DESC:BACKGROUND
[0001] Embodiments of the present disclosure relate to security events and more particularly to a system and method for generating an alert for security events in real-time.
[0002] The security event is a change in the operation of a network or information or data which indicates that the security policy is being violated or a security safeguard is failed. The security events include one or more occurrences which is significant to a security of a system or a data.
[0003] In one approach, the system uses a security event and event management technology to provide analysis of security events generated by network hardware and an application on a computer device. Further the system may detect the generated alerts by analysing the security events. The analysed security alerts is further displayed on a user interface module. However, the system does not automatically display the analysed security events as the user must manually select and prioritise the security events to be displayed.
[0004] In another approach, the system uses one or more of machine learning models to detect and alert the user regarding the security events of the system and the network in real-time. Further the system displays the detected security events in a form of a message or a warning on the user interface display. However, the system does not display the security alerts automatically on the user interface display. Also such systems make the display complicated for the user to understand and solve the occurred security events.
[0005] Hence, there is a need for an improved system and method for generating an alert for security events in real-time to address the aforementioned issue.
BREIF DESCRIPTION
[0006] In accordance with one embodiment of the disclosure, a system and method for generating an alert for security events in real-time are disclosed. The system includes a first detection module configured to detect a plurality of security events occurring in one or more devices. The system also includes a second detection module operatively coupled to the first detection module, wherein the second detection module includes a plurality of sensors configured to detect the plurality of security events occurring in one or more servers. The system also includes a processing subsystem operatively coupled to the first detection module and the second detection module and configured to receive the plurality of security events from the first detection module and the second detection module. The processing subsystem is also configured to analyse a plurality of received security events using one or more first machine learning models. The processing subsystem is further configured to prioritising a plurality of analysed security events based on one or more second machine learning models. The processing subsystem is further configured to generate one or more alerts to a user based on a plurality of prioritized security events. The system further includes a user interface module operatively coupled to the processing subsystem and configured to display a plurality of generated security alerts.
[0007] The method for generating an alert for security events in real-time includes detecting a plurality of security events occurring in one or more devices and one or more servers. The method also includes receiving a plurality of detected security events. The method further includes analysing a plurality of received security events. The method further includes prioritising a plurality of analysed security events. The method further includes generating one or more alerts based on a plurality of prioritized security events. The method further includes displaying a plurality of generated security events.
[0008] To further clarify the advantages and features of the present disclosure, a more particular description of the disclosure will follow by reference to specific embodiments thereof, which are illustrated in the appended figures. It is to be appreciated that these figures depict only typical embodiments of the disclosure and are therefore not to be considered limiting in scope. The disclosure will be described and explained with additional specificity and detail with the appended figures.
BRIEF DESCRIPTION OF THE DRAWINGS
The disclosure will be described and explained with additional specificity and detail with the accompanying figures in which:
[0009] FIG. 1 is a block diagram of a system for generating an alert for security events in real-time in accordance with an embodiment of the present disclosure;
[0010] FIG. 2 is a schematic representation of an embodiment of the system for generating an alert for security events in real-time of FIG. 1 in accordance with an embodiment of the present disclosure;
[0011] FIG. 3 is a schematic representation of an exemplary embodiment of a display of the security events on a user interface module of FIG. 1 in accordance with an embodiment of the present disclosure;
[0012] FIG. 4 is a block diagram of a computer or a server in accordance with an embodiment of the present disclosure; and
[0013] FIG. 5 is a process flow for generating an alert for security events in real-time in accordance with the embodiment of the present disclosure.
[0014] Further, those skilled in the art will appreciate that elements in the figures are illustrated for simplicity and may not have necessarily been drawn to scale. Furthermore, in terms of the construction of the device, one or more components of the device may have been represented in the figures by conventional symbols, and the figures may show only those specific details that are pertinent to understanding the embodiments of the present disclosure so as not to obscure the figures with details that will be readily apparent to those skilled in the art having the benefit of the description herein.
DETAILED DESCRIPTION
[0015] For the purpose of promoting an understanding of the principles of the disclosure, reference will now be made to the embodiment illustrated in the figures and specific language will be used to describe them. It will nevertheless be understood that no limitation of the scope of the disclosure is thereby intended. Such alterations and further modifications in the illustrated system, and such further applications of the principles of the disclosure as would normally occur to those skilled in the art are to be construed as being within the scope of the present disclosure.
