide,” Version 1.7, © 1992-1998, Internet Security Systems, Inc., pp. 1-248.Applicant
- “Sytem Scanner, User Guide,” Version 1.0, © 1996-1998, Internet Security Systems, Inc., pp. 1-140.Applicant
- “System Scanner™, User Guide,” Version 4.0, © 1999 by Internet Security Systems, Inc., pp. 1-178.Applicant
- Internet Security Systems, Inc., “Introduction to RealSecure Version 5.0, The Industry's Only Integrated Host-Based and Network-Based Intrusion Detection System”, Aug. 22, 2000, pp. 1-47.Applicant
- Internet Security Systems, Inc., “RealSecure Network Sensor and Gigabit Network Sensor Policy Guide Version 7.0”, Aug. 2003, pp. 1-86.Applicant
- Internet Security Systems, Inc., “RealSecure Console User Guide Version 3.1”, Jun. 1999, pp. 1-98.Applicant
- Internet Security Systems, Inc., “RealSecure Version 2.0”, Apr. 1998, pp. 1-154.Applicant
- Internet Security Systems, Inc., “Enhanced Dynamic Threat Protection via Automated Correlation and Analysis”, an ISS White Paper, 2002, pp. 1-14.Applicant
- Internet Security Systems, Inc., “RealSecure Site Protector Comparison Guide for Internet Scanner 7.0 Reporting Version 1.2”, Mar. 2003, an ISS Tech Note, pp. 1-15.Applicant
- Internet Security System, Inc., “RealSecure Site Protector Comparison Guide for ICEcap Manager Version 1.5”, Jan. 2002, an ISS Technical White Paper, pp. 1-27.Applicant
- Internet Security Systems, Inc., “RealSecure SiteProtector Security Fusion Module 2.0 Frequently Asked Questions”, Mar. 2003, pp. 1-8.Applicant
- Internet Security Systems, Inc., “RealSecure SiteProtector Console User Reference Guide Version 2.0 Service Pack 1”, Mar. 14, 2003, Chapter 3, pp. 1-27.Applicant
- Internet Security Systems, Inc., “Proventia Gateway and Network Protection”, Jul. 2003, pp. 1-12.Applicant
- Farley, Internet Security System, Inc., “ID Fusion Technology, A First-Generation Approach”, Apr. 29, 1999, National Security Framework Forum, pp. 1-8.Applicant
- Farley, “RealSecure Fusion Engine Concepts”, an ISS White Paper, Jun. 30, 1999, pp. 1-23.Applicant
- PC User, Jun. 29, 1994, n238, p. 108(16).Applicant
- Walther, 2000, Information Week, n 777, p. 124.Applicant
- Gibson Research Corporation Web Pages, “Shields Up!—Internet Connection Security Analysis”, grc.com/default.htm, Laguna Hills, CA, 2000.Applicant
- “Anti-Virus NLMs (Seven anti-virus NetWare loadable Modules) (Software Review) (PC User NSTL Lab Test)” Jun. 29, 1994, n238, p. 108(a).Applicant