Protect computer assets from malicious attacks

Abstract

A method selectively installs a specific signature on a specific gateway based on the type of signature and the type of computer assets protected by the specific gateway. The system and / or analyst receives a plurality of signatures, where different signatures from the plurality of signatures are specific to different computer asset types. The system and / or analyst identifies and extracts a specific signature from the plurality of signatures, which, if implemented on an appropriate gateway, will protect a specific computer asset. The system and / or analyst identifies the appropriate gateway that protects the specific computer asset and installs the specific signature extracted from the plurality of signatures only on that appropriate gateway.

Description

BACKGROUND OF THE INVENTION

[0001] The present invention relates to the field of protecting computer assets from malicious electronic attacks. More specifically, the present invention relates to the field of upgrading gateways that protect computer assets from malicious electronic attacks.

[0002] Computer assets such as databases, servers, programs, data, etc. are typically protected by a gateway (e.g., a firewall) that prevents malicious attacks (i.e., intrusions) from attacking these computer assets. Behind such gateways are a large number of computer assets with different characteristics.

[0003] To protect computer assets, the gateway can be updated using security vendors' solutions to the latest known intrusions. Such solutions are commonly referred to as "signatures" because they are solutions specific to a particular intrusion with a specific code (i.e., binary code). Thus, the term "signature" is used and defined herein as a solution / update / upgrade for the gateway, where the signature addresses an intrusion / threat to the computer assets protected by the gateway.

[0004] When end users (e.g., analysts and / or automated systems) receive updated signatures, they typically do not know what specific computer assets are behind the different gateways. As such, the updated signatures are typically loaded onto all the gateways used by the enterprise. This results in a degradation of performance in the gateways as they become bogged down with irrelevant and unnecessary signatures.

[0005] Currently, there is no effective process for correlating known vulnerabilities of certain computer assets with the vendor signatures released. That is, the vendors have their own proprietary methods for managing protection policies and signatures. As a result, there is a current need to enable signatures in bulk without specific oversight (i.e., install new / updated signatures on all gateways), and / or spend a significant amount of time and effort manually reviewing each necessary protection / signature and applying it to a specific gateway. SUMMARY OF THE INVENTION

[0006] In one or more embodiments of the present invention, a method selectively installs a specific signature on a specific gateway based on the type of computer assets protected by the specific gateway. The system and / or analyst receives a plurality of signatures (e.g., intrusion prevention system - IPS signatures) from a signature vendor. Different signatures from the plurality of signatures are specific to different types of computer assets. The system and / or analyst identifies a specific signature from the plurality of signatures, the specific signature being specific to a specific type of computer assets. The specific signature is code that causes the gateway to block an intrusion from reaching the specific computer assets of the specific type of computer assets, as described in its specific asset context. The system and / or analyst extracts the specific signature from the plurality of signatures based on the specific asset context and identifies the specific gateway that protects the specific computer assets. Then, the system and / or analyst installs the specific signature extracted from the plurality of signatures only on the specific gateway.

[0007] In one or more embodiments of the present invention, the system and / or analyst affirmatively prevents any other signature from the plurality of signatures other than the extracted specific signature from being installed on the specific gateway.

[0008] In one or more embodiments of the present invention, the specific computer assets are a database system, and the specific asset context describes the vulnerability level of the database system, the identity of the database system, the hostname of the host computer on which the database system runs, and the operating system used by the database system.

[0009] In one or more embodiments of the present invention, the specific computer assets are a database program, and the specific asset context describes the vulnerability level of the database program, the identity of the database program, the hostname of the host computer on which the database program runs, the database system used by the database program, and the operating system used by the database system.

[0010] In one or more embodiments of the present invention, the method further includes performing natural language processing (NLP) analysis on a set of vulnerabilities to extract risk-related information, where the set of vulnerabilities describes the vulnerabilities applied to the specific gateway, and where the risk-related information includes a list of vulnerable network resources protected by the specific gateway and vulnerable to intrusion attacks.

[0011] In one or more embodiments of the present invention, the vulnerability of the specific computer assets to intrusion comes from a set of identified vulnerabilities such that the set of identified vulnerabilities is identified in a Common Vulnerabilities and Exposures (CVE) list generated by a third party monitoring the vulnerabilities of multiple computer systems.

[0012] In one or more embodiments of the present invention, a deep neural network (DNN) is trained to identify which gateway will receive a new signature based on the specific signature and the specific asset context referenced in the specific signature.

[0013] In one or more embodiments of the present invention, a computer program product includes a computer-readable storage medium having program code embodied therewith, wherein the computer-readable storage medium itself is not a transient signal. The program code is readable and executable by a processor to perform a method including but not limited to the following steps: receiving a plurality of intrusion prevention system (IPS) signatures, wherein different IPS signatures from the plurality of IPS signatures are specific to different types of IPS gateways that protect different types of computer assets; identifying a specific IPS signature from the plurality of IPS signatures, wherein the specific IPS signature is specific to a specific type of computer asset, wherein the specific IPS signature is code that causes a specific IPS gateway to block an intrusion from reaching a specific computer asset of the specific type of computer asset, and wherein the specific computer asset has a specific asset context specific to the specific computer asset; extracting the specific IPS signature from the plurality of IPS signatures based on the specific asset context; identifying a specific IPS gateway that protects the specific computer asset; and installing only the specific IPS signature extracted from the plurality of IPS signatures on the specific IPS gateway.

[0014] In one or more embodiments of the present invention, a computer system includes one or more processors, one or more computer-readable memories, one or more computer-readable non-transitory storage media, and program instructions stored on at least one of the one or more computer-readable non-transitory storage media, the program instructions being for execution by at least one of the one or more processors via at least one of the one or more computer-readable memories, the stored program instructions being executed to perform a method including but not limited to: receiving a plurality of intrusion prevention system (IPS) signatures, wherein different IPS signatures from the plurality of IPS signatures are specific to different types of IPS gateways that protect different types of computer assets; identifying a specific IPS signature from the plurality of IPS signatures, wherein the specific IPS signature is specific to a specific type of computer asset, wherein the specific IPS signature is code that causes a specific IPS gateway to block an intrusion from reaching a specific computer asset of the specific type of computer asset, and wherein the specific computer asset has a specific asset context specific to the specific computer asset; extracting the specific IPS signature from the plurality of IPS signatures based on the specific asset context; identifying a specific IPS gateway that protects the specific computer asset; and installing only the specific IPS signature extracted from the plurality of IPS signatures on the specific IPS gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 Exemplary systems and networks for implementing the present invention in one or more embodiments of the present invention are described;

[0016] Figure 2 Shows a high - level overview of components of one or more embodiments of the present invention;

[0017] Figure 3 Shows a data scraper process for receiving new signatures according to one or more embodiments of the present invention;

[0018] Figure 4 Shows a signature ticket processing flow according to one or more embodiments of the present invention;

[0019] Figure 5 Describes a recommendation engine process according to one or more embodiments of the present invention;

[0020] Figure 6 Shows an exemplary deep neural network (DNN) trained to determine which gateway will receive a specific signature;

[0021] Figure 7 Is a high - level flowchart of one or more steps performed according to one or more embodiments of the present invention;

[0022] Figure 8 Shows a cloud computing environment according to an embodiment of the present invention; and

[0023] Figure 9 Shows an abstract model layer of a cloud computing environment according to an embodiment of the present invention. Detailed Description

[0024] As described herein and in one or more embodiments, the present invention utilizes a recommendation engine that collects Common Vulnerability Exposure (CVE) information and other types of vulnerability information and scan data. Based on this information / data, the present invention evaluates the CVE base score (e.g., how severe the intrusion / attack is, based on how important the resource being attacked is, the impact on the overall system, etc.), attack vector (e.g., the path the intrusion is designed to take), impact score (based on the impact the intrusion will have on a specific set of computer assets), exploit score (e.g., the level at which the intrusion can exploit / extract computer assets such as data, programs, etc.), signature accuracy (e.g., how accurately the signature identifies the intrusion it is designed to counter), signature implementation impact (e.g., the amount of time and resource usage required to install and implement the signature), and vendor recommendations (e.g., which gateway the signature vendor / vendors recommend to install the new signature).