[0016] The terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process or method that comprises a list of steps does not include only those steps but may include other steps not expressly listed or inherent to such a process or method. Similarly, one or more devices or sub-systems or elements or structures or components preceded by "comprises... a" does not, without more constraints, preclude the existence of other devices, sub-systems, elements, structures, components, additional devices, additional sub-systems, additional elements, additional structures or additional components. Appearances of the phrase "in an embodiment", "in another embodiment" and similar language throughout this specification may, but not necessarily do, all refer to the same embodiment.
[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this disclosure belongs. The system, methods, and examples provided herein are only illustrative and not intended to be limiting.
[0018] In the following specification and the claims, reference will be made to a number of terms, which shall be defined to have the following meanings. The singular forms “a”, “an”, and “the” include plural references unless the context clearly dictates otherwise.
[0019] Embodiments of the present disclosure relate to a system and method for generating an alert for security events in real-time. The system includes a first detection module configured to detect a plurality of security events occurring in one or more devices. The system also includes a second detection module operatively coupled to the first detection module, wherein the second detection module includes a plurality of sensors configured to detect the plurality of security events occurring in one or more servers. The system also includes a processing subsystem operatively coupled to the first detection module and the second detection module and configured to receive the plurality of security events from the first detection module and the second detection module. The processing subsystem is also configured to analyse a plurality of received security events using one or more first machine learning models. The processing subsystem is further configured to prioritising a plurality of analysed security events based on one or more second machine learning models. The processing subsystem is further configured to generate one or more alerts to a user based on a plurality of prioritized security events. The system further includes a user interface module operatively coupled to the processing subsystem and configured to display a plurality of generated security alerts.
[0020] FIG. 1 is a block diagram of a system for generating an alert for security events in real-time in accordance with an embodiment of the present disclosure. The system (10) for generating an alert for security events at real-time includes a first detection module (15). The first detection module (15) is configured to detect a plurality of security events occurring in one or more devices. In one embodiment, the first detection module (15) may be a host-based intrusion detect system (HIDS). As used herein, the HIDS is a type of detection system for detecting a plurality of intrusions or the plurality of security events which is occurred in a computer device or on a plurality of network packets on a network of the computer device. In another embodiment, one or more devices may be one or more hand held devices such as a mobile phone, a laptop or a tablet. In yet another embodiment, one or more devices may be one or more computer devices.
[0021] The system (10) also includes a second detection module (20) operatively coupled to the first detection module (15). The second detection module (20) includes a plurality of sensors (25) configured to detect the plurality of security events occurring in one or more servers. In one embodiment, the second detection module (20) may be a network-based intrusion detect system (NIDS). As used herein, the NIDS is a type of detection system which is placed at one or more strategic points to monitor traffic of the network in one or more devices. In another embodiment, the plurality of sensors (25) may be----. In yet another embodiment, the plurality of sensors (25) may be configured to sense or detect one or more intrusions in an ethernet interface with the server. In yet another embodiment, the plurality of sensors (25) may also be configured to constantly analyse a plurality of data packets which may be captured by the ethernet interface.
[0022] The system (10) also includes a processing subsystem (30) operatively coupled to the first detection module (15) and the second detection module (20). The processing subsystem (30) is configured to receive the plurality of security events from the first detection module (15) and the second detection module (20). In one embodiment, the processing subsystem (30) may be a collector configured to collect the plurality of security events from the first detection module (15) and the second detection module (20).
[0023] The processing subsystem (30) is also configured to analyse a received plurality of security events using one or more first machine learning models. In one embodiment, if any of the received plurality of security events may be found suspicious by the first detection module (15) and the second detection module (20) then the processing subsystem (30) may receive the plurality of security events in a specific pattern or a specific format. In another embodiment, the processing subsystem (30) may us a web based analytics to analyse the plurality of received security events.
[0024] The processing subsystem (30) is further configured to prioritise a plurality of analysed security events based on one or more second machine learning models. In one embodiment, the plurality of security events may be prioritized based on the importance of each of the plurality of security events which may be decided by a machine learning model or a predefined event.
[0025] The processing subsystem (30) is further configured to generate one or more alerts to a user based on a plurality of prioritized security events. In one embodiment, the alert may be in the form of a message, a mail or a popup on a user interface. In another embodiment, the processing subsystem (30) may generate an alert with a bold context or a coloured context on the user interface.
[0026] The system (10) further includes a user interface module (35) operatively coupled to the processing subsystem (30). The user interface module (35) is configured to display a plurality of generated security alerts. In one embodiment, the user interface module (35) may be one or more dashboards on one or more devices to display the plurality of generated security alerts. In another embodiment, the user interface module (35) may include a plurality of dashboards which may characterise the plurality of security events based on one or more parameters such as a source of each of the plurality of security events or a category of each of the plurality of security events. In yet another embodiment, the user interface module (35) may assign a fraction of a display which may display the plurality of security events. In such embodiment, the user may select or prioritise the plurality of displayed security events.
