Back to results
US 8,973,132 B2Granted
Automated security analytics platform with pluggable data collection and analysis modules
AssigneeClick Security, Inc.
InventorsBrian Smith, Donovan Kolbly, Marc Willebeek-LeMair
Life of this patent
Estimating the term…
Abstract
Pluggable network security modules provide a collaborative response across plural networks by allowing modules associated with detection and neutralization of a network security threat to plug into a network security platform of other networks. Plugging the security modules in provides an automated insertion of detection and neutralization tools into the network security platform to respond to potential threats based upon proven successful responses at other networks.
Claims18
A method for maintaining network security, the method comprising:
- distributing a network security platform to each of plural networks, each network security platform having a sensor execution environment and an analysis execution environment;
- monitoring network activity for each of the plural networks with plural sensor modules running on the sensor execution environment of each of the plural network security platforms, the plural sensor modules storing monitored network activity in random access memory accessible by the analysis execution environment, the storing performed by a rowcreate events in one or more tables of the analysis execution environment;
- detecting a network threat with one or more of plural analysis modules running on the analysis execution environment of one of the network security platforms, the analysis modules having access to the one or more of tables, each table having plural rows, the analysis modules further having one or more bindings, each binding having at least one handler associated with at least one table for responding to predetermined network activity indicated by a binding of the analysis module to the one or more tables, the sensor module providing a monitored network activity to the one or more tables, the detecting performed by analysis of the stored monitored network activity at the one network security platform, the analysis initiated by one or more of the rowcreate events, wherein one or more of the bindings of the one or more analysis modules to the one or more of the rowcreate events invokes the one or more analysis modules to execute logic that analyzes network activity stored by the rowcreate event;
- in response to the detecting, generating an output by the one or more analysis modules and performing a rowupdate to one or more of the tables with the output, the rowupdate of the output binding to another of the analysis modules to invoke logic that neutralizes the network threat;
- and
- in response to detecting the network threat, distributing the one or more of plural analysis modules associated with the detection of the threat to the analysis execution environment of one or more other of the network security platforms.
3 more elements
A system for maintaining network security, the system comprising:
- a processor operable to process information, the processor having integrated program memory;
- an active memory interfaced with the processor, the active memory storing network telemetry information accessible by the processor;
- a sensor execution environment defined in the processor and operable to run plural sensor modules that store network telemetry information to the active memory;
- an analysis execution environment defined in the processor and operable to run plural analysis modules that analyze network telemetry information for network security threats;
- wherein the plural sensor modules are further operable to store network telemetry information in a sensor table of the analysis execution environment with a rowcreate and wherein at least one of the plural analysis modules have one or more bindings that selectively invoke the at least one of the plural analysis modules in response to the rowcreate, the at least one of the plural analysis module initiating to analyze the network telemetry information as the sensor module stores the network telemetry information in the sensor table of the execution environment, the at least one of the plural analysis modules generating a threat output associated with a threat and storing the threat output in the active memory with a rowcreate, the threat output rowcreate invoking another of the plural analysis modules for neutralizing the threat by a binding of the another of the plural analysis modules to the threat output rowcreate so that monitoring, analysis and neutralization of the threat is performed in real time from the active memory.
2 more elements
A non-transitory machine readable medium comprising instructions operable to execute on a network security analysis execution environment to:
- create in random access memory one or more tables, each table having plural rows, each row providing a structured record mapping names to network sensor values according to a schema;
- apply one or more bindings having handlers associated with the one or more tables for responding to a network security event entered at the one or more tables, the one or more bindings invoking a first analysis module bound to predetermined of the tables by one or more rowcreate events;
- in response to invoking the first analysis module, retrieve native code of the first analysis module operable to reside in program memory of a processor for responding to the network security event;
- apply an interface operable to load the native code to the processor, the native code responding in real time to the network security events indicated by entries to one or more of the tables by analyzing the information entered in the one or more tables of the random access memory and bound to the analysis module and generating a threat output associated with a network threat;
- and
- storing the threat output in the random access memory with a rowcreate, the threat output rowcreate invoking a second analysis module for neutralizing the threat by a binding of the second analysis module to the threat output rowcreate so that monitoring, analysis and neutralization of the network threat is performed in real time from the random access memory.
3 more elements
Dependencies are inferred from the claim text.