[0025] In one or more embodiments of the present invention, the system uses this data to only filter network exploitation, such as which computer assets will be affected by an intrusion. The system recommendation for which gateway will have a signature installed on it is based on a weighted metric compared to a response matrix from the system.

[0026] In one or more embodiments of the present invention, recommendations are provided to a user / system / analyst who may choose to block or not block the installation of a signature on a protection device (e.g., gateway, firewall, etc.).

[0027] In one or more embodiments of the present invention, an implementation engine compiles the correct syntax to enable the signature on the protection device as well as any other relevant and necessary mechanisms.

[0028] In one or more embodiments of the present invention, inventory scan data (among other things) that describes which computer assets are used / managed / owned by a particular customer is incorporated into the recommendation to filter out irrelevant threats. That is, if a signature vendor sends a customer a new signature to protect a certain type of computer asset, but the customer's inventory scan data reveals that this type of computer asset is not used by the customer, the customer does not install the new signature on any of its gateways.

[0029] There are no existing tools in the prior art that enable a system and / or analyst to use a combination of vulnerability data, field device configuration, and scan data to automatically evaluate and implement protection across multiple different vendor platforms in a single request. However, one or more embodiments of the present invention provide these features.

[0030] Thus, one or more embodiments of the present invention collect vendor-unique vulnerability definitions and keyword-tag them in a common vulnerability database using the CVE-unique field.

[0031] Using security operations center (SOC)-based evaluation techniques, one or more embodiments of the present invention programmatically recommend protection techniques in real time.

[0032] Accordingly, as described herein, one or more embodiments of the present invention simplify the process of protecting against known vulnerabilities by scaling and automating prevention strategy modification across multiple vendors. One or more embodiments of the present invention take a given vulnerability identifier or keyword, correlate it with protection rules from multiple vendors, and then query the customer's devices to determine whether they are currently protected. Based on data from a vulnerability repository, such as severity, access vector, and system impact, one or more embodiments of the present invention determine which risks should be prioritized.

[0033] In addition, one or more embodiments of the present invention collect information from scan data (i.e., data obtained by scanning computer assets to identify their presence and their characteristics / context) to determine which systems are vulnerable and apply appropriate recommended protection. One or more embodiments of the present invention then automatically apply fixes (signatures) on the customer's gateway devices, such as updating the signature of the gateway device from the vendor and / or enabling the signature in a relevant profile.

[0034] In one or more embodiments of the present invention, the intrusion prevention system (IPS) rule databases of aggregating vendors are such that CVEs are associated with internal identifiers (IDs) of each vendor for associated rules. Each set of CVE and vendor ID is stored with metadata such as description, severity, device impact, and updated version, where each vendor introduces rules for which it is to protect. In one or more embodiments of the present invention, the stored data for populating the aggregation database is sourced from the physical devices of each vendor and / or the online application programming interfaces (APIs) of the vendors. The data is stored centrally, so only one database needs to be created for all users of the software, reducing the amount of time required to update records. Thus, in one or more embodiments of the present invention, records are updated only when each vendor pushes a change to its IPS rule set.

[0035] After collecting threat protection rules in a central database, one or more embodiments of the present invention allow users to query the central database by CVE or keyword. Based on the vendor used by the customer, the rule IDs of the appropriate vendor are then returned. Associating the rule IDs with data stored in an online CVE library, one or more embodiments of the present invention evaluate the potential risk level of the vulnerability and the importance of blocking the exploitation of the vulnerability at the network level. In one or more embodiments of the present invention, the process uses vectors such as access vectors (e.g., which will ignore attacks that require physical access rather than using remote access) and affected applications / operating systems (e.g., which will not prioritize vulnerabilities of a first type of operating system on a firewall / gateway protecting a second type of operating system machine). After compiling this information, one or more embodiments of the present invention make a decision on the optimal IPS policy (block, log, allow, etc.) for the rule and provide context for the priority and time sensitivity of the matter. If the system / user / analyst accepts the proposed configuration, one or more embodiments of the present invention will proceed to automatically install the new policy (i.e., signature) or modify the existing policy / signature. Additionally, one or more embodiments of the present invention also check the version of the installed IPS database and, if an update exists, prompt the user / system / analyst to install the latest IPS database.

[0036] As used in this patent application, a "weakness" of a computer asset is defined as a characteristic in a computer asset that makes it vulnerable to malicious actions. For example, a new code version may typically not protect a specific port in a network router, making that specific port "weak". Thus, the Common Weakness Enumeration (CWE) is a standard for describing such identified / discovered weaknesses.

[0037] As used in this patent application, a "vulnerability" is defined as a specific vulnerability of a computer asset caused by that weakness. For example, if a new code version does not protect a specific port in a network router, that specific port is vulnerable to malicious attacks, making that specific port clearly vulnerable ("vulnerable"). Thus, a Common Vulnerability Exposure (CVE) is a standard used to describe such a specifically identified / discovered vulnerability.

[0038] Thus, a "weakness" describes the general vulnerability level to malicious attacks, while a "vulnerability" describes the exposure to a specific type of malicious attack.

[0039] As used in this patent application, the term "intrusion" is defined as a malicious attack on a computer asset. Examples of intrusions include, but are not limited to, malware such as viruses, unauthorized keyloggers, unauthorized data extraction programs, etc.

[0040] As used in this patent application, the term "intrusion prevention system" or IPS is defined as a system such as a firewall or gateway to protect against intrusions from reaching the protected computer assets. Such a firewall / gateway is implemented in hardware, software, and / or a combination of hardware and software.

[0041] As used in this patent application, the term "signature" is defined as protection code that, when installed on an IPS, prevents intrusions from reaching the protected computer assets.

[0042] Now referring to the drawings, specifically to Figure 1 , which shows a block diagram of an exemplary system and network that can be used by and / or in the implementation of one or more embodiments of the present invention. Note that the neural network 124 and / or the software deployment server 150 and / or the intrusion prevention system (IPS) signature provider system 152, the (one or more) IPSs 154 and / or the (one or more) computer assets 156 can utilize some or all of the exemplary architecture shown in and within the computer 102, including both the depicted hardware and software.

