US 11,601,449 B2Granted

Event evaluation pipeline for alert engine

AssigneeAbsolute Software Corporation

InventorsTomas Piedrahita Herran, Hansel D'Ornellas

Life of this patent

Estimating the term…

Loading patent…

Abstract

Provided is a way of evaluating rules/conditions that span different domain entities against a set of disparate events from multiple sources that have occurred within a specific window or interval of time from the current time back to a specific time in the past. Events are stored in dedicated storage to enable an extended window of time to be used for multiple event evaluation. Only relevant event/rule pairs are evaluated. The system will record when an event relevant to a rule happens. When a second event that is relevant to the rule happens, the system checks the records to see if a previous relevant event had happened in the past that would cause the rule to trigger an alert. A mechanism is also provided for evaluating static state in combination with changed properties.

Claims19

Dependent claims

A method for filtering events related to an electronic device prior to evaluation of a group of multiple events thereof, the method comprising:

storing a set of rules, each rule labeled with a rule type;
receiving a stream of events, each event labeled with an event type;
determining that the event type of one of the events matches the rule type of one of the rules;
determining that a condition of said one rule is satisfied by said one event;
creating a document;
writing, in the document, said one event, said one rule, an indication that the condition is satisfied and an expiry time that is measured from said one event, wherein said one rule requires (a) the event type of another of the events to match the rule type of said one rule type, (b) the other event occur within the expiry time and (c) the other event to satisfy another condition of said one rule;
storing the document in a non-volatile storage;
determining that the event type of a second one of the events matches the rule type of said one rule;
determining that the expiry time has not passed;
determining that a second condition of said one rule is satisfied by said second event;
writing said second event and an indication that the second condition is satisfied in the document;
and
taking a security action related to the electronic device.

10 more elements

A system for filtering events related to an electronic device prior to evaluation of a group of multiple events thereof, the system comprising a server and non-transitory computer readable memory in the server storing computer-readable instructions, which, when executed by one or more processors in the server cause the server to:

store a set of rules, each rule labeled with a rule type;
receive a stream of events, each event labeled with an event type;
determine that the event type of one of the events matches the rule type of one of the rules;
determine that a condition of said one rule is satisfied by said one event;
create a document;
write, in the document, said one event, said one rule, an indication that the condition is satisfied and an expiry time that is measured from said one event, wherein said one rule requires (a) the event type of another of the events to match the rule type of said one rule type, (b) the other event occur within the expiry time and (c) the other event to satisfy another condition of said one rule;
store the document in a non-volatile storage;
determine that the event type of a second one of the events matches the rule type of said one rule;
determine that the expiry time has not passed;
determine that a second condition of said one rule is satisfied by said second event;
write said second event and an indication that the second condition is satisfied in the document;
and
take a security action related to the electronic device.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/380,857Filed 20 Jul 2021 · us provisional application
Priority: 21 Jul 2020
Published: US 2022/0030015 A127 Jan 2022
Granted: 7 Mar 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 16/24568
Query execution: data stream processing; Continuous queries
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 16/2474
Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries: sequence data queries, e.g. querying versioned data
G06F 16/93
Details of database functions independent of the retrieved data types: document management systems