# US 2014/0137240 A1 · Automated security analytics platform > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0137240 A1 - Document ID: US20140137240A1 - Status: Published application - Kind: A1 - Application number: 13/677,121 - Filed: 2012-11-14 - Published: 2014-05-15 - Earliest claimed: 2012-11-14 - Assignees: Click Security, Inc. - Applicants: Click Security, Inc. - Inventors: Brian Smith; Marc Willebeek-LeMair - Web page: https://patentgrep.com/patent/US20140137240A1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 12/14: Protection against unauthorised use of memory {or access to memory} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A network security platform stores network telemetry information in an active memory, such as DRAM, and analyzes the network telemetry information to detect and respond to network security threats. Using a common active memory to store sensed network telemetry information and analyze that information provides a real-time dataflow engine for detecting security threats and neutralizing detected threats. ## Claims ### Claim 1 A method for maintaining network security, the method comprising: sensing network telemetry information at plural network resources; communicating the network telemetry information to an active memory interfaced with a processor, the processor executing plural network security modules, each network security module having an input specification, an output specification and a logic specification, the logic specification defining a memory allocation in the active memory for each of the security modules; and maintaining network security by investigating network telemetry information with one or more of the security modules using the telemetry information stored in the active memory to detect network security threats and by neutralizing the detected network security threats with one or more of the security modules in response to detecting of predetermined network telemetry information in the active memory. ### Claim 2 (depends on 1) The method of claim 1 further comprising: identifying the network telemetry information associated with the input specification of each network security module; and storing the identified network telemetry information to active memory allocated to each of the network security modules based on the association of the identified network telemetry information with active memory allocated for the network security modules. ### Claim 3 (depends on 2) The method of claim 2 further comprising: maintaining the network security modules in an inactive state; detecting storage of information to active memory; and activating each of the network security modules only in response to detecting of storage of information to active memory associated with the network security modules. ### Claim 4 (depends on 3) The method of claim 3 further comprising: determining that the storage of information to active memory exceeds the active memory allocated to one of the network security modules; and in response to determining, discarding the oldest information stored in active memory allocated to the one of the network security modules. ### Claim 5 (depends on 4) The method of claim 4 wherein discarding the oldest information stored in active memory comprises: deleting the information from the active memory; and communicating the information to a database for analysis. ### Claim 6 (depends on 2) The method of claim 2 further comprising: identifying at least some of the network telemetry information lacking an association with any of the input specifications of the network security modules; and discarding the at least some of the network telemetry information from the active memory. ### Claim 7 (depends on 6) The method of claim 6 wherein discarding further comprises storing the at least some of the network telemetry information in a database for analysis. ### Claim 8 (depends on 2) The method of claim 2 wherein maintaining network security further comprises investigating network telemetry information with one or more of the security modules using one or more outputs of one or more security modules. ### Claim 9 (depends on 1) The method of claim 1 further comprising: monitoring the active memory usage by each of the network security modules; and altering the active memory associated with one or more of the network security modules based upon the active memory usage. ### Claim 10 A system for maintaining network security, the system comprising: one or more processors operable to process information; a network interface operable to receive network telemetry information; an active memory operable to store predetermined of the network telemetry information; plural network security modules operable to execute on the processor to investigate and neutralize network security operations with information stored in the active memory; and a memory allocation module interfaced with the active memory and the network security modules, the memory allocation module operable to associate each network security module with an allocated area of the active memory and to store network telemetry information used as an input by a network security module to the allocated area of the security module as the network telemetry information is received at the network interface. ### Claim 11 (depends on 10) The system of claim 10 wherein the memory allocation module is further operable to: maintain the network security modules in an inactive state; activate each of the network security modules if network telemetry information is stored in the active memory allocated area associated with each network security module; and return each network security module to an inactive state after processing the network telemetry information in the active memory allocated area. ### Claim 12 (depends on 10) The system of claim 10 wherein the active memory is random access memory. ### Claim 13 (depends on 10) The system of claim 10 wherein the memory allocation module is further operable to: determine that storage of network telemetry information to active memory exceeds the capacity of one of the allocated areas; and in response to determining, discard the oldest information stored in the one of the allocated areas. ### Claim 14 (depends on 10) The system of claim 10 wherein the memory allocation module is further operable to: compare network telemetry information with inputs specifications of the network security modules; and store network telemetry information in the active memory only if the network telemetry information matches an input specification for at least one network security module. ### Claim 15 (depends on 10) The system of claim 10 wherein the memory allocation module is further operable to alter the size of the allocated areas in response to usage of the allocated areas. ### Claim 16 (depends on 10) The system of claim 10 wherein the plural security modules investigate and neutralize network security operations with common network telemetry information stored in the allocated areas. ### Claim 17 A machine readable medium comprising instructions operable to: receive network telemetry information from network resources; selectively store the network telemetry information to a predetermined area of an active memory only if the network telemetry information matches an input specification for at least one of plural network security modules; and activate one or more of the plural network security modules to process network telemetry information, the activating in response to the storing of the network telemetry information in the predetermined area associated with the one or more of the plural network security modules. ### Claim 18 (depends on 17) The machine readable medium of claim 17 further comprising instructions operable to: track the length of time that network telemetry information is stored in the active memory; and discard network telemetry information after a predetermined length of time. ### Claim 19 (depends on 17) The machine readable medium of claim 17 wherein each network security module comprises an input specification, a logic specification and an output specification, and wherein at least one output specification of at least one network security module maps to an input specification of at least one network security module. ### Claim 20 (depends on 19) The machine readable medium of claim 19 wherein the logic specification of each network security module defines the size of the predetermined area of the active memory for storing network telemetry information defined by the associated input specification.