[0043] Exemplary computer 102 includes a processor 104 coupled to a system bus 106. The processor 104 may utilize one or more processors, each processor having one or more processor cores. A video adapter 108 that drives / supports a display 110 is also coupled to the system bus 106. The system bus 106 is coupled to an input / output (I / O) bus 114 via a bus bridge 112. An I / O interface 116 is coupled to the I / O bus 114. The I / O interface 116 provides communication with various I / O devices, including a keyboard 118, a mouse 120, a media tray 122 (which may include storage devices such as a CD-ROM drive, a multimedia interface, etc.), a neural network 124, and one or more external USB ports 126. Although the format of the ports connected to the I / O interface 116 may be any format known to those skilled in the art of computer architecture, in one embodiment, some or all of these ports are universal serial bus (USB) ports.

[0044] As depicted, computer 102 is capable of communicating with neural network 124 and / or software deployment server 150 and / or IPS signature vendor system 152 and / or one or more IPSs 154 and / or one or more computer assets 156 using a network interface 130 to a network 128. The network interface 130 is a hardware network interface, such as a network interface card (NIC), etc. The network 128 may be an external network, such as the Internet, or an internal network, such as Ethernet or a virtual private network (VPN).

[0045] A hard drive interface 132 is also coupled to the system bus 106. The hard drive interface 132 interfaces with a hard drive 134. In one embodiment, the hard drive 134 populates a system memory 136 that is also coupled to the system bus 106. The system memory is volatile memory in computer 102. This volatile memory includes additional levels of memory (not shown), including but not limited to cache memory, registers, and buffers. The data populating the system memory 136 includes an operating system (OS) 138 and application programs 144 of computer 102.

[0046] The OS 138 includes a shell 140 that provides transparent user access to resources such as application 144. Generally, the shell 140 is a program that provides an interpreter and interface between the user and the operating system. More specifically, the shell 140 executes commands entered into a command-line user interface or from a file. Thus, the shell 140, also known as the command processor, is typically the highest level of the operating system software hierarchy system and serves as a command interpreter. The shell provides a system prompt, interprets commands entered by a keyboard, mouse, or other user input medium, and sends the interpreted commands to the appropriate lower level of the operating system (e.g., the kernel 142) for processing. Note that although the shell 140 is a text-based line-oriented user interface, the present invention can equally well support other user interface modes, such as graphical, voice, gesture, etc.

[0047] As depicted, the OS 138 also includes a kernel 142 that includes lower-level functions of the OS 138, including providing basic services required by other parts of the OS 138 and application 144, including memory management, process and task management, disk management, and mouse and keyboard management.

[0048] The application 144 includes a renderer shown by way of example as a browser 146. The browser 146 includes program modules and instructions that enable a World Wide Web (WWW) client (i.e., the computer 102) to send network messages to and receive network messages from the Internet using Hypertext Transfer Protocol (HTTP) messaging, thereby enabling communication with a software deployment server 150 and other computer systems.

[0049] The application 144 in the system memory of the computer 102 (and the system memory of the software deployment server 150) also includes Intrusion Prevention System (IPS) Signature Management Logic (IPSSML) 148. The IPSSML 148 includes code for implementing the processes described below, including Figure 2-7 those described in. In one embodiment, the computer 102 is able to download the IPSSML 148 from the software deployment server 150, including on-demand downloading, where the code in the IPSSML 148 is not downloaded until it is needed for execution. Note also that in one embodiment of the present invention, the software deployment server 150 performs all functions associated with the present invention (including the execution of the IPSSML 148), thereby relieving the computer 102 from having to use its own internal computing resources to execute the IPSSML 148.

[0050] The neural network 124 is also connected to the computer 102 (or as part thereof). In one or more embodiments of the present invention, the neural network 124 is a deep neural network (see Figure 6) a convolutional neural network or another type of heuristic artificial intelligence.

[0051] The IPS signature vendor system 152 is also connected to the computer 102 (alternatively, as part of it), which is a system used by the vendor of the IPS signature (e.g., Figure 2 IPS signature vendor 202 and / or IPS signature vendor 204 as shown). As defined herein, a "signature" matches a specific intrusion binary file, such that a "signature" is defined as code that prevents the intrusion binary file from reaching computer assets (e.g., Figure 2 computer assets 224 and / or computer assets 226 as shown) protected by an IPS gateway (such as Figure 2 IPS 220 and / or IPS 222 as shown).

[0052] Thus, Figure 1 the (one or more) IPSs 154 as shown are similar to Figure 2 the exemplary IPS 220 and / or IPS 222 as shown, and the computer assets 156 are similar to Figure 2 the exemplary computer assets 224 and / or computer assets 226 as shown.

[0053] Note that the hardware elements shown in computer 102 are not exhaustive but representative to highlight the basic components required by the present invention. For example, computer 102 may include alternative memory storage devices such as tape cartridges, digital versatile discs (DVDs), Bernoulli cartridges, etc. These and other variations are within the scope of the present invention.

[0054] Now referring to Figure 2 , a high-level overview of the components of one or more embodiments of the present invention is shown.

[0055] In the description Figure 2 the terms intrusion prevention system (IPS), gateway, firewall, and IPS gateway are used interchangeably to describe the exemplary IPS 220 and IPS 222.

[0056] As Figure 2 shown, one or more signature vendors (e.g., IPS signature vendor 202 and / or IPS signature vendor 204) provide signatures for use by one or more customers (e.g., customer 216 and / or customer 218) via the implementation engine 214.

[0057] Signature vendors (e.g., IPS signature vendor 202 and / or IPS signature vendor 204) send new / updated signatures (i.e., code that provides protection against newly identified intrusions when implemented in a firewall / gateway such as IPS 220 and / or IPS 222) to the database updater 206.

[0058] The database updater 206 executes new signatures chronologically by querying a data source for signature-specific metadata and then inserts the extracted metadata into a centralized database 208. That is, signatures from signature vendors (e.g., IPS signature vendor 202 and / or IPS signature vendor 204) include metadata about such signatures. This metadata is then used to associate vulnerabilities (e.g., Common Vulnerabilities and Exposures - CVE) with a specific gateway (e.g., IPS 220) by using vulnerabilities found in the vulnerability database 212, where the found vulnerabilities are applied to the vulnerability-to-IPS signature lookup table 210.

[0059] The vulnerability-to-IPS signature lookup table 210 is a lookup system that matches metadata for a specific IPS signature with a specific vulnerability. That is, given a specific CVE identifier for a specific computer asset, the vulnerability-to-IPS signature lookup table 210 matches that specific CVE identifier with known vendor IPS signatures and information for such known IPS signatures. One or more of these known vendor IPS signatures and their accompanying information are sent to the implementation engine 214 to send the appropriate signature to the appropriate gateway (e.g., IPS 220 and / or IPS 222).

[0060] However, for illustrative purposes, assume that IPS 220 is able to load signatures from IPS signature vendor 202 or IPS signature vendor 204, and IPS 222 is able to load signatures from IPS signature vendor 202 or IPS signature vendor 204, even if computer assets 224 and 226 are different types of computer assets (e.g., running on different types of hosts, different types of operating systems, using different types of databases, etc.).