[0027] In one specific embodiment, the system (10) may further include a plurality of filters operatively coupled to the processing subsystem (30). The plurality of filters may be configured to filter and sort the received plurality of security events. In such embodiment, the plurality of filtered and sorted security events may be a source internet protocol, a destination internet protocol, a source port, a destination port, a severity of the plurality of security events or a category of the plurality of security events.
[0028] In another specific embodiment, the system (10) may include a database operatively coupled to the processing subsystem (30). The database may be configured to store the plurality of security events. In such embodiment, the database may be a hardware storage device on the computer system. In another embodiment, the plurality of security events may be stored in a cloud database. In such embodiment, the first detection module (15) and the second detection module (20) may send a plurality of information about the plurality of suspicious events to the processing subsystem (30), wherein the processing subsystem (30) may analyse a plurality of received information about the plurality of suspicious events and may store the analysis and the received information in the database for further analysis or detection of the plurality of security events.
[0029] FIG. 2 is a schematic representation of an embodiment of the system for generating an alert for security events in real-time of FIG. 1 in accordance with an embodiment of the present disclosure. The system (50) includes an intrusion detection module (55), wherein the intrusion detection module (55) includes a plurality of sensors (60), an event collector (65), and an analysis dashboard (70), wherein the analysis dashboard (70) includes a watch list (75). Further, the intrusion detection module (55) is substantially similar to the first detection module (15) and the second detection module (20) of FIG. 1. The event collector (65) is substantially similar to the processing subsystem (30) of FIG. 1. The analysis dashboard (70) is substantially similar to the user interface module (35) of FIG. 1. The plurality of sensors (60) coupled to the intrusion detection module (55) is substantially similar to the plurality of sensors (25) coupled to the second detection module (20) of FIG. 1.
[0030] The intrusion detection module (55) is configured to receive the plurality of security events from one or more devices or the network. In one embodiment one or more devices may be one or more host devices such as a computer device. In another embodiment, the intrusion detection module (55) is constantly running inside an operating system of one or more devices, on an application which is installed on one or more devices or one or more logs which will detect the plurality of security events that occurs in the network or one or more devices. Further the instruction detection module (55) includes a host-based intrusion detection system (HIDS) and a network-based intrusion detection system (NIDS) which is operatively connected to the HIDS and a plurality of sensors operatively connected to the NIDS.
[0031] Further, the plurality of security events which are found to be suspicious are transferred into the event collector (65) in a specific format. In one embodiment, the plurality of suspicious events may be a plurality of suspicious packets of data in the network or one or more log entry in the network or one or more devices. In another embodiment, event collector (65) may be a machine learning model which may be running and listening on a specific internet protocol (IP) or on one or more ports of the one or more devices.
[0032] Further, the HIDS and NIDS sends a plurality of information about the plurality of detected security events to the event collector. Further, the event collector (65) analyses the received plurality of security events and also stores the received plurality of security events for further analysis and alerts. The intrusion detection module (55) on detection and analysis of the received plurality of security events will display the analysed plurality of security events on the analysis dashboard (70). The analysis dashboard (70) provides web based analytics which makes the user view the plurality of security events happing in the network or the servers and each of one or more devices. In one embodiment, the plurality of filters may be used to filter or sort the plurality of security events which may be recorded and analysed by the event collector which may be displayed on the analysis dashboard (70). Further, the plurality of security events is displayed on the watch list (75) of the analysis dashboard (70) of one or more devices. As used herein, the watch list is an area on the analysis dashboard (70) to view the plurality of security events in real-time. In one embodiment, the alert may be displayed on the analysis dashboard (70) as soon as a new security event occurs which may be related to the plurality of security events in the watch list (75). In another embodiment, the user may add or remove one or more security events from the plurality of security events from the watch list (75). In such embodiment, one or more security events may be removed from the watch list (75) by clicking a remove button on the analysis dashboard (70).
[0033] Further, the watch list (75) will be displayed on a top right-hand part of the analysis dashboard (70). The watch list (75) can be maximized by clicking on an icon of the watch list (75). In one embodiment, the user may click a minimize button on the analysis dashboard (70) which may minimize the watch list (75) to a default size.
[0034] In one embodiment, the user may log into the system (50). Further on logging into the system (50), the user may select an analysis dashboard (70) from the plurality of dashboards. Further, the user may identify the plurality of security events which may be received and stored by the event collector (65). In such embodiment, the user may add a security event to the watch list (75) using a drop down menu displayed on a selected analysis dashboard (70). Further, the system (70) may use a plurality of machine learning model to filter the plurality of IP which may be mentioned in the plurality of security events and may be added to the watch list (75). Further, the user may receive a notification on the analysis dashboard (70) displaying the plurality of security events added to the watch list (75).
