Apparatus and methods for determining event information and intrusion detection at a host device
AssigneeHawk Network Defense Inc.
InventorsTimothy J. Shelton, David Edwin Harris, Todd Jason Wheeler, Jr.
Life of this patent
Estimating the term…
Abstract
Disclosed are apparatus and methods that facilitate analysis of events associated with network and computer systems. The methodology includes determining at least one lookup key in a host device for an event occurring in the host device and determining whether the at least one lookup key is used in a memory to determine if at least one key-value pair exists for the event. The methodology also includes appending the at least one key-value pair to the event, and storing the at least one key-value pair in the memory based on the at least one lookup key including replacing existing keys found for the at least one lookup key.
Claims19
A method for analyzing events in a host device in a computer network system, the method comprising:
- determining at least one lookup key in a host device for an event occurring in the host device, wherein the at least one lookup key comprises one of a user ID or a session ID;
- determining whether the at least one lookup key is used in a memory to determine when at least one key-value pair exists for the event;
- appending at least one key-value pair to the event when at least one key-value pair is determined to exist for the event;
- and
- storing the at least one key-value pair in the memory based on the at least one lookup key including replacing existing keys found for the at least one lookup key.
A non-transitory computer-readable medium storing computer executable code, the code when executed by a processor causes the processor to:
- determine at least one lookup key in a host device for an event occurring in the host device, wherein the at least one lookup key comprises one of a user ID or a session ID;
- determine whether the at least one lookup key is used in a memory to determine when at least one key-value pair exists for the event;
- append at least one key-value pair to the event when at least one key-value pair is determined to exist for the event;
- and
- store the at least one key-value pair in the memory based on the at least one lookup key including replacing existing keys found for the at least one lookup key.
Dependencies are inferred from the claim text.