[0061] For example, assume that computer asset 224 is a program that uses database structure A and runs on a first type of OS. Additionally, assume that computer asset 226 is a program that uses database structure B and runs on a second type of OS. Further assume that the new signature is specific to assets that only run on the first type of OS. However, the end user 234 will typically not know any details about computer asset 224 or computer asset 226. Thus, in the absence of the present invention, the end user 234 will, via user interface 232, direct implementation engine 214 to install the new signature received from IPS signature vendor 202 on both IPS 220 and IPS 222, even though this is useless for IPS 222 (which has been assigned to only protect computer asset 226 that runs on the second type of OS). This over-installation causes unnecessary signatures to be installed on the IPSs, thus degrading their performance.

[0062] One or more embodiments of the present invention solve this problem by using context database 230 and analysis engine 228.

[0063] Context database 230 includes information that describes a particular computer asset (e.g., computer asset 224). For example, in one or more embodiments of the present invention, assume that the context entry for computer asset 224 in context database 230 provides information about the infrastructure of computer asset 224. If computer asset 224 is a file, the infrastructure includes other files that together with computer asset 224 form a file cluster, what applications are used with the file, what operating systems are used with the applications, what host systems hold the file and / or application, etc.

[0064] In one or more embodiments of the present invention, if the end user 234 (e.g., a computer system such as Figure 1 computer 102 shown and / or an analyst using user interface 232) determines that a particular computer system does not have all of these characteristics (e.g., is a particular type of file, and / or uses a particular type of application, and / or runs a particular operating system, etc.), then the execution / implementation of the new signature is not performed. That is, if the new signature is only for computer assets that run on a first type of OS, but an enterprise only runs applications on a second type of OS, then there is no need to install the new signature on any IPS gateways used by the enterprise. Thus, the implementation of the new signature is prevented from being sent to any IPS gateways used by the enterprise.

[0065] However, if the enterprise includes computer assets (e.g., computer asset 224) and the new signature is designed to protect it when installed on its gateway (e.g., IPS 220), the end user 234 installs the new signature on IPS 220 rather than IPS 222 (assuming there are no assets protected by the new signature installed on IPS 222 in computer asset 226).

[0066] In one or more embodiments of the present invention, the decision on whether to implement a particular signature is based on multiple factors (such as factors other than the type of OS on which the asset runs as described in the above example), as evaluated by the analysis engine 228 using information from the context database 230.

[0067] That is, in one or more embodiments of the present invention, the analysis engine 228 uses a CVE score (i.e., a score on how vulnerable a particular asset such as computer asset 224 is); an attack vector (i.e., the channel / port etc. through which the intrusion is designed to be used when attacking a particular asset); the history of when, where, and how often the intrusion attacks other computer assets; and / or a record of the effectiveness of the signature provided by the signature vendor in thwarting attacks passing through other computer components in determining whether to install the newly received signature and / or on which IPS to install the newly received signature.

[0068] In one or more embodiments of the present invention, scan data (e.g., information describing how computer assets and / or intrusions have affected other systems and their components in the past) is also used for impact verification on how dangerous the intrusion is to the current computer asset. In one or more embodiments of the present invention, this information is used by the implementation engine 214 when determining whether and / or on which IPS to install the newly received signature.

[0069] In one or more embodiments of the present invention, the analysis engine 228 also uses IPS context from the context database 230 for a specific IPS gateway such as computer asset 224, the IPS context including information about the IPS 220 such that policies can be implemented. That is, in one or more embodiments of the present invention, the analysis engine 228 not only considers the context of the computer asset (e.g., computer asset 224), but also the context of the protective gateway (e.g., IPS 220). In this way, the analysis engine 228 uses the IPS CVE score (i.e., a score of how vulnerable a specific IDS gateway such as IPS 220 is); the IPS attack vector (i.e., through which channel / port, etc., the intrusion is designed to be used when attacking a specific IPS gateway); the history of when, where, and how often an intrusion strikes other computer IPS gateways; and / or a record of the effectiveness of signatures provided by signature vendors in deterring past attacks on other computer assets by other IPS gateways in determining whether and / or on which IPS to install a newly received signature.

[0070] Thus, in one or more embodiments of the present invention, Figure 2 depicts how to selectively implement a specific IPS signature on a specific IPS based on what type of computer asset is protected by the specific IPS signature, the asset context of the computer asset, and / or the IPS context of the specific IPS.

[0071] Now referring to Figure 3 , a data scraper process for receiving new signatures used in one or more embodiments of the present invention is shown.

[0072] After the initiator box 301, the IPS signature vendor (e.g., Figure 2 the IPS signature vendor 202 shown in

[0073] updates its record of newly generated IPS signatures (in response to newly detected intrusions), as well as updated reports from customers on their common vulnerability exposures (CVEs), as shown in box 303. Figure 2 The vulnerability database 212 shown in

[0074] As shown in box 307, the client / customer (e.g., customer 216 and / or end user 234) requests CVE protection (e.g., IPS signatures) from the centralized database.

[0075] As shown in query box 309, if the requested CVE protection is not in the centralized database, the requested CVE protection is retrieved from the vendor and added to the centralized database (see box 311). However, if the requested CVE protection is in the centralized database, the customer retrieves the configuration data from a specific endpoint device (e.g., IPS 220), as shown in box 313.

[0076] As shown in query box 315, the customer determines whether the local IPS rule base (i.e., the rules for what types of computer assets are protected by a specific IPS and / or which IPS signature vendors' products are used by that specific IPS) is up-to-date. If not, the local definitions of these IPSs are updated by scanning the component descriptions of these IPSs (i.e., gateways, firewalls, etc.) (e.g., searching for the universally unique identifier (UUID) associated with each component from a database or from a radio frequency identifier (RFID) chip attached to the device, an identifier in the software associated with the component / asset, etc.), as shown in box 317. However, if the local IPS rule base is up-to-date, the customer's current CVE is correlated with the internal identifier (ID) of the IPS protection vendor (see box 319).

[0077] As shown in query box 321, a query is made as to which IPS gateway protects which specific computer assets and whether the rules for which IPS protection will be used are enabled. That is, not only must the customer's system know which specific IPS uses a specific IPS signature vendor to protect which computer assets, but the system must also be enabled (configured) to correlate a specific IPS signature with a specific IPS and a specific computer asset with a specific IPS signature, and must also authorize that specific IPS to install that specific IPS signature. If these conditions have been met, the user is notified (box 323) that the specific IPS signature will be installed on the specific IPS, and the process ends at termination box 333.

[0078] However, if the rules have not been enabled (query box 321), the customer's end user and / or analysis (e.g., Figure 2 the analysis engine 228 shown therein) will generate a score as to whether the rules should be enabled, as shown in box 325. That is, a high score indicates that the rules should be enabled, while a low score indicates that the rules should not be enabled. Such a score is based on heuristics, such as those described in the discussion of asset context and other factors presented above Figure 2 and below Figure 6 and herein.

[0079] In this way, the customer's system and / or analyst determines in query box 327 whether a rule should be enabled. If not, the user is notified (along with the reason why the rule should not be enabled, such as that installing a new but unnecessary rule will result in overprotection of the rules already in a particular IPS, etc.), as shown in box 329, and the process ends at termination box 333.

