System and method for identifying security entities in a computing environment
AssigneeAwake Security, Inc.
InventorsDaniel Wang, Debabrata Dash, Gary Golomb
Life of this patent
Estimating the term…
Abstract
System and method to identify a security entity in a computing environment is disclosed. Communication between a user computer and at least one destination computer by a security appliance is monitored by a security appliance. A virtual identifier is assigned to a subset of the communication within a defined time period. At least one security entity is identified based on a subset of the selective information. The assigned virtual identifier associated with at least one security entity.
Claims22
A method for identifying a security entity in a computing environment, comprising:
- monitoring a communication between a user computer and at least one destination computer by a security appliance;
- extracting selective information from the communication by the security appliance;
- assigning a first virtual identifier to a subset of the communication within a first time interval;
- extending the first time interval so that the subset of the communication to which the first virtual identifier is assigned applies to a larger portion of the communication;
- identifying at least one security entity based on a subset of the extracted selective information within a duration of the extended first time interval;
- associating one or more of the extracted selective information from the communication within the duration of the extended first time interval to the identified at least one security entity;
- and
- associating the assigned first virtual identifier to the identified at least one security entity, for the duration of the extended first time interval.
A system to identify a security entity in a computing environment, comprising:
- a security appliance configured to
- monitor a communication between a user computer and a destination computer;
- extract selective information from the communication;
- assign a first virtual identifier to a subset of the communication within a first time interval;
- extend the first time interval so that the subset of the communication to which the first virtual identifier is assigned applies to a larger portion of the communication;
- identify at least one security entity based on a subset of the extracted selective information within a duration of the extended first time interval;
- associated one or more of the extracted selective information from the communication within the duration of the extended first time interval to the identified at least one security entity;
- and
- associate the assigned first virtual identifier to the identified at least one security entity, for the duration of the extended first time interval.
Dependencies are inferred from the claim text.