(12) Ullltfild States Patent (10) Patent No.: US 7,954,159 B2 Hrabik et al. 45 Date of Patent: *Ma 31 2011 a (54) METHOD AND APPARATUS FOR VERIFYING (56) References Cited THE INTEGRITY AND SECURITY OF COMPUTER NETWORKS AND U.S. PATENT DOCUMENTS IMPLEMENTING COUNTER MEASURES 7,131,769 Bl * 2/2007 Keanini et al, ,,,,,,,,,,,,,,,, H 726/23 7,215,637 Bl * 5/2007 Ferguson et al. .. 370/230.1 (75) Inventors: Mike Hrabik, Omaha, NE (U S); Jeffrey : gigyfisgigp Guilfoyle, Omaha, NE (US); Edward 7:712:137 B2,. 5/2010 Meier 11111111 726/25 Mac Beaver, Omaha, NE (US) 7,788,722 Bl * 8/2010 Njemanze et al. 726/23 7,861,299 Bl * l2/2010 Tidwell et al. ................ .. 726/22 (73) Assignee: Solutionary Inc., Omaha, NE (U S) FOREIGN PATENT DOCUMENTS ( * ) Notice: Subject to any disclaimer, the term of this JP 00004700 0/1000 patent is extended or adjusted under 35 OTHER PUBLICATIONS U'S'C' 154(0) by 0 d0yS' Japanese Office Action dated Dec. 18, 2007 in Japanese counterpart This patent is Subject to a tenninal dis- application No. 2002-56033 lwith translation. Proceedings of JourClaimep nal ofNikkei Internet Technology, vol. 39, P140-145, Japan, Nikkei Business Publication, Inc., Oct. 2000, with relevant partial English (21) Appl. No.: 12/115,147 ‘m“S1a“_°“ °f Fig Z _ _ Johna Till Johnson, “Simulated Attack for Real Network Security”, P d' fD t C ' t' , .3l-32,N .2l,l995. May 5, fOC€€ lIlgS O 3. 3. OI1']I1'lLlIllC3. IOIIS OV * cited by examiner (65) Prior Publication Data _ _ _ Primary Examiner — Syed A. Zia Us 2008/0244745 A1 Oct 2= 2008 (74) Attorney, Agent, 0r Firm — Ostrolenk Faber LLP Related U.S. Application Data (57) ABSTRACT (63) Continuation of application No. ll/070,022, filed on A System Securing 3 Computer neWVO_rk having Variolls Map 21 20051 pow pap Na 7137013591 Wliicli is a devices connected thereto. The system includes a security Continuation of application Na ll)/l 9614721 filed on subsystem connected to the devices in the network, a master ]u1_ l6, 20021 110W pap Na 619331208’ which is a security system, and a first communication medium conCOntinuatiOn_in_part of application Na ()9/77015251 nected between the security subsystem and the master secufiled O11 jap_ 25’ 2()0l1 110W pap Na 71l681093_ rity system. The network devices generate event messages when under attack. The security subsystem generates multiple views, each view including a subset of the event mes(51) Int. Cl. . . sages generated by the devices. The security subsystem G00F 21/24 (200001) includes an event anal zer which anal zes the event mesG00F 21/00 (200001) sa es across multi le v0iews to detennin0e if an of the assoG06F 12/14 (2006.01) .g P . Y ciated events exceeds a predetermined threshold. The master G06F 12/16 (2006.01) . . . . security system receives the associated events, which exceed (52) U.S. Cl. ............ .. 726/23, 726/22, 726/25, 713/188, the predetennined threshold, from the Security Subsystem 713/189 through the first communication medium. (58) Field of Classification Search ...................... .. None