[0080] However, if the customer's system and / or analyst determines that the rule should be enabled, the user is notified (e.g., Figure 2 the end user 234 as shown), as shown in box 331. This allows the end user / analyst to either manually enable the rule by implementing the signature in the IPS through the Figure 2 implementation engine 214 as shown, or authorize the heuristic system (e.g., Figure 6 the deep neural network 624 as shown) to automatically enable the rule, thereby installing the signature in the IPS and ending the process at termination box 333.

[0081] Now referring to Figure 4 , the high-level flowchart illustrates a signature ticket processing flow according to one or more embodiments of the present invention.

[0082] After start block 402, a customer (e.g., Figure 2 the customer 216 as shown) requests a signature (i.e., to prevent an intrusion to be installed on a gateway / firewall such as Figure 2 the IPS 220 as shown) to prevent an intrusion, as shown in block 404.

[0083] As shown in query box 406, a query is made as to whether there is a ticket (work order) for the request made in block 404. If not, a new ticket is created (see block 408). However, if there is already a ticket for the request made in block 404, a query is made as to whether the authorizing party (e.g., end user 234 and / or customer 216) has granted approval to implement the changes described in the ticket (see query box 410). If not, the changes are not applied to the IPS to be protected by the signature described in the ticket (block 412), and the ticket is closed (block 416), resulting in the end of the process (termination box 418). However, if the appropriate party has approved the ticket (query box 410), then Figure 2 the implementation engine 214 as shown in

[0084] Now referring to Figure 5 , the high-level flowchart describes a recommendation engine flow according to one or more embodiments of the present invention.

[0085] After the start box 501, a request for a signature to address a specific intrusion (e.g., via an application programming interface API) is received, as shown in box 503. For example, Figure 2 the end user 234 and / or the analysis engine 228 shown interface with the API (e.g., via the Figure 2 user interface 232 shown if the requester is the end user 234) to request a signature (i.e., to protect the IPS gateway / firewall from a specific intrusion).

[0086] As shown in query box 505, a query (e.g., by the Figure 2 analysis engine 228 shown) is made to determine whether the signature and / or the specific intrusion is in a public threat database (e.g., Figure 2 the vulnerability database 212 shown). If not, the database is updated to include a description of the signature and / or the specific intrusion, or the intrusion binary itself, as shown in box 507.

[0087] If the signature and / or the specific intrusion is in the public threat database, a query is made to query whether the above CVE score meets a threshold (query box 509). If not, no further action is taken (box 511), and the process ends (termination box 535).

[0088] However, if the CVE score meets or exceeds the set threshold, a query is made as to whether components of the network (e.g., Figure 2 the computer asset 224 shown) have been attacked (query box 513). If not, no further action is taken (box 511), and the process ends (termination box 535).

[0089] However, if the network component has been attacked, the asset context of the computer asset is retrieved (as described above) (box 515). This results in determining whether the scan data (i.e., a description of the computer asset, such as Figure 2 the computer asset 224 shown) shows that the asset is actually vulnerable to the intrusion attack, as shown in query box 517. If not, no further action is taken (box 511), and the process ends (termination box 535).

[0090] However, if the scan data indicates that a computer asset is vulnerable or potentially vulnerable to an intrusion, a query is made as to whether to trust a vendor (e.g., IPS signature vendor 202) to provide an appropriate / suitable signature (query box 519). If the impact of the intrusion is such that the signature vendor is not trusted / insufficient to provide the correct signature (e.g., based on the signature vendor's previous experience), as shown in box 521, or if the signature has poor fidelity just by looking at the code in the signature (box 523), then the customer (e.g., end user 234) is so notified, and the process ends at termination box 535.

[0091] However, if the vendor is considered able to address that specific intrusion (query box 519), then a query is made to ask whether the IPS gateway already has sufficient protection (e.g., from another signature) to protect its computer assets from that specific intrusion (query box 525). If so, the customer is notified (box 527), and the process ends (termination box 535). However, if there is not sufficient intrusion protection at the IPS level yet, then Figure 2 the implementation engine 214 as shown will prepare the appropriate syntax to utilize the signature (box 529), notify the customer of the need for approval to install the signature (box 531), and then via Figure 2 the implementation engine 214 as shown will send the change (signature) with the appropriate customer approval to the appropriate IPS (box 533). Again, the process ends at termination box 535.

[0092] In one or more embodiments of the present invention, a deep neural network (DNN) determines which IPS will receive a particular IPS signature. Figure 6 An exemplary DNN 624 is shown that is trained to determine which IPS / gateway will receive that particular signature (similar to Figure 1 the neural network 124 shown in

[0093] As the name implies, a neural network roughly emulates a biological neural network (e.g., the human brain). A biological neural network consists of a series of interconnected neurons that influence each other. For example, a first neuron can be electrically connected to a second neuron via a synapse by releasing neurotransmitters (from the first neuron) that are received by the second neuron. These neurotransmitters can cause the second neuron to be excited or inhibited. The pattern of interconnected neurons that are excited / inhibited ultimately results in biological outcomes, including thinking, muscle movement, memory recall, etc. Although this description of a biological neural network is highly simplified, the high-level overview is that one or more biological neurons affect the operation of one or more other electrically connected biological neurons.

[0094] An electronic neural network is similarly composed of electronic neurons. However, unlike biological neurons, electronic neurons are never technically "inhibitory" but only "excitatory" to varying degrees.

[0095] Nodes within the neural network, such as DNN 624, represent hardware processors, virtual processors, software algorithms, or a combination of hardware processors, virtual processors, and / or software algorithms.

[0096] In a deep neural network (DNN) (such as DNN 624), the electronic neurons are arranged in layers, referred to as an input layer, one or more hidden layers, and an output layer. Thus, the electronic neurons (also simply referred to herein as "neurons" or "nodes") in DNN 624 are arranged in input layer 603, hidden layer 605, and output layer 607. The input layer 603 includes neurons / nodes that acquire input data and send it to a series of hidden neuron layers (e.g., hidden layer 605), where neurons from one of the hidden layers are interconnected with all neurons in the next layer within hidden layer 605. Then, the last layer within hidden layer 605 outputs the calculation result to output layer 607, which is typically a single node for storing vector information.

[0097] As just mentioned, each node in the depicted DNN 624 represents an electronic neuron, such as the depicted neuron 609. As shown in block 611, in one or more embodiments of the present invention, each neuron (including neuron 609) functionally includes at least four features: an algorithm, an output value, a weight, and a bias value.

[0098] The algorithm is a mathematical formula for processing data received from one or more upstream neurons. For example, assume that one or more of the neurons depicted in the intermediate hidden layer 605 send data values to neuron 609. Neuron 609 then processes these data values by executing the algorithm shown in block 611 in order to create one or more output values, which are then sent to another neuron, such as another neuron within hidden layer 605 or neuron 606 in output layer 607. Each neuron also has a weight specific to that neuron and / or to other connected neurons, and indicates how important the output from that neuron is. That is, a downstream neuron can ignore the output from a lightly weighted upstream neuron, but must accept and process the data from a heavily weighted upstream neuron. Additionally, the one or more output values are added to the one or more bias values, which increases or decreases the one or more original output values, thus allowing for further "fine-tuning" of DNN 624.

