Scalable network security with fast response protocol

An apparatus comprising at least one hardware processor, embodied in at least one network-attachable device, said apparatus further comprising:

• means for determining whether a query received via a wide area network is of a first type, that requires response within a predetermined period of time, or of a second type, that does not require response within the predetermined period of time, wherein the query has at least one field having an identifier of a possible network security threat;
• means for, if the query is determined to be of the first type, further determining whether data responsive to the query and corresponding to the identifier is stored in the fast access memory by attempting to match the identifier with at least one data record stored in the fast access memory;
• means for, if the query is determined to be of the first type and if the data is stored in the fast access memory, transmitting a response to the query within the period of time via packet-based wide area network transmission to a source of the query;
• means for, if the query is determined to be of the first type and if the data is not stored in the fast access memory,
• transmitting an indication within the period of time that the data is not stored in the fast access memory to the source of the query, and
• generating a first request, transmitting the first request to at least one other network data source to retrieve asynchronously load the fast access memory with the data responsive to the query, and asynchronously updating the fast access memory to reflect data from the at least one other network data source retrieved responsive to the query;
• and
• means for, if the query is determined to be of the second type, generating a second request, transmitting the second request to at least one other network data source to retrieve data responsive to the query, receiving one or more responses to second request, and automatically transmitting data responsive to the second request to a source of the query via packet-based wide area network transmission.

An intrusion detection system comprising at least one computer and instructions stored on non-transitory computer-readable media, each computer having at least one hardware processor, the intrusion detection system further comprising:

• a transmission control protocol module adapted to receive queries as to whether the intrusion detection system is aware of a network security threat associated with at least one identifier specified by each respective query, each identifier identifying a possible network security threat;
• logic to determine for each query whether the query is of a first type, that is to be responded to within a predetermined period of time, or of a second type, that does not require response within the predetermined period of time;
• and
• a memory manager adapted to determine for each respective query determined to be of the first type whether a fast access memory has a record associating the network security threat that matches the at least one specified identifier, and if the fast access memory does have such a record, to responsively transmit a response via the transmission control protocol module to a source of the respective query which identifies the network security threat;
• wherein the memory manager is adapted to, in the event the fast access memory does not have such a record, transmit an indication to the source of the query that the data is not stored in the fast access memory, via packet-based wide area transmission, within the period of time, and generate a first request, transmit the first request to at least one other network data source to asynchronously load the fast access memory with the data responsive to the query, and asynchronously update the fast access memory to reflect data from the at least one other network data source retrieved responsive to the query in a manner adapted for use in responding to a future, similar query, and
• wherein the memory manager is adapted to for each respective query determined to be of the second type, generate a second request, transmit the second request to at least one other network data source to retrieve data responsive to the query, receive one or more responses to the second request, and to responsively transmit a response via the transmission control protocol module responsive to the respective query of the second type representing the one or more responses to the second request.

A method comprising:

• using at least one computer, each computer comprising at least hardware processor, to determine whether a query received via a wide area network is of a first type that requires response within a predetermined period of time, or of a second type that does not require response within the predetermined period of time, wherein the query has at least one field having an identifier of a possible network security threat;
• if the query is determined to be of the first type, using the at least one computer to determine whether data responsive to the query and is stored in a fast access memory by attempting to match the identifier with at least one data record stored in the fast access memory;
• if the query is determined to require response within the predetermined period of time and if the data is stored in the fast access memory, using the at least one computer to automatically transmit a response to the query within the period of time to a source of the query;
• if the query is determined to be of the first type and if the data is not stored in the fast access memory, using the at least one computer to
• transmit an indication within the period of time that the data is not stored in the fast access memory to the source of the query, and
• automatically generate a first request, transmit the first request to at least one other network data source to retrieve data responsive to the query, and asynchronously update the fast access memory to reflect data from the at least one other network data source retrieved responsive to the query;
• and,
• if the query is determined to be of the second type, to collect responses from one or more remote data sources and respond to the query only follow receipt of the responses from the one or more remote data sources.