Back to results
US 12,585,657 B2Granted
Real-time streaming graph queries
AssigneeCrowdStrike, Inc.
InventorsBrent Ryan Nash, Timothy Jason Berger, Hyacinth D. Diehl, James Robert Plush
Life of this patent
Estimating the term…
Abstract
An event query host can include an event processor configured to process an event stream indicating events that occurred on a computing device. The event processor can add representations of events to an event graph. If an event added to the event graph is a trigger event associated with a query, the event processor can also add an instance of the query to a query queue. The query queue can be sorted based on scheduled execution times of query instances. At a scheduled execution time of a query instance in the query queue, a query manager of the event query host can execute the query instance and attempt to find a corresponding pattern of one or more events in the event graph.
Claims20
A computer-implemented method comprising:
- maintaining, by an event query host of a digital security system, an event graph;
- storing, by the event query host, definitions of queries, wherein:
- different queries are respectively associated with different trigger events,
- the definitions of the queries indicate rescheduling schemes determined based on historical information indicating durations of time by which instances of the different queries were determined to be satisfied after identification of corresponding trigger events, and
- occurrences of the different trigger events indicate that corresponding query instances, of the different queries, are to be added to a query queue associated with the event graph;
- maintaining, by the event query host, the query queue associated with the event graph, wherein the query queue:
- comprises query instances, of one or more of the queries, to be executed at scheduled execution times in association with the event graph, and
- is ordered based on the scheduled execution times of the query instances;
- adding, by the event query host, and to the event graph, a representation of a particular event that has occurred on a computing device;
- determining, by the event query host, and in response to adding the representation of the particular event to the event graph, that the particular event is a trigger event associated with a particular query of the queries;
- determining, by the event query host, and based on a rescheduling scheme of the rescheduling schemes that is associated with the particular query, a particular scheduled execution time for a query instance of the particular query;
- adding, by the event query host, and in response to determining that the particular event is the trigger event associated with the particular query, the query instance of the particular query to the query queue, wherein:
- the query instance is added at a position within the query queue determined based on the particular scheduled execution time of the query instance, relative to the scheduled execution times of the query instances already in the query queue;
- and
- executing, by the event query host, the query instance at the particular scheduled execution time.
12 more elements
A computing system, comprising:
- one or more processors;
- and
- memory storing computer-executable instructions associated with an event query host of a digital security system that, when executed by the one or more processors, cause the one or more processors to:
- maintain an event graph;
- store definitions of queries, wherein:
- different queries are respectively associated with different trigger events,
- the definitions of the queries indicate rescheduling schemes determined based on historical information indicating durations of time by which instances of the different queries were determined to be satisfied after identification of corresponding trigger events, and
- occurrences of the different trigger events indicate that corresponding query instances, of the different queries, are to be added to a query queue associated with the event graph;
- maintain the query queue associated with the event graph, wherein the query queue:
- comprises query instances, of one or more of the queries, to be executed at scheduled execution times in association with the event graph, and
- is ordered based on the scheduled execution times of the query instances;
- add, to the event graph, a representation of a particular event that has occurred on a computing device;
- determine, in response to adding the representation of the particular event to the event graph, that the particular event is a trigger event associated with a particular query of the queries;
- determine, based on a rescheduling scheme of the rescheduling schemes that is associated with the particular query, a particular scheduled execution time for a query instance of the particular query;
- add, in response to determining that the particular event is the trigger event associated with the particular query, the query instance of the particular query to the query queue, wherein:
- the query instance is added at a position within the query queue determined based on the particular scheduled execution time of the query instance, relative to the scheduled execution times of the query instances already in the query queue;
- and
- execute the query instance at the particular scheduled execution time.
15 more elements
One or more non-transitory computer-readable media storing computer-executable instructions associated with an event query host of a digital security system that, when executed by one or more processors, cause the one or more processors to:
- maintain an event graph;
- store definitions of queries, wherein:
- different queries are respectively associated with different trigger events,
- the definitions of the queries indicate rescheduling schemes determined based on historical information indicating durations of time by which instances of the different queries were determined to be satisfied after identification of corresponding trigger events, and
- occurrences of the different trigger events indicate that corresponding query instances, of the different queries, are to be added to a query queue associated with the event graph;
- maintain the query queue associated with the event graph, wherein the query queue:
- comprises query instances, of one or more of the queries, to be executed at scheduled execution times in association with the event graph, and
- is ordered based on the scheduled execution times of the query instances;
- add, to the event graph, a representation of a particular event that has occurred on a computing device;
- determine, in response to adding the representation of the particular event to the event graph, that the particular event is a trigger event associated with a particular query of the queries;
- determine, based on a rescheduling scheme of the rescheduling schemes that is associated with the particular query, a particular scheduled execution time for a query instance of the particular query;
- add, in response to determining that the particular event is the trigger event associated with the particular query, the query instance of the particular query to the query queue, wherein:
- the query instance is added at a position within the query queue determined based on the particular scheduled execution time of the query instance, relative to the scheduled execution times of the query instances already in the query queue;
- and
- execute the query instance at the particular scheduled execution time.
12 more elements
Dependencies are inferred from the claim text.