[0099] For example, assume that neuron 613 is sending the result of its analysis of a piece of data to neuron 609. Neuron 609 has a first weight that defines how important the data specifically from neuron 613 is. If the data is important, the data from neuron 613 is reweighted and / or its bias value is increased, such that the algorithm(s) within neuron 609 generate an output that is then weighted higher and / or has a higher value, which has a corresponding impact on the neurons in output layer 607. That is, if neuron 613 has been determined to be important for the operation of neuron 609, the weight and / or bias in neuron 613 will be increased such that neuron 609 receives a higher level of importance for the output attributable to the algorithm in neuron 613. Alternatively, the output of neuron 609 can be minimized by decreasing the weight and / or bias used to influence the output of neuron 609. These weights / biases are adjustable for one, some, or all of the neurons in DNN 624 such that a reliable output will be obtained from output layer 607.

[0100] When an asset context 600 (e.g., a description of a specific computer asset) and an IPS signature 602 (e.g., a specific signature generated by an IPS signature vendor for an IPS gateway to block a specific intrusion from reaching that specific computer asset) are input into a trained version of DNN 624, an identification of which specific IPS the IPS signature should be installed on is identified in the output 604 from DNN 624. To provide this functionality, DNN 624 must first be trained.

[0101] Thus, in one or more embodiments of the present invention, known training asset contexts (depicted as asset context 600 during the training of DNN 624) and known IPS signatures (depicted as IPS signature 602 during the training of DNN 624) are input into DNN 624 in order to train DNN 624 via a manual process and / or a backpropagation process.

[0102] When manually adjusted during the training of DNN 624, the algorithms, output values, weights, and / or biases are adjusted in a repetitive manner by a user, sensor logic, etc. until the output from output layer 607 matches the expectation. For example, assume that the input layer 603 receives training inputs that describe a known specific type of asset context and a known IPS signature. By manually and repetitively adjusting the algorithm(s), output value(s), weight(s), and bias in one or more of the electronic neurons within DNN 624, DNN 624 becomes a trained DNN that will correctly output a vector / value to output layer 607 indicating that neuron 606 describes a specific solution for installing the signature on the appropriate IPS, which is presented as output 604.

[0103] When automatically adjusting, "backpropagation" is used to adjust the weights (and / or algorithms and / or bias values), where the weight values, algorithms, and / or bias values of the neurons are adjusted by using the "gradient descent" method, and the gradient descent method determines the direction in which each weight / bias / algorithm should be adjusted. This gradient descent process moves the weights and / or biases in each neuron in a specific direction, and / or changes the algorithm itself, until the output from the output layer 607 improves (e.g., accurately describes which IPS should have the signature installed on it).

[0104] Thus, in one or more embodiments of the present invention, the DNN 624 is now trained to determine which IPS / gateway will receive a specific signature based on the IPS signature itself (depicted as the IPS signature 602 at runtime) and the description of the computer asset (depicted as the asset context 600 at runtime, which is an asset context such as the asset context described above with reference to Figure 2 ).

[0105] Thus, in one or more embodiments of the present invention, the DNN 624 is first trained by inputting known training asset context data (depicted as the asset context 600 in Figure 6 ) and known training IPS signature data (depicted as the IPS signature 602 in Figure 6 ) to generate an expected value in the neuron 606 in the output layer 607. For example, assume that the known training asset context data describes a specific computer asset (e.g., a database system), and the known training IPS signature data describes a specific type of signature (e.g., for use with an IPS gateway that protects that type of database system). Using the above manual or backpropagation process, the DNN 624 is adjusted until the content of the neuron 606 describes the specific type of IPS gateway on which this type of IPS signature should be installed.

[0106] The training process then goes through other combinations of the known training asset context descriptions and the known training IPS signature data until the DNN 624 is a trained DNN that is capable of matching a specific type of IPS signature with a specific type of IPS gateway.

[0107] Thereafter, the trained DNN 624 will be able to evaluate other asset contexts and IPS signatures in order to determine which IPS gateway (if any) in the customer inventory should receive a specific IPS signature.

[0108] DNN 624 is an exemplary type of neural network used in one or more embodiments of the present invention. Other neural networks that may be used in one or more embodiments of the present invention include convolutional neural networks (CNNs) and neural networks using other forms of deep learning.

[0109] Now referring to <……>, a high-level flowchart of one or more steps performed in accordance with one or more embodiments of the present invention is shown.

[0110] After start block 701, a customer (e.g., Figure 2 the end user 234 and / or the implementation engine 214 and / or the analysis engine 228 and / or the customer 216 shown in Figure 2 ) receives a plurality of signatures, as described in block 703. In one or more embodiments of the present invention, different signatures from the plurality of signatures are dedicated to different types of gateways for protecting different types of computer assets. That is, assume

[0111] As described in block 705, Figure 2 the analysis engine 228 shown in

[0112] identifies a specific signature from the plurality of signatures. The specific signature is specific to a specific type of computer asset (e.g., computer asset 224). As described herein, the specific signature is the code of a specific computer asset that causes a specific gateway to block an intrusion from reaching a specific type of computer asset. Thus, a specific computer asset has a specific asset context specific to the specific computer asset. [[ID=……]]: Figure 2 the analysis engine 228 shown in Figure 2 extracts the specific signature from the plurality of signatures based on the specific asset context. That is, the analysis engine 228 determines that the specific signature protects a specific computer asset (e.g.,

[0113] As described in block 709, Figure 2 the analysis engine 228 shown in Figure 2 identifies a specific gateway (e.g.,

[0114] As described in block 711, Figure 2 It should be noted that there seems to be an incomplete or incorrect tag in the original text at " Figure 7 ", which is presented as "<……>" in the translation for the purpose of maintaining the format. You may want to check and correct the original text for a more accurate translation.The implementation engine 214 shown then installs only the specific signature extracted from the multiple signatures on a specific gateway. That is, among the multiple signatures received by the customer / end user, only the extracted specific signature is used, and the specific signature is dedicated to computer assets that are part of the system that is actually the customer's. More specifically, the extracted specific signature is installed only on the IPS 220, not on the IPS 222, because the extracted specific signature is specific for protecting the computer assets 224. In this way, the IPS 222 is not burdened with a copy of this extracted specific signature because the IPS 222 does not need this extracted specific signature. Thus, the extracted specific signature is installed only on the specific gateway and not on other gateways.

[0115] In one or more embodiments of the present invention, the end user and / or customer and / or implementation engine explicitly prevent any other signature other than the extracted specific signature from the multiple signatures from being installed on the specific gateway.

[0116] The flowchart ends at the terminator box 713.

[0117] In one or more embodiments of the present invention, the specific computer asset is a database system. The database system is a specific type of database management system that supports database programs designed to run on the database management system. Thus, the specific asset context describes the vulnerability level of the database system, the identity of the database system, the hostname of the host computer on which the database system runs, and the operating system used by the database system. In one or more embodiments of the present invention, when determining which IPS to install the extracted specific signature on, all of this information is used (e.g., by Figure 6 the DNN 624 shown).

[0118] In one or more embodiments of the present invention, the specific asset is a database program. The database program runs on a specific type of database system (e.g., the database management system just described). Thus, the specific asset context describes the vulnerability level of the database program, the identity of the database program, the hostname of the host computer on which the database program runs, the database system used by the database program, and the operating system used by the database system. In one or more embodiments of the present invention, when determining which IPS to install the extracted specific signature on, all of this information is used (e.g., by Figure 6 the DNN 624 shown).

