Detektion von Fortgeschrittener, Andauernder Bedrohung

Details

Veröffentlichungs-Nr.

EP3171567

Aktenzeichen

EP15306850

Anmeldetag

23. November 2015

Veröffentlichung

24. Oktober 2018

Erteilung

24. Oktober 2018

Rechtsraum

EP

IPC

H04L29/06G06F21/56

Abstract

For detecting persistent attack in an information system infrastructure comprising resources that are associated with sensors able to send notifications to a management device, the notifications comprising a report on the access of the associated resources, the method comprising the following steps in the management device (MD): evaluating (S1) a threat level for an ongoing attack detected for a given set of resources in function of received notifications having low weight in the evaluation of the threat level, if the threat level is smaller than an entrapment threshold, activating (S2) sensors associated with resources of the information system infrastructure that are potential subsequent targets of the ongoing attack, setting the weight of the notifications sent from the activated sensors as average weight in the evaluation of the threat level, and evaluating the threat level for the ongoing attack further in function of received notifications sent from the activated sensors, if the threat level is greater than the entrapment threshold, deploying (S3) traps in the information system infrastructure, the traps being potential subsequent targets of the ongoing attack and able to send notifications to the management device, and setting the weight of the notifications sent from the deployed traps as high weight in the evaluation of the threat level, and evaluating the threat level for the ongoing attack further in function of received notifications sent from the deployed traps.

Anmelder

Firmen

Alcatel Lucent
ALCATEL LUCENT

Land

🇫🇷 Frankreich

Fachgebiete