With the growing deployment of host and network intrusion detection systems, managing reports from these systems becomes critically important. We present a probabilistic approach to alert correlation, extending ideas from multisensor data fusion. Features used for alert correlation are based on alert content that anticipates evolving IETF standards. The probabilistic approach provides a unified mathematical framework for correlating alerts that match closely but not perfectly, where the minimum degree of match required to fuse alerts is controlled by a single configurable parameter. Only features in common are considered in the fusion algorithm. For each feature we define an appropriate similarity function. The overall similarity is weighted by a specifiable expectation of similarity. In addition, a minimum similarity may be specified for some or all features. Features in this set must match at least as well as the minimum similarity specification in order to combine alerts, regardless of the goodness of match on the feature set as a whole. Our approach correlates attacks over time, correlates reports from heterogeneous sensors, and correlates multiple attack steps.

/pdf/probabilistic-alert-correlation-510d6g9djt.pdf

Probabilistic Alert Correlation

Network architecture, computer system and/or server, circuit, device, apparatus, method, and computer program and control mechanism for managing power consumption and workload in computer system and data and information servers. Further provides power and energy consumption and workload management and control systems and architectures for high-density and modular multi-server computer systems that maintain performance while conserving energy and method for power management and workload management. Dynamic server power management and optional dynamic workload management for multi-server environments is provided by aspects of the invention. Modular network devices and integrated server system, including modular servers, management units, switches and switching fabrics, modular power supplies and modular fans and a special backplane architecture are provided as well as dynamically reconfigurable multi-purpose modules and servers. Backplane architecture, structure, and method that has no active components and separate power supply lines and protection to provide high reliability in server environment.

System, method, and architecture for dynamic server power management and dynamic workload management for multi-server environment

In embodiments of the present invention improved capabilities are described for a virtualization environment adapted for development and deployment of at least one software workload, the virtualization environment having a metamodel framework that allows the association of a policy to the software workload upon development of the workload that is applied upon deployment of the software workload. This allows a developer to define a security zone and to apply at least one type of security policy with respect to the security zone including the type of security zone policy in the metamodel framework such that the type of security zone policy can be associated with the software workload upon development of the software workload, and if the type of security zone policy is associated with the software workload, automatically applying the security policy to the software workload when the software workload is deployed within the security zone.

System and method for a cloud computing abstraction layer with security zone facilities

System, architecture, and method for logical server and other network devices in a dynamically configurable multi-server network environment

An automated analysis system identifies the presence of malicious P-code or N-code programs in a manner that limits the possibility of the malicious code infecting a target computer. The target computer system initializes an analytical virtual P-code engine (AVPE). As initialized, the AVPE comprises software simulating the functionality of a P-code or intermediate language engine as well as machine language facilities simulating the P-code library routines that allow the execution of N-code programs. The AVPE executes a target program so that the target program does not interact with the target computer. The AVPE analyzes the behavior of the target program to identify occurrence of malicious code behavior and to indicate in a behavior pattern the occurrence of malicious code behavior. The AVPE is terminated at the end of the analysis process, thereby removing from the computer system the copy of the target program that was contained within the AVPE.

Computer immune system and method for detecting unwanted code in a P-code or partially compiled native-code program executing within a virtual machine

A network virtualization layer for an information handling system in which a physical machine coupled to a network is divided into a plurality of logical partitions, each of which has a host system residing thereon. In response to receiving a set command from one of the host systems specifying a data link layer (layer 2) address, the virtualization layer associates the data link layer address with the host system and forwards to the host system data packets specifying the data link layer address as a destination address. Unicast packets are forwarded to the single host system specifying the destination address as an individual MAC address, while multicast packets are forwarded to each host system specifying the destination address as a group MAC address. A host system may also specify a virtual LAN (VLAN) ID, which is used to scope the forwarding of packets to host systems sharing that VLAN ID.

Method and apparatus for providing network virtualization

A multicasting apparatus that broadcasts messages to at least some of the clients in a computing network environment having a plurality of clients and at least one host connected to these clients via a gateway device. A multicast routing table is created for registering any host and clients requesting registration. The table will include one entry per host/client and includes their relevant information. A connectivity platform is used for controlling all communications so that all information packets is first received by the platform. Upon the receipt of a packet, the table is searched and if an match is found the packet will be routed using the entry information; otherwise, the packet will be dropped.

IP multicast interface

An LAN management facility for monitoring and managing errors on the physical links connecting the stations of a LAN. The facility includes, in part, an Enhanced Link Error Monitor (LEM). The Enhanced LEM continuously determines a Link Error Rate (LER) estimate as a function of time based upon the errors seen on the physical links. The enhanced LEM applies a link specific characteristic function to the LER estimate in order to determine an Adjusted LER Estimate. The link specific characteristic function takes into account the particular characteristics of the link experiencing the errors and is used to alter the station's responsiveness to these errors. The Adjusted LER Estimate is compared to alarm and cutoff thresholds in order to determine the appropriate action to take with respect to the link. By altering the link specific characteristic function, the Enhanced LEM will either become more or less responsive to errors on the link, thereby tolerating more or less errors in a greater or lesser period of time. In a preferred embodiment of invention, each station on the LAN maintains a Management Information Base (MIB) which contains the link specific characteristic function. The attributes in the MIB, including the link specific characteristic function, can be altered remotely by a LAN manager through one of the LAN stations acting as a proxy agent.

Management of FDDI physical link errors

An apparatus for dynamically providing a host information about all functions supported by a communication platform provided in a computing network environment is presented. The computing network environment is also provided with a gateway device that is electronically connected at least to one initiating host and at least one receiving host, besides the associated communication platform. The apparatus comprises of a handshaking component for determining address and other information about all hosts to be inputted in a port-sharing table. Means is also provided for checking all host connections at preselected intervals to ensure their connection status availability and all necessary changes are made in the port-sharing table in case any host connection becomes unavailable. A receiving component obtains IP datagrams related to a particular initiating host after a special IP address command has been issued relating to that initiating host. Comparing means will then check the entries of the port-sharing table for a match and if no match is found the information about the initiating host is inputted in the port-sharing table.

Internet protocol assists for high performance LAN connections

An integrated hybrid system is provided. The hybrid system includes compute components of different types and architectures that are integrated and managed by a single point of control to provide federation and the presentation of the compute components as a single logical computing platform.

Stephen R. Valley

Papers

Method and apparatus for providing network virtualization

IP multicast interface

Management of FDDI physical link errors

Internet protocol assists for high performance LAN connections

Management of a data network of a computing environment