[0119] In one or more embodiments of the present invention, the method further includes performing natural language processing (NLP) analysis on a set of vulnerabilities to extract risk-related information. The set of vulnerabilities describes vulnerabilities applied to a specific gateway. The risk-related information includes a list of vulnerable network resources that are protected by the specific gateway and are vulnerable to intrusion attacks.

[0120] For example, consider Figure 2 the vulnerability database 212 shown in, and assume that the vulnerability database 212 includes information about a specific type of intrusion, including what types of computer assets can be attacked by that type of intrusion. In addition, the information in the vulnerability database 212 also includes what types of computer assets are protected by what types of gateways. Thus, the vulnerability database 212 includes the following information: 1) what types of computer assets are vulnerable to a specific type of intrusion attack (may be compromised), 2) what types of IPS gateways protect that type of computer asset, and 3) a description of the signature that, if installed on that type of IPS gateway, will prevent that specific type of intrusion from reaching that type of computer asset.

[0121] To identify all this information, the NLP analysis will examine the text in the vulnerability database 212 that describes this information in order to identify 1) what types of computer assets are vulnerable to a specific type of intrusion attack (may be compromised), 2) what types of IPS gateways protect that type of computer asset, and 3) a description of the signature that, if installed on that type of IPS gateway, will prevent that specific type of intrusion from reaching that type of computer asset.

[0122] In one or more embodiments of the present invention, the vulnerability of a specific computer asset to intrusion comes from a set of identified vulnerabilities (e.g., as found in the vulnerability database 212 shown in Figure 2 ). The set of identified vulnerabilities is identified in a Common Vulnerabilities and Exposures (CVE) list generated by a third party that monitors the vulnerabilities of multiple computer systems.

[0123] In one or more embodiments of the present invention, a user and / or a computer system (e.g., the implementation engine 214 shown in Figure 2 ) trains a deep neural network (DNN) to identify a specific gateway by inputting known training signatures and known training asset contexts into the DNN, as described in Figure 6 . Similarly, as described in Figure 6 , once the DNN is trained to identify certain types of signatures and asset contexts, it will identify the specific gateway to receive the extracted specific signature by inputting the specific asset context and the extracted specific signature into the trained DNN.

[0124] In one or more embodiments, the present invention is implemented using cloud computing. Nevertheless, it should be understood upfront that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings described herein is not limited to a cloud computing environment. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0125] Cloud computing is a service delivery model for enabling convenient on-demand network access to a shared pool of configurable computing resources such as networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services, which can be rapidly provisioned and released with minimal management effort or interaction with the provider of the service. This cloud model includes at least five characteristics, at least three service models, and at least four deployment models.

[0126] The characteristics are as follows:

[0127] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities such as server time and network storage as needed, without the need for human interaction with the service provider.

[0128] Wide area network access: Capabilities are available over a network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms such as mobile phones, laptops, and PDAs.

[0129] Resource pooling: The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned according to demand. There is a location-independent aspect in that consumers generally have no control or knowledge of the exact location of the provided resources, but can still specify a location at a higher level of abstraction such as country, state, or data center.

[0130] Rapid elasticity: In some cases, automatically, the ability to rapidly scale out and rapidly scale in can be provided quickly and elastically. To the consumer, the available capabilities for provisioning generally appear to be unlimited and can be purchased in any quantity at any time.

[0131] Measured service: The cloud system automatically controls and optimizes resource use by leveraging metering capabilities at some level of abstraction appropriate to the type of service such as storage, processing, bandwidth, and active user accounts. Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

[0132] Software as a Service (SaaS): The ability provided to the consumer is to use the vendor's applications running on a cloud infrastructure. The applications can be accessed from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0133] Platform as a Service (PaaS): The ability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications that are created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, or storage, but has control over the deployed applications and possibly the application hosting environment configuration.

[0134] Infrastructure as a Service (IaaS): The ability provided to the consumer is to provide processing, storage, networks, and other fundamental computing resources where the consumer can deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over the operating systems, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0135] The deployment models are as follows:

[0136] Private cloud: The cloud infrastructure is operated only for an organization. In one or more embodiments, it is managed by the organization or a third party and / or exists on-premises or off-premises.

[0137] Community cloud: The cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). In one or more embodiments, it is managed by the organization or a third party and / or exists on-premises or off-premises.

[0138] Public cloud: The cloud infrastructure is available for general public or large industry groups and is owned by an organization that sells cloud services.

[0139] Hybrid cloud: The cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0140] The cloud computing environment is service-oriented, with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the center of cloud computing is an infrastructure of a network including interconnected nodes.

[0141] Now refer toFigure 8 , depicts an illustrative cloud computing environment 50. As shown, cloud computing environment 50 includes one or more cloud computing nodes 10, local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an in-vehicle computer system 54N, which communicate with one or more cloud computing nodes 10 with each other. Additionally, nodes 10 communicate with each other. In one embodiment, these nodes are physically or virtually grouped (not shown) in one or more networks, such as the private cloud, community cloud, public cloud, or hybrid cloud or combinations thereof described above. This allows cloud computing environment 50 to provide infrastructure, platform, and / or software as a service, for which cloud consumers do not need to maintain resources on a local computing device. It should be understood that Figure 8 the types of computing devices 54A-54N shown in

[0142] are only illustrative, and computing node 10 and cloud computing environment 50 can communicate with any type of computing device over any type of network and / or network addressable connection (e.g., using a web browser). Figure 9 , a set of functional abstraction layers provided by cloud computing environment 50 is shown ( Figure 8 ). It should be understood in advance that Figure 9 the components, layers, and functions shown in

[0143] are only illustrative, and embodiments of the present invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0144] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: hosts 61; servers 62 based on RISC (Reduced Instruction Set Computer) architecture; servers 63; blade servers 64; storage devices 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0145] In one example, management layer 80 provides the functions described below. Resource provisioning 81 provides for the dynamic procurement of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 82 provides cost tracking for resource utilization within the cloud computing environment, as well as billing or invoicing for the consumption of those resources. In one example, these resources include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management such that the required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides for the pre-arrangement and procurement of cloud computing resources, where future requirements are anticipated according to the SLA.

[0146] Workload layer 90 provides examples of functions for which the cloud computing environment is used in one or more embodiments. Examples of workloads and functions provided from this layer include: graphics and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis processing 94; transaction processing 95; and vulnerability response processing 96, which performs one or more features of the invention described herein.

[0147] In one or more embodiments, the invention is a system, method, and / or computer program product at any possible level of integration of technical details. In one or more embodiments, the computer program product includes a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of the invention.

[0148] A computer-readable storage medium can be a tangible device that is capable of storing and retaining instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer-readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punched card or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed to be a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through an optical fiber cable), or an electrical signal transmitted through a wire.

[0149] The computer-readable program instructions described herein can be downloaded to a corresponding computing / processing device from a computer-readable storage medium or downloaded to an external computer or an external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the corresponding computing / processing device.