[0035] FIG. 3 is a schematic representation of an exemplary embodiment of a display of the security events on a user interface module of FIG. 1 in accordance with an embodiment of the present disclosure. The plurality of security events which are received are further analysed. The plurality of analysed security events are further generated as alerts on one or more user interface module. In one embodiment, the user interface module may be a display on a user device. The display includes a watch list which may be selected by the user or generated by the event collector. The watch list includes a plurality of entry based on the plurality of first machine learning model and the second learning model. The watch list also includes a column to display a count. In one embodiment, the count may be the number of times each of the plurality of events occurred in one or more devices or in the network.
[0036] The watch list also includes a column which displays last observed. In one embodiment, last observed may be a date and time which may tell when each of the plurality of events have occurred. The watch list also displays a column for an action. In one embodiment, the action may be responding to each of the plurality of security events occurred by the user. In such embodiment, the user may respond to the displayed alert of the plurality of security events or may delete the alert which may be displayed on the watch list.
[0037] FIG. 4 is a block diagram of a computer or a server in accordance with an embodiment of the present disclosure. The exemplary system (100) for generating an alert for security events at real-time (10) includes a general-purpose computing device in the form of a computer (100) or a server or the like. The computer (100) includes including a processing unit (110) substantially similar to the processing subsystem (25) of FIG. 1, and configured to analyse and generate alerts for the received security events, a system memory (120) configured to store the plurality of internal data sets and the plurality of external data sets. The computer (100) also includes a system bus (130) that couples various system components including the system memory (100) to the processing unit (110).
[0038] The system bus (130) may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. The system memory (120) includes read-only memory (ROM) (140) and random access memory (RAM) (150). A basic input/output system (BIOS) (160), containing the basic routines that help transfer information between elements within the computer (100), such as during start-up, is stored in ROM (140).
[0039] The computer (100) may further include a hard disk drive for reading from and writing to a hard disk, not shown, a magnetic disk drive for reading from or writing to a removable magnetic disk, and an optical disk drive for reading from or writing to a removable optical disk such as a CD-ROM, DVD-ROM or other optical media.
[0040] The hard disk drive, magnetic disk drive, and optical disk drive30 are connected to the system bus by a hard disk drive interface (220), a magnetic disk drive interface (230), and an optical drive interface (240), respectively. The drives and their associated computer-readable media provide non-volatile storage of computer readable instructions, data structures, program modules and other data for the computer (100) to the various results generated from the data processing unit (110).
[0041] Although the exemplary environment described herein employs a hard disk, a removable magnetic disk and a removable optical disk, it should be appreciated by those skilled in the art that other types of computer readable median that can store data that is accessible by a computer, Such as magnetic cassettes, flash memory cards, digital video disks, Bernoulli cartridges, random access memories (RAMS), read-only memories (ROMs) and the like may also be used in the exemplary operating environment.
[0042] A number of program modules may be stored on the hard disk, magnetic disk, optical disk, ROM (140) or RAM (150), including an operating system (250). The computer (100) includes a file system (170) associated with or included within the operating system (250), one or more application programs (260), other program modules (270) and program data (280). A user may enter commands and information into the computer (100) through input devices (290) such as a keyboard and pointing device. Other input devices (not shown) may include a microphone, joystick, game pad, Satellite dish, Scanner or the like.
[0043] These and other input devices are often connected to the data processing unit (110) through a serial port interface (300) that is coupled to the system bus, but may be connected by other interfaces, such as a parallel port, game port or universal serial bus (USB). A monitor (310) or other type of display device is also connected to the system bus (130) via an interface. Such as a video adapter (320). In addition to the monitor (310), personal computers typically include other peripheral output devices (not shown), such as speakers and printers.
[0044] The computer (100) may operate in a networked environment using logical connections to one or more remote computers (330). The one or more remote computer (330) may be another computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer (100), although only a memory storage device (340) has been illustrated. The logical connections include a local area network (LAN) (350) and a wide area network (WAN) (360). Such networking environments are common place in offices, enterprise-wide computer networks, Intranets and the Internet.
[0045] When used in a LAN (350) networking environment, the computer (100) is connected to the local network (350) through a network interface or adapter (370). When used in a WAN (360) networking environment, the computer (100) typically includes a modem (380) or other means for establishing communications over the wide area network (360), such as the Internet.
