Back to results
US 9,071,637 B2Granted
Automated security analytics platform
AssigneeClick Security, Inc.
InventorsBrian Smith, Marc Willebeek-LeMair
Life of this patent
Estimating the term…
Abstract
A network security platform stores network telemetry information in an active memory, such as DRAM, and analyzes the network telemetry information to detect and respond to network security threats. Using a common active memory to store sensed network telemetry information and analyze that information provides a real-time dataflow engine for detecting security threats and neutralizing detected threats.
Claims20
A method for maintaining network security, the method comprising:
- sensing network telemetry information at plural network resources;
- communicating the network telemetry information to an active memory interfaced with a processor, the processor executing plural network security modules, each network security module having an input specification, an output specification and a logic specification, the logic specification defining a memory allocation in the active memory for each of the security modules;
- and
- maintaining network security by investigating network telemetry information with one or more of the security modules using the telemetry information stored in the active memory to detect network security threats and by neutralizing the detected network security threats with one or more of the security modules in response to detecting of predetermined network telemetry information in the active memory;
- wherein the output of the one or more security modules that investigate network telemetry information is linked to the input of the one or more modules that neutralize the detected network security threats with a publish and subscribe relationship defined with tables in the active memory.
2 more elements
A system for maintaining network security, the system comprising:
- one or more processors operable to process information;
- a network interface operable to receive network telemetry information;
- an active memory operable to store predetermined of the network telemetry information in one or more tables;
- plural network security modules operable to execute on the processor to investigate and neutralize network security operations with information stored in the active memory;
- and
- a memory allocation module interfaced with the active memory and the network security modules, the memory allocation module operable to associate each network security module with one or more tables in an allocated area of the active memory, at least one network security module subscribed to a table that stores network telemetry information used as an input by the network security module and that receives the network telemetry information substantially as the network telemetry information is received at the network interface, the at least one network security module publishing investigation results of the network telemetry information to one or more tables subscribed to by another network security module that a neutralizes network threat.
3 more elements
A non-transitory machine readable medium comprising instructions operable to:
- receive network telemetry information from network resources;
- selectively store the network telemetry information to a predetermined area of an active memory only if the network telemetry information matches an input specification for at least one of plural network security modules;
- and
- activate one or more of the plural network security modules to process network telemetry information, the activating in response to the storing of the network telemetry information in the predetermined area associated with the one or more of the plural network security modules, the activating initiated by publication of network telemetry information to the predetermined area of the active memory and subscription of the at least one of the plural network security modules to predetermined area of the active memory.
1 more element
Dependencies are inferred from the claim text.