US 7895641

Patent Overview: US 7,895,641 B2

Title: Method and system for dynamic network intrusion monitoring, detection and response

Assignee (current, per listing): BT Americas Inc; original assignee BT Counterpane Internet Security Inc. (I do not characterize transfers.)

Key dates: Priority 2000-03-16; application US11/551,606 filed 2006-10-20; published as US20070162973A1 on 2007-07-12; granted 2011-02-22; listed legal status "Expired – Lifetime," adjusted expiration 2023-06-11 (status as listed, not a legal conclusion).

Inventors: Bruce Schneier, Andrew H. Gross, Jonathan D. Callas.

Purpose: The excerpt frames the invention as a supplement to, not replacement for, a customer's preventive security products (firewalls, servers, routers, intrusion detection systems). Such products "can generate millions of lines of audit information each day," within which "may be the footprints of ongoing network attacks or intrusions." The system helps filter and analyze that audit information in effectively real time, using human intelligence and trained personnel, to detect and respond to breaches.

Plain-language scope (per the excerpt): The disclosed methods and systems support a managed security monitoring ("MSM") service in which a probe or "sentry" system monitors customer network activity, collects status data from monitored components, filters/analyzes the data for possible security concerns, and alerts trained security analysts at secure operations centers ("SOCs"), who then guide the customer through an appropriate response with follow-up as needed. Analysts draw on security intelligence databases covering product characteristics, known vulnerabilities, hacker tools, and effective/ineffective responses; these databases can be continually updated. The service may be customized dynamically or off-line to reflect network-specific needs and real-world response feedback. Data filtering and analysis can include "cross-product analysis," correlating multiple sensor readings as reflecting the same event. SOCs connect to customer networks preferably through cryptographically secured tunnels ("pipes"/"pathways"), with no other interconnection and physical hardening; multiple geographically separated SOCs may be used. Security analysts would preferably pass background checks and be bonded.

Source: https://patents.google.com/patent/US7895641/en

What the excerpt does not establish: The full claim language and claim scope; the detailed components of the probe/sentry system; the specific filtering, escalation, and response procedures; the remaining listed components of the "exemplary implementation"; and the text of the background section. This overview relies solely on the supplied excerpt.