Loading patent…
AssigneeSplunk Inc.
InventorsJoseph Auguste Zadeh, Rodolfo Soto, George Apostolopoulos, John Clifton Pierce
Estimating the term…
Techniques are described for analyzing data regarding activity in an IT environment to determine information regarding the entities associated with the activity and using the information to detect anomalous activity that may be indicative of malicious activity. In an embodiment, a plurality of events reflecting activity by a plurality of entities in an IT environment are processed to resolve the identities of the entities, discover how the entities fit within a topology of the IT environment, and determine what the entities are. This information is then used to generate an entity relationship graph that includes nodes representing the entities in the IT environment and edges connecting the nodes representing interaction relationships between the entities. In some embodiments, baselines are established by monitoring the activity between entities. This baseline information can be represented in the entity relationship graph in the form of directionality applied to the edges. The entity relationship graph can then be monitored to detect anomalous activity.
A computer implemented method comprising:
A computer system comprising:
A non-transitory computer-readable medium containing instructions, execution of which in a computer system causes the computer system to:
Dependencies are inferred from the claim text.
Drawings are temporarily unavailable. Open the PDF at USPTO
From the US filing history. Foreign family members aren’t listed.
By monitoring network traffic: traffic logging, e.g. anomaly detection
Processing captured monitoring data, e.g. for logfile generation: for graphical visualisation of monitoring data
Arrangements for monitoring or testing data switching networks: monitoring or testing based on specific metrics, e.g. QoS, energy consumption or…
Of different types: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
About 10 years 3 months of term left · ends 30 Jan 2037 (estimated)
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
At least one embodiment of the present disclosure pertains to distributed data processing systems, and more particularly, to intelligence generation and activity discovery from events in a distributed data processing system.
Activity detection, both friendly and malicious, has long been a priority for computer network administrators. In known public and private computer networks, users employ devices such as desktop computers, laptop computers, tablets, smartphones, browsers, etc. to interact with others through computers and servers that are coupled to the network. Digital data, typically in the form of data packets, are passed along the network by interconnected network devices.
In the drawings:
FIG. 1 illustrates a networked computer environment in which an embodiment may be implemented;
FIG. 2 illustrates a block diagram of an example data intake and query system in which an embodiment may be implemented;
Embodiments are described herein according to the following outline: 1.0. GENERAL OVERVIEW 1.1. ENTITY FINGERPRINTING OVERVIEW 2.0. OPERATING ENVIRONMENT 2.1. HOST DEVICES 2.2. CLIENT DEVICES 2.3. CLIENT DEVICE APPLICATIONS 2.4. DATA SERVER SYSTEM 2.5. DATA INGESTION 2.5.1. INPUT 2.5.2. PARSING 2.5.3. INDEXING 2.6. QUERY PROCESSING 2.7. FIELD EXTRACTION 2.8. EXAMPLE SEARCH SCREEN 2.9. DATA MODELS 2.10. ACCELERATION TECHNIQUES 2.10.1. AGGREGATION TECHNIQUE 2.10.2. KEYWORD INDEX 2.10.3. HIGH PERFORMANCE ANALYTICS STORE 2.10.4. ACCELERATING REPORT GENERATION 2.11. CLOUD-BASED SYSTEM OVERVIEW 2.12. SEARCHING EXTERNALLY ARCHIVED DATA 2.12.1. ERP PROCESS FEATURES 2.13. SECURITY FEATURES 2.13.1 SECURITY SYSTEM 2.13.2 ENTERPRISE SECURITY APPLICATION 2.13.3. IT SERVICE MONITORING 2.14. COMPUTER PROCESSING SYSTEMS 3.0 ENTITY FINGERPRINTING 3.1 IDENTITY RESOLUTION 3.2 TOPOLOGY DISCOVERY 3.3 BEHAVIORAL PROFILING 3.4 CLIENT/SERVER RELATIONSHIP DISCOVERY 3.5 MONITORING AN ENTITY RELATIONSHIP GRAPH 1.0. General Overview
Modern data centers and other computing environments can comprise anywhere from a few host computer systems to thousands of systems configured to process data, service requests from remote clients, and perform numerous other computational tasks. During operation, various components within these computing environments often generate significant volumes of machine-generated data. For example, machine data is generated by various components in the information technology (IT) environments, such as servers, sensors, routers, mobile devices, Internet of Things (IoT) devices, etc. Machine-generated data can include system logs, network packet data, sensor data, application program data, error logs, stack traces, system performance data, etc. In general, machine-generated data can also include performance data, diagnostic information, and many other types of data that can be analyzed to diagnose performance problems, monitor user interactions, and to derive other insights.
A number of tools are available to analyze machine data, that is, machine-generated data. In order to reduce the size of the potentially vast amount of machine data that may be generated, many of these tools typically pre-process the data based on anticipated data-analysis needs. For example, pre-specified data items may be extracted from the machine data and stored in a database to facilitate efficient retrieval and analysis of those data items at search time. However, the rest of the machine data typically is not saved and discarded during pre-processing. As storage capacity becomes progressively cheaper and more plentiful, there are fewer incentives to discard these portions of machine data and many reasons to retain more of the data.