# US 2014/0282871 A1 · Universal actor correlator

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0282871 A1
- Document ID: US20140282871A1
- Status: Published application
- Kind: A1
- Application number: 13/843,414
- Filed: 2013-03-15
- Published: 2014-09-18
- Earliest claimed: 2013-03-15
- Assignees: Click Security, Inc.
- Applicants: Click Security, Inc.
- Inventors: Victoria L. Rowland; Brian Smith
- Web page: https://patentgrep.com/patent/US20140282871A1

## CPC

- G06T 11/26: Drawing of charts or graphs
- G06F 21/60: Protecting data
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/104: {Grouping of entities}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Precorrelation of data applied to use cases by a module intermediate to the data and use cases provides normalized data across multiple sources for more effective analysis. For example, network sensors provide network telemetry to a precorrelation core, which extracts and normalizes the data to correlate actors to events. Universal actor correlation improves visualizations by creating a mesh of events tied to each other through a common actor.

## Claims

### Claim 1

A network security system comprising:
plural use cases operable to identify predetermined conditions in data from plural sources, the predetermined conditions including indications of unauthorized network accesses;
a data source having network telemetry from plural sensors, at least some of the network telemetry including at one or more events and one or more actors, the network telemetry associated with authorized and unauthorized network accesses;
a precorrelation core interfaced with the data source and operable to associate events and actors, each event defined as a type selected from the group of flow, authenticate, access, security and policy event types.

### Claim 2 (depends on 1)

The network security system of claim 1 further comprising a fan out graphical user interface depicting events associated by actor.

### Claim 3

A method for monitoring network security, the method comprising:
retrieving network telemetry from plural sensors;
storing the network telemetry at a data source;
precorrelating the network sensor information by associating plural events of the data source with a common actor; and
presenting a visualization of the plural events that depicts a relationship with the common actor.