DYNAMIC PROVISIONING OF PROTECTION SOFTWARE IN A HOST INTRUSION PREVENTION SYSTEM

摘要

Methods and apparatus for optimizing security configurations of a set ofcomputers are disclosed. A set of local servers, each functioning as a deep-securitymanager supporting a respective subset of the computers, maintains protectionsoftware containing filters and rules for deploying each filter. A localserver receivesupdated protection software from a central server. Each local serverinterrogates eachcomputer of its subset of computers to acquire computer-characterizing dataandapplies relevant rules to determine an optimal set of filters for eachcomputer. Each ruleadaptively determines required characterizing data elements from each computerfordetermining an optimal security configuration. A local server updates thesecurityconfiguration of a computer to suit changes in the operational environment ofthecomputer.