# US 2016/0182551 A1 · Automated Security Analytics Platform with Multi-Level Representation Conversion for Space Efficiency and Incremental Persistence > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0182551 A1 - Document ID: US20160182551A1 - Status: Published application - Kind: A1 - Application number: 15/054,488 - Filed: 2016-02-26 - Published: 2016-06-23 - Earliest claimed: 2012-11-14 - Assignees: Click Security, Inc. - Applicants: Click Security, Inc. - Inventors: Donovan Kolbly - Web page: https://patentgrep.com/patent/US20160182551A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 15/167: using a common memory, e.g. mailbox - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Active memory for managing network telemetry information, or other types of information stored as objects, has objects partially-serialized to allow greater amounts of information to store in a memory of a given size with slightly increased retrieval times. Storing additional information in an active memory provides an overall increase in network security platform responsiveness by allowing a greater amount of information to be accessible from the active memory instead of archive. ## Claims ### Claim 1 A method for managing network information stored in an active memory for interaction with a network security platform, the method comprising: storing the network information as plural objects in the active memory in non-serialized form; accessing at least some of the plural objects from the active memory with the network security platform; selectively converting less than all of the plural objects into a serialized form for storage in the active memory; and accessing at least some of the less than all of the plural objects that were converted into serialized form with the network security platform from the active memory to detect a network security threat, the accessing performed at least in part by converting the at least some of the less than all of the plural objects from the serialized form to the non-serialized form. ### Claim 1 A method for managing network information stored in an active memory for interaction with a network security platform, the method comprising: storing the network information as plural objects in the active memory; accessing at least some of the plural objects with the network security platform; selectively converting less than all of the plural objects into a serialized form in the active memory; and accessing at least some of the less than all of the plural objects with the network security platform. ### Claim 2 (depends on 1) The method of claim 1 wherein selectively converting further comprises: analyzing one or more predetermined conditions; and selecting one or more objects to convert to serialized form based upon the predetermined conditions. ### Claim 2 (depends on 1) The method of claim 1 wherein selectively converting further comprises: analyzing one or more predetermined conditions; and selecting one or more objects to convert to serialized form based upon the predetermined conditions. ### Claim 3 (depends on 2) The method of claim 2 wherein the predetermined conditions comprise the complexity of attribute values of the plural objects, and selecting comprises selecting objects to convert to serialized form that have less complexity relative to unselected objects. ### Claim 3 (depends on 2) The method of claim 2 wherein the predetermined conditions comprise the complexity of attribute values of the plural objects, and selecting comprises selecting objects to convert to serialized form that have less complexity relative to unselected objects. ### Claim 4 (depends on 2) The method of claim 2 wherein the predetermined conditions comprise the recency of access of the plural objects by the network security platform and selecting comprises selecting objects to convert to serialized form that have less frequency of access by the network security platform relative to unselected objects. ### Claim 4 (depends on 2) The method of claim 2 wherein the predetermined conditions comprise the receny of access of the plural objects by the network security platform and selecting comprises selecting objects to convert to serialized form that have less frequency of access by the network security platform relative to unselected objects. ### Claim 5 (depends on 2) The method of claim 2 wherein the predetermined conditions comprise the length of time of storage of the plural objects in the active memory, and selecting comprises selecting objects to convert to serialized form that have a greater time of storage relative to unselected objects. ### Claim 5 (depends on 2) The method of claim 2 wherein the predetermined conditions comprise the length of time of storage of the plural objects in the active memory, and selecting comprises selecting objects to convert to serialized form that have a greater time of storage relative to unselected objects. ### Claim 6 (depends on 1) The method of claim 1 wherein the active memory is a dynamic random access memory. ### Claim 6 (depends on 1) The method of claim 1 wherein the active memory is a dynamic random access memory. ### Claim 7 (depends on 1) The method of claim 1 wherein selectively converting less than all of the plural objects into a serialized form in the active memory further comprises: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attribute values having fully-realized objects to objects stored in serialized form without per-object overhead. ### Claim 7 (depends on 1) The method of claim 1 wherein selectively converting less than all of the plural objects into a serialized form in the active memory further comprises: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attribute values having fully-realized objects to objects stored in serialized form without per-object overhead. ### Claim 8 (depends on 1) The method of claim 1 wherein selectively converting less than all of the plural objects into a serialized form in the active memory further comprises: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attribute values having fully-realized objects to a fully serialized object with shared context to interpret the serialized representation. ### Claim 8 (depends on 1) The method of claim 1 wherein selectively converting less than all of the plural objects into a serialized form in the active memory further comprises: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attribute values having fully-realized objects to a fully serialized object with shared context to interpret the serialized representation. ### Claim 9 (depends on 6) The method of claim 6 wherein selectively converting less than all of the plural objects into a serialized form in the active memory further comprises: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attributes having full-realized objects to plural fully serialized objects compressed into one or more pages. ### Claim 9 (depends on 6) The method of claim 6 wherein selectively converting less than all of the plural objects into a serialized form in the active memory further comprises: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attributes having full-realized objects to plural fully serialized objects compressed into one or more pages. ### Claim at position 19 10-16. (canceled) ### Claim 10 A system for managing network information stored in an active memory for interaction with a network security platform, the system comprising: a processor operable to process the network information by executing the network security platform to retrieve the network information from the active memory; an active memory interfaced with the processor, the active memory storing the network information for access by the processor; a memory allocation module interfaced with the active memory and operable to selectively convert the network information in the active memory from fully-realized objects to partially-serialized objects; wherein the network information is selected to convert based upon one or more predetermined factors. ### Claim 11 (depends on 10) The system of claim 10 wherein the active memory comprises dynamic random access memory. ### Claim 12 (depends on 11) The system of claim 11 wherein the memory allocation module selectively converts the network information by: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attribute values having fully-realized objects to objects stored in serialized form without per-object overhead. ### Claim 13 (depends on 11) The system of claim 11 wherein the memory allocation module selectively converts the network information by: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attribute values having fully-realized objects to a fully serialized object with shared context to interpret the serialized representation. ### Claim 14 (depends on 11) The system of claim 11 wherein the memory allocation module selectively converts the network information by: maintaining at least some of the plural objects with attribute values having fully-realized objects; and converting at least some of the plural objects from attributes having full-realized objects to plural fully serialized objects compressed into one or more pages. ### Claim 15 (depends on 11) The system of claim 11 wherein the predetermined conditions comprise an anticipated access time for the network information. ### Claim 16 (depends on 11) The system of claim 11 wherein the predetermined conditions comprise the complexity of attribute values of the fully-realized objects. ### Claim 17 A machine readable medium comprising instructions operable to execute on a processor to manage information stored in random access memory to: select at least some of the information to store in the random access memory as fully realized objects; select at least some of the information to store in the random access memory as partially-serialized objects; and provide access by an application running on the processor to both the fully realized objects and the partially-serialized objects. ### Claim 18 (depends on 17) The machine readable medium of claim 17 further comprising instructions operable to: partially-serialize objects in both immutable and mutable forms; and extract objects from the immutable form when information associated with the objects is requested by the application. ### Claim 19 (depends on 18) The machine readable medium of claim 18 wherein the mutable form comprises a semicompact serialized from having objects stored without per-object overhead. ### Claim 20 (depends on 18) The machine readable medium of claim 18 wherein the immutable form comprises plural objects fully serialized as a separate object having a shared context to interpret the serialized representation.