Intrusion Detection and Mitigation in Data Processing

Abstract

a security manager configured to generate a plurality of learned security policies and provide at least one learned security policy and a security agent to a client machine, such that the at least one learned security policy is performed by the security agent on the client machine security policy. The security manager is configured to receive alerts from the security agent indicating abnormal behavior on the client machine.

Description

technical field [0001] The present invention relates to computer security, and in particular to intrusion detection systems. Background technique [0002] A computer security system protects the confidentiality (e.g., protection from privacy breaches), data integrity (e.g., protection from data corruption) and the availability of data (e.g. protection against functional interruption). However, unauthorized intrusion into computer systems may result in data disclosure and / or limited functionality. [0003] Unauthorized intrusions can exploit various attack vectors such as, but not limited to, workstation compromise, credential theft, exploitation (e.g., buffer overflow, stack overflow, etc.), vulnerabilities (e.g., exploiting a coding weakness in an application, kernel, etc.), and Escape-to-host attacks. [0004] Traditional intrusion detection systems can suffer from many challenges, such as generating an excessive number of alerts, requiring significant expertise (e.g., ...

AI Technical Summary

Problems solved by technology

However, traditional HIDS cannot monitor the large number of calls made in a network environment that may execute hundreds of different containers and / or virtual machines

Images