[0046] The modem (380), which may be internal or external, is connected to the system bus (130) via the serial port interface (300). In a networked environment, program modules depicted relative to the computer (100), or portions thereof, may be stored in the remote memory storage device. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.
[0047] FIG. 5 is a process flow for generating an alert for security events in real-time in accordance with the embodiment of the present disclosure. A method (500) for generating an alert for security events at real-time includes detecting a plurality of security events occurring in one or more devices and one or more servers (510). In one embodiment, the plurality of security events may be detected using a plurality of intrusion detection systems such as the HIDS and the NIDS.
[0048] The method (500) also includes receiving a plurality of detected security events (520). In one embodiment, the detected plurality of security events may be sent to the processing subsystem to analyse and sort the detected plurality of security events.
[0049] The method (500) further includes analysing a plurality of received security events (530). In one embodiment, the received plurality of security events must be analysed and studied to discard or to sort the plurality of security events which may alter the functioning of one or more devices or one or more networks.
[0050] The method (500) further includes prioritising a plurality of analysed security events (540). In one embodiment, the plurality of analysed events may be prioritized based on the category or a risk factor of each of the plurality of security alerts.
[0051] The method (500) further includes generating one or more alerts based on a plurality of prioritized security events (550). In one embodiment, one or more alert may be a message or a mail.
[0052] The method (500) further includes displaying a plurality of generated security events (560). In one embodiment, the plurality of generated security events may be displayed on the user interface module. In another embodiment, the plurality of generated security events may be displayed on the user interface module in the form of an animation.
[0053] Various embodiments of the system described above enable the system to automatically generate the plurality of security events on the display of the user device in real-time.
[0054] Also the system displays the plurality of security events automatically based on the priority of the plurality of the security events occurred which makes the system user friendly and more reliable.
[0055] The figures and the foregoing description give examples of embodiments. Those skilled in the art will appreciate that one or more of the described elements may well be combined into a single functional element. Alternatively, certain elements may be split into multiple functional elements. Elements from one embodiment may be added to another embodiment. For example, order of processes described herein may be changed and are not limited to the manner described herein. Moreover, the actions of any flow diagram need not be implemented in the order shown; nor do all of the acts need to be necessarily performed. Also, those acts that are not dependent on other acts may be performed in parallel with the other acts. The scope of embodiments is by no means limited by these specific examples.
,CLAIMS:WE CLAIM:
1. A system (10) for generating an alert for security events at real-time comprising:
a first detection module (15) configured to detect a plurality of security events occurring in one or more devices;
a second detection (20) module operatively coupled to the first detection module (15), wherein the second detection module (20) comprising:
a plurality of sensors (25) configured to detect the plurality of security events occurring in one or more servers.
a processing subsystem (30) operatively coupled to the first detection module (15) and the second detection module (20) and configured to:
receive the plurality of security events from the first detection module (15) and the second detection module (20);
analyse a plurality of received security events using one or more first machine learning models;
prioritise a plurality of analysed security events based on one or more second machine learning models; and; and
generate one or more alerts to a user based on a plurality of prioritized security events.
a user interface module (35) operatively coupled to the processing subsystem (30) and configured to display a plurality of generated security alerts.
2. The systems (10) as claimed in claim 1, wherein the first detection module (15) comprises a host-based intrusion detect system (HIDS).
3. The systems (10) as claimed in claim 1, wherein the second detection module (20) comprises a network-based intrusion detect system (NIDS).
4. The systems (10) as claimed in claim 1, wherein the user interface module (35) comprises one or more dashboards on one or more devices to display the plurality of generated security alerts.
5. The systems (10) as claimed in claim 1, further includes a plurality of filters operatively coupled to the processing subsystem (30) and configured to filter and sort the plurality of received security events.
6. The systems (10) as claimed in claim 5, wherein a plurality of filtered and sorted security events comprises a source internet protocol, a destination internet protocol, a source port, a destination port, a severity of the plurality of security events or a category of the plurality of security events.
7. The systems (10) as claimed in claim 1, further includes a database operatively coupled to the processing subsystem (30) and configured to store the plurality of security events.
8. A method (500) for generating an alert for security events at real-time comprising:
detecting a plurality of security events occurring in one or more devices and one or more servers;
receiving a plurality of detected security events;
analysing a plurality of received security events;
prioritising a plurality of analysed security events;
generating one or more alerts based on a plurality of prioritized security events; and
displaying a plurality of generated one or more alerts.
9. The method (500) as claimed in claim 8, wherein displaying a plurality of generated security events comprises displaying the plurality of generated security events on a user interface module.
10. The method (500) as claimed in claim 8, wherein displaying the plurality of generated security events comprises displaying the plurality of security events in a form of an animation.