System and method for web-based log analysis

Patent metadata

Field	Value
Publication number	US-9876813-B2
Application number	US-201514619423-A
Country	US
Kind code	B2
Filing date	Feb 11, 2015
Priority date	Feb 11, 2015
Publication date	Jan 23, 2018
Grant date	Jan 23, 2018

Abstract

The technology described herein provides a novel system and method for web-based log analysis. The analysis combines the benefits of typical log monitoring systems with those of typical vulnerability managements systems. The synergy of the combined log monitoring and vulnerability management results in a single provider detecting vulnerability and subsequently accessing archived log data to detect if the vulnerability has been exploited in the past, identifying compromised machines for customers.

First claim

What is claimed is:

1. A method for web-based log analysis comprising the steps of:
receiving log data from one or more devices, wherein the log data is received from the one or more devices by a log management appliance;
determining a vulnerability actually exists at a device, the device being one of the one or more devices;
after determining the vulnerability actually exists at the device, determining a trace related to the vulnerability actually existing at the device, wherein determining the trace comprises:
executing an exploit related to the vulnerability actually existing at the device;
monitoring the log data created responsive to executing the exploit;
generating the trace based upon the log data;
scanning the log data for the trace;

in response to finding the trace in the log data, determining the device is vulnerable to or has been compromised by the exploit related to the vulnerability actually existing at the device; and
transmitting the log data to a storage, wherein the log data is transmitted from the log management appliance to the storage via a uni-directional channel between the log management appliance and the storage, wherein the uni-directional channel prevents access to the log data in the storage, and
wherein the log data is stored in the storage.

2. The method of claim 1 , wherein the storage comprises cloud based storage.

3. The method of claim 1 , wherein determining the vulnerability actually exists comprises scanning the one or more devices for vulnerabilities using data from a vulnerability database.

4. The method of claim 3 , wherein determining the trace related to the vulnerability comprises retrieving the trace from the vulnerability database.

5. The method of claim 1 , further comprising in response to finding the trace in the log data, providing a notification to a user of the device.

6. The method of claim 3 , further comprising writing the trace to an entry in the vulnerability database, the entry corresponding to the vulnerability.

7. The method of claim 3 , wherein the vulnerability database comprises a plurality of entries, each entry corresponding to a vulnerability, each entry comprising an identifier, a signature, and a trace.

8. The method of claim 1 , wherein the trace comprises an indicator that the device is vulnerable to the exploit related to the vulnerability.

9. The method of claim 1 , further comprising in response to finding the trace in the log data, providing a notification to a user of the device, wherein the user of the device accesses, using an analysis device, and via a bi-directional channel between the analysis device and the storage, the log data in the storage.

10. The method of claim 1 , wherein receiving the log data from the one or more devices comprises both actively soliciting the log data based on requests being transmitted to first devices of the one or more devices and passively receiving the log data without requests being transmitted to second devices of the one or more devices.

11. A system for web-based log analysis comprising:
one or more hardware processors configured to:
receive log data from one or more devices, wherein the log data is received from the one or more devices by a log management appliance;
determine a vulnerability actually exists at a device, the device being one of the one or more devices;
after determining the vulnerability actually exists at the device, determine a trace related to the vulnerability actually existing at the device, wherein determining the trace comprises:
executing an exploit related to the vulnerability actually existing at the device;
monitoring the log data created responsive to executing the exploit;
generating the trace based upon the log data;
scan the log data for the trace;

in response to finding the trace in the log data, determine the device has is vulnerable to or has been compromised by the exploit related to the vulnerability actually existing at the device; and
transmit the log data to a storage, wherein the log data is transmitted from the log management appliance to the storage via a uni-directional channel between the log management appliance and the storage, wherein the uni-directional channel prevents access to the log data in the storage, and
wherein the log data is stored in the storage.

12. The system of claim 11 , wherein the storage comprises a cloud based storage.

13. The system of claim 11 , wherein the one or more processors is further configured to scan the one or more devices for vulnerabilities using data from a vulnerability database.

14. The system of claim 13 , wherein the one or more processors is further configured to retrieve the trace from the vulnerability database.

15. The system of claim 11 , wherein the one or more processors is further configured to in response to finding the trace in the log data, provide a notification to a user of the device.

16. The system of claim 13 , wherein the one or more processors is further configured to write the trace to an entry in the vulnerability database, the entry corresponding to the vulnerability.

17. The system of claim 13 , wherein the vulnerability database comprises a plurality of entries, each entry corresponding to a vulnerability, each entry comprising an identifier, a signature, and a trace.

Assignees

• Qualys Inc

Inventors

• Harutyunyan Artem
• Sarwate Amol R
• Thakar Sumedh
• Shema Michael P

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title