# US 2014/0137241 A1 · Automated security analytics platform with pluggable data collection and analysis modules > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0137241 A1 - Document ID: US20140137241A1 - Status: Published application - Kind: A1 - Application number: 13/677,139 - Filed: 2012-11-14 - Published: 2014-05-15 - Earliest claimed: 2012-11-14 - Assignees: Click Security, Inc. - Applicants: Click Security, Inc. - Inventors: Brian Smith; Donovan Kolbly; Marc Willebeek-LeMair - Web page: https://patentgrep.com/patent/US20140137241A1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Pluggable network security modules provide a collaborative response across plural networks by allowing modules associated with detection and neutralization of a network security threat to plug into a network security platform of other networks. Plugging the security modules in provides an automated insertion of detection and neutralization tools into the network security platform to respond to potential threats based upon proven successful responses at other networks. ## Claims ### Claim 1 A method for maintaining network security, the method comprising: distributing a network security platform to each of plural networks, each network security platform having a sensor execution environment and an analysis execution environment; monitoring network activity for each of the plural networks with plural sensor modules running on the sensor execution environment of each of the plural network security platforms, the plural sensor modules storing monitored network activity in memory accessible by the analysis execution environment; detecting a network threat with one or more of plural analysis modules running on the analysis execution environment of one of the network security platforms, the detecting performed by analysis of the stored monitored network activity at the one network security platform; and in response to detecting the network threat, distributing the one or more of plural analysis modules to the analysis execution environment of one or more other of the network security platforms. ### Claim 2 (depends on 1) The method of claim 1 further comprising: modifying the one or more of plural analysis modules associated with the detecting a network threat to neutralize the network threat at the analysis execution environment; and neutralizing the network threat at the analysis execution environment of one or more of the network security platforms with monitored network activity stored in the memory by the sensor modules. ### Claim 3 (depends on 1) The method of claim 1 wherein the distributing the one or more of plural analysis modules further comprises: communicating the one or more of plural analysis modules to the one or more network security platforms as one or more pluggable modules, each pluggable module having at least a predetermined set of one or more commands executable at the analysis execution environment; executing the predetermined set of one or more commands at the analysis execution environment to load an executable of the one or more pluggable modules into a processor program memory; and activating the executable in response to predetermined monitored network activity. ### Claim 4 (depends on 3) The method of claim 3 wherein activating further comprises: binding the executable to a sensor table of the analysis execution environment; providing the predetermined network activity to the sensor table of the analysis execution environment; and in response to the providing, performing the executable with the predetermined monitored network activity. ### Claim 5 (depends on 3) The method of claim 3 wherein the executable comprises native code pushed into an execution path. ### Claim 6 (depends on 3) The method of claim 3 wherein each pluggable module comprises: one or more tables, each table having plural rows; and one or more bindings, each binding having at least one handler associated with at least one table for responding to the predetermined network activity, the sensor module providing a monitored network activity to the one or more tables, the monitored network activity associated with the predetermined network activity. ### Claim 7 (depends on 6) The method of claim 6 wherein the binding performs a rowcreate in response to the providing of the monitored network activity to the table. ### Claim 8 (depends on 6) The method of claim 6 wherein the binding performs a rowupdate in response to the providing of the monitored network activity to the table. ### Claim 9 (depends on 6) The method of claim 6 wherein the binding performs a rowdelete in response to the providing of the monitored network activity to the table. ### Claim 10 A system for maintaining network security, the system comprising: a processor operable to process information, the processor having integrated program memory; an active memory interfaced with the processor, the active memory storing network telemetry information accessible by the processor; a sensor execution environment defined in the processor and operable to run plural sensor modules that store network telemetry information to the active memory; an analysis execution environment defined in the processor and operable to run plural analysis modules that analysis network telemetry information for network security threats; wherein the plural sensor modules are further operable to store network telemetry information in a sensor table of the analysis execution environment and wherein at least one of the plural analysis modules have one or more bindings that selectively respond to network telemetry information as the sensor module stores the network telemetry information in the sensor table. ### Claim 11 (depends on 10) The system of claim 10 wherein the plural sensor modules store network telemetry information in the sensor table in real time as the network telemetry information is received by the plural sensor modules. ### Claim 12 (depends on 11) The system of claim 11 wherein the binding of the analysis module responds to network telemetry information stored in the sensor table in real time as the network telemetry information is stored in the sensor table. ### Claim 13 (depends on 10) The system of claim 10 wherein the binding responds to the storing of network telemetry information in the sensor table by invoking a rowcreate. ### Claim 14 (depends on 10) The system of claim 10 wherein each of the plural sensor modules comprise a unix subprocess operable to output a JSON structure having one of a structured message, a statistics message or a status message. ### Claim 15 (depends on 10) The system of claim 10 wherein the analysis modules comprise pluggable modules stored in the active memory and having native code in program memory of the processor, the native code loaded into the program memory in response to a predetermined API command of the analysis execution environment. ### Claim 16 (depends on 15) The system of claim 15 wherein analysis execution environment comprises an object oriented interface having subclasses, the object oriented interface providing calls from the pluggable module into the analysis execution environment with inherited methods. ### Claim 17 A machine readable medium comprising instructions operable to execute on a network security analysis execution environment to: one or more tables, each table having plural rows, each row providing a structured record mapping names to network sensor values according to a schema; one or more bindings having handlers associated with tables for responding to a network security event entered at the one or more tables; native code operable to reside in program memory of a processor for responding to the network security event; and an interface operable to load the native code to the processor, native code responding in real time to network security events indicated by entries to one or more of the tables. ### Claim 18 (depends on 17) The machine readable medium of claim 17 further comprising instructions operable to execute on a sensor execution environment to: detect predetermined network security events; and enter the predetermined network security events to a predetermined table of the network security analysis execution environment. ### Claim 19 (depends on 17) The machine readable medium of claim 17 wherein the interface comprises an install command to create a persistent object and a start command to establish the native code in program memory of the processor. ### Claim 20 (depends on 17) The machine readable medium of claim 17 wherein one of the tables is a sensor table and the native code binds to sensor table for rowcreate events to invoke an action in real time upon receipt of information from a network sensor at the sensor table.