[0150] In one or more embodiments, the computer-readable program instructions for performing the operations of the present invention include assembly instructions, instruction set architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state-setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Java, Smalltalk, C++, etc., and conventional procedural programming languages such as the "C" programming language or similar programming languages. In one or more embodiments, the computer-readable program instructions are executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case and in one or more embodiments, the remote computer is connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, to perform aspects of the present invention, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) executes the computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0151] Aspects of the present invention are described herein with reference to the flowchart and / or block diagram of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It will be understood that each block of the flowchart and / or block diagram, and the combinations of blocks in the flowchart and / or block diagram, can be implemented by computer-readable program instructions.

[0152] In one or more embodiments, the computer-readable program instructions are provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. In one or more embodiments, the computer-readable program instructions are also stored in a computer-readable storage medium that in one or more embodiments directs a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer-readable storage medium in which the instructions are stored comprises an article of manufacture including instructions implementing aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0153] In one or more embodiments, the computer-readable program instructions are also loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process such that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0154] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, can be implemented by special purpose hardware-based systems that perform the specified functions or actions, or combinations of special purpose hardware and computer instructions.

[0155] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising", when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0156] All of the apparatus or steps plus function element corresponding structures, materials, acts, and equivalents in the following claims are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. For purposes of illustration and description, descriptions of various embodiments of the invention have been given, but are not intended to be exhaustive or to limit the invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the invention. The embodiments were chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention with various modifications suited to the particular use contemplated.

[0157] In one or more embodiments of the invention, any method described in this disclosure is implemented by using a VHDL (VHSIC Hardware Description Language) program and a VHDL chip. VHDL is an exemplary design input language for field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), and other similar electronic devices. Thus, in one or more embodiments of the invention, any software-implemented method described herein is simulated by a hardware-based VHDL program and then applied to a VHDL chip, such as an FPGA.

[0158] Embodiments of the invention of this application have been described in detail and by reference to illustrative embodiments thereof, it will be apparent that modifications and variations are possible without departing from the scope of the invention as defined in the appended claims.

Claims

1. A method for protecting computer assets, the method comprising: Receiving a plurality of signatures, wherein different signatures from the plurality of signatures are specific to different computer asset types; Identifying a specific signature from the plurality of signatures, wherein the specific signature is specific to a specific computer asset type, wherein the specific signature is code that causes a specific gateway to block an intrusion from reaching a specific computer asset of the specific computer asset type, and wherein the specific computer asset has a specific asset context specific to the specific computer asset; Extracting the specific signature from the plurality of signatures based on the specific asset context; Identifying a specific gateway for protecting the specific computer asset; And Installing only the specific signature extracted from the plurality of signatures on the specific gateway.

2. The method according to claim 1, wherein the specific computer asset is a database system, and wherein the specific asset context describes a vulnerability level of the database system, an identity of the database system, a host name of a host computer on which the database system runs, and an operating system used by the database system.

3. The method according to claim ​ ​ ​ ​ ​ ​ ​ ​ ​ Identify a specific IPS signature from the plurality of IPS signatures, where the specific IPS signature is specific to a specific computer asset type, where the specific IPS signature is code that causes a specific IPS gateway to block an intrusion from reaching a specific computer asset of the specific computer asset type, and where the specific computer asset has a specific asset context specific to the specific computer asset; Extract the specific IPS signature from the plurality of IPS signatures based on the specific asset context; Identify a specific IPS gateway that protects the specific computer asset; And Install only the specific IPS signature extracted from the plurality of IPS signatures on the specific IPS gateway.

8. The computer program product according to claim 7, where the specific computer asset is a database system, and where the specific asset context describes the vulnerability level of the database system, the identity of the database system, the host name of the host computer on which the database system runs, and the operating system used by the database system.

9. The computer program product according to claim 7, where the specific asset is a database program, and where the specific asset context describes the vulnerability level of the database program, the identity of the database program, the host name of the host computer on which the database program runs, the database system used by the database program, and the operating system used by the database system.

10. The computer program product according to claim 7, where the method further comprises: Performing natural language processing (NLP) analysis on a set of vulnerabilities to extract risk-related information, where the set of vulnerabilities describes vulnerabilities applied to the specific IPS gateway, and where the risk-related information includes a list of vulnerable network resources protected by the specific IPS gateway and vulnerable to the intrusion attack.

11. The computer program product according to claim 7, where the vulnerability of the specific computer asset to the intrusion is from a set of identified vulnerabilities, and where the set of identified vulnerabilities is identified in a Common Vulnerabilities and Exposures (CVE) list generated by a third party monitoring vulnerabilities of multiple computer systems.

12. The computer program product according to claim 7, where the method further comprises: Training the DNN to identify the specific IPS gateway by inputting known training signatures and known training asset contexts into a deep neural network (DNN); And Identifying the specific IPS gateway by inputting the specific asset context and the extracted specific signature into the trained DNN.

13. The computer program product according to claim 7, where the program code is provided as a service in a cloud environment.

14. A computer system includes one or more processors, one or more computer-readable memories, and one or more computer-readable non-transitory storage media, and program instructions stored on at least one of the one or more computer-readable non-transitory storage media for execution by at least one of the one or more processors via at least one of the one or more computer-readable memories, the stored program instructions being executed to perform a method, the method including: Receiving a plurality of Intrusion Prevention System (IPS) signatures, wherein different IPS signatures from the plurality of IPS signatures are specific to different types of IPS gateways protecting different computer asset types; Identifying a specific IPS signature from the plurality of IPS signatures, wherein the specific IPS signature is specific to a specific computer asset type, wherein the specific IPS signature is code that causes a specific IPS gateway to block an intrusion from reaching a specific computer asset of the specific computer asset type, and wherein the specific computer asset has a specific asset context specific to the specific computer asset; Extracting the specific IPS signature from the plurality of IPS signatures based on the specific asset context; Identifying a specific IPS gateway that protects the specific computer asset; And Installing only the specific IPS signature extracted from the plurality of IPS signatures on the specific IPS gateway.

15. The computer system of claim 14, wherein the specific computer asset is a database system, and wherein the specific asset context describes the vulnerability level of the database system, the identity of the database system, the hostname of the host computer on which the database system runs, and the operating system used by the database system.

16. The computer system of claim 14, wherein the specific asset is a database program, and wherein the specific asset context describes the vulnerability level of the database program, the identity of the database program, the hostname of the host computer on which the database program runs, the database system used by the database program, and the operating system used by the database system.

17. The computer system according to claim 14, wherein the method further includes: Performing a Natural Language Processing (NLP) analysis on a set of vulnerabilities to extract risk-related information, wherein the set of vulnerabilities describes vulnerabilities applied to the specific IPS gateway, and wherein the risk-related information includes a list of vulnerable network resources protected by the specific IPS gateway and vulnerable to the intrusion attack.

18. The computer system of claim 14, wherein the vulnerability of the specific computer asset to the intrusion is from a set of identified vulnerabilities, and wherein the set of identified vulnerabilities is identified in a Common Vulnerabilities and Exposures (CVE) list generated by a third party monitoring vulnerabilities of multiple computer systems.

19. The computer system according to claim 14, wherein the method further includes: The DNN is trained to identify the specific IPS gateway by inputting a known training signature and a known training asset context into a deep neural network (DNN). And The specific IPS gateway is identified by inputting the specific asset context and the extracted specific signature into the trained DNN.

20. The computer system according to claim 14, wherein the program instructions are provided as a service in a cloud environment.

Images