# US 2016/0366160 A1 · Systems and Methods for Processing Data Flows

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0366160 A1
- Document ID: US20160366160A1
- Status: Published application
- Kind: A1
- Application number: 15/137,492
- Filed: 2016-04-25
- Published: 2016-12-15
- Earliest claimed: 2000-09-25
- Assignees: Blue Coat Systems, Inc.
- Applicants: Blue Coat Systems, Inc.
- Inventors: Harsh Kapoor; Moisey Akerman; Stephen Justus; John C. Ferguson; Yevgeny Korsunsky; Paul S. Gallo; Charles Ching Lee; Timothy M. Martin; Chunsheng Fu; Weidong Xu
- Web page: https://patentgrep.com/patent/US20160366160A1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 16/2358: {Change logging, detection, and notification (replication G06F16/27)}
- H04L 41/0866: Checking the configuration
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/306: User profiles
- G06N 3/088: Non-supervised learning, e.g. competitive learning
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A flow processing facility, which uses a set of artificial neurons for pattern recognition, such as a self-organizing map, in order to provide security and protection to a computer or computer system supports unified threat management based at least in part on patterns relevant to a variety of types of threats that relate to computer systems, including computer networks. Flow processing for switching, security, and other network applications, including a facility that processes a data flow to address patterns relevant to a variety of conditions are directed at internal network security, virtualization, and web connection security. A flow processing facility for inspecting payloads of network traffic packets detects security threats and intrusions across accessible layers of the IP-stack by applying content matching and behavioral anomaly detection techniques based on regular expression matching and self-organizing maps. Exposing threats and intrusions within packet payload at or near real-time rates enhances network security from both external and internal sources while ensuring security policy is rigorously applied to data and system resources. Intrusion Detection and Protection (IDP) is provided by a flow processing facility that processes a data flow to address patterns relevant to a variety of types of network and data integrity threats that relate to computer systems, including computer networks.

## Claims

### Claim 1

A method in a flow processing facility for securing a computer resource, comprising:
providing a data flow processing facility comprising a plurality of network addressable data processing modules;
receiving a data flow;
identifying data packets associated with a subscriber profile in the data flow;
employing a policy to make a determination, the determination indicating which of a plurality of network addresses of the plurality of the network addressable data processing modules to select for first processing of the identified data packets based on at least one of the subscriber profile in the data flow and the policy;
accessing a configuration, the configuration associating two or more processing actions with the policy;
delivering the identified data packets to a first network addressable data processing module for executing one of the actions that are associated with the policy, the first network addressable data processing module being accessible at the network address that the determination indicates, the one of the actions modifying the data flow;
determining a second network address of a network addressable data processing module for second processing of the identified data packets based on the configuration and at least one of the subscriber profile and the policy; and
delivering the identified data packets from the first network address to the second network address to secure a computer resource.