Back to results
US 2015/0287225 A1Published application
Universal Actor Correlator
AssigneeClick Security, Inc.
InventorsVictoria L. Rowland, Brian Smith
Life of this patent
Estimating the term…
Abstract
Precorrelation of data applied to use cases by a module intermediate to the data and use cases provides normalized data across multiple sources for more effective analysis. For example, network sensors provide network telemetry to a precorrelation core, which extracts and normalizes the data to correlate actors to events. Universal actor correlation improves visualizations by creating a mesh of events tied to each other through a common actor.
Claims14
1-3. (canceled)
A network security system comprising:
- plural network sensors at plural locations operable to detect network telemetry information and stream the network telemetry information to a network location, the network telemetry information including events, each event having at least one of plural types of actor identifiers;
- and
- a precorrelation core stored in non-transitory memory and interfaced with the data source, the precorrelation core storing the network telemetry information in tables of random access memory by the types of actor identifier of each event, the precorrelation core associating events and actors by comparing actor identifiers for the tables to identify each event of different tables having common actor identifier information;
- and
- a graphical user interface interfaced with the precorrelation core and operable to present the identified events of the different tables having common actor identifier information.
2 more elements
A method for monitoring network security, the method comprising:
- streaming network telemetry information from plural sensors to random access memory accessible by a precorrelation core;
- storing the network telemetry information as plural events in the random access memory, each of the plural events stored by type in one of plural tables based upon entity identifier information associated with each event;
- associating plural events of plural tables with a common entity by correlating entity identifier information in different tables;
- and
- presenting a visualization of the association of the plural events by interconnecting nodes that share entity identifier information.
2 more elements
Dependencies are inferred from the claim text.