Using network connections to monitor an environment
AssigneeFortinet, Inc.
InventorsVikram Kapoor, Rakesh Sachdeva, Samuel Joseph Pullara, III
Life of this patent
Estimating the term…
Abstract
A data platform monitors a compute environment. For example, the data platform receives, from an agent operating in the environment, process data for a process in the environment, where the process data for the process is collected by the agent in response to the agent detecting an initiation of a network connection in the environment and determining that the process is associated with the network connection. The data platform performs an analysis on a combination of the process data received from the agent and additional data. The performance of the analysis may include generating a polygraph representing activities in the environment and/or detecting an anomaly in the environment.
Claims20
A method, comprising:
- receiving, by a data platform and from an agent operating in a cloud environment, process data for a process in the cloud environment, wherein the process data for the process is collected by the agent causally responsive to the agent detecting an initiation of a network connection in the cloud environment and determining that the process is associated with the network connection, the detecting of the initiation of the network connection being performed by the agent on a machine where the process executes;
- and
- performing, by the data platform, an analysis on a combination of:
- (1) the process data received from the agent, and (2) additional data.
A non-transitory computer readable medium having stored thereon a computer program product configured to be executed by at least one processor of a data platform to:
- receive, at the data platform and from an agent operating in a datacenter environment, process data for a process in the datacenter environment, wherein the process data for the process is collected by the agent causally responsive to the agent detecting an initiation of a network connection in the datacenter environment and determining that the process is associated with the network connection, the detecting of the initiation of the network connection being performed by the agent on a machine where the process executes;
- and
- perform, at the data platform, an analysis on a combination of:
- (1) the process data received from the agent, and (2) additional data.
A system, comprising:
- a data platform comprising at least one computer processor and configured to:
- receive, from an agent operating in a network environment, process data for a process in the network environment, wherein the process data for the process is collected by the agent causally responsive to the agent detecting an initiation of a network connection in the network environment and determining that the process is associated with the network connection, the detecting of the initiation of the network connection being performed by the agent on a machine where the process executes;
- and
- perform an analysis on a combination of:
- (1) the process data received from the agent, and (2) additional data.
Dependencies are inferred from the claim text.