System and method for detecting real-time security threats in a network datacenter

Abstract

The system and method described herein may include a configuration management database that describes every known service endpoint in a network datacenter to represent a steady state for the datacenter. One or more listeners may then observe traffic in the datacenter in real-time to detect network conversations initiating new activity in the datacenter, which may be correlated, in real-time, with the information in the configuration management database representing the steady state for the datacenter. Thus, in response to the new activity failing to correlate with the known service endpoints, a real-time security alert may be generated to indicate that any network conversations initiating such activity fall out-of-scope from the steady state for the information technology datacenter.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This application claims the benefit of U.S. Provisional Patent Application Ser. No. 61 / 352,257, entitled “System and Method for Creating and Leveraging a Configuration Management Database,” filed Jun. 7, 2010, the contents of which are hereby incorporated by reference in their entirety.[0002]In addition, this application is related to U.S. patent application Ser. No. ______, entitled “System and Method for Modeling Interdependencies in a Network Datacenter,” filed on an even date herewith, and U.S. patent application Ser. No. ______, entitled “System and Method for Managing Changes in a Network Datacenter,” filed on an even date herewith, both of which further claim the benefit of U.S. Provisional Patent Application Ser. No. 61 / 352,257, and the contents of which are hereby incorporated by reference in their entirety.FIELD OF THE INVENTION[0003]The invention relates to a system and method for detecting real-time security threats in a netwo...

AI Technical Summary

Benefits of technology

[0009]According to one aspect of the invention, the system and method described herein may be used to create a configuration management database in a network datacenter, wherein the configuration management database may model interdependencies, detect real-time security threats, and manage proposed changes in the network datacenter. In particular, the system and method described herein may obtain accurate and timely information describing relationships and interdependencies in the datacenter, which may be modeled in a dependency database. As such, the information modeling the relationships and interdependencies in t...

Problems solved by technology

The deliberate sampling or selective extraction techniques may deliberately damper or reduce impacts on operations in the datacenter, as a number of flows needed to build a dependency map for the resources contained therein may be deliberately dampered.

Furthermore, the listeners may be part...

Images