# US 9,306,947 B2 · Automated security analytics platform with multi-level representation conversion for space efficiency and incremental persistence

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,306,947 B2
- Document ID: US9306947B2
- Status: Granted
- Kind: B2
- Application number: 13/677,152
- Filed: 2012-11-14
- Published: 2014-05-15
- Granted: 2016-04-05
- Earliest claimed: 2012-11-14
- Assignees: Click Security, Inc.
- Applicants: Click Security, Inc.
- Inventors: Donovan Kolbly
- Web page: https://patentgrep.com/patent/US9306947B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 15/167: using a common memory, e.g. mailbox
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Active memory for managing network telemetry information, or other types of information stored as objects, has objects partially-serialized to allow greater amounts of information to store in a memory of a given size with slightly increased retrieval times. Storing additional information in an active memory provides an overall increase in network security platform responsiveness by allowing a greater amount of information to be accessible from the active memory instead of archive.

## Claims

### Claim 1

A system for managing network information stored in an active memory for interaction with a network security platform, the system comprising:
a processor operable to process the network information by executing the network security platform to retrieve the network information from the active memory;
an active memory interfaced with the processor, the active memory storing the network information for access by the processor;
a memory allocation module interfaced with the active memory and operable to convert one or more selected objects of the network information in the active memory from fully-realized objects to partially-serialized objects, the one or more selected objects of the network information stored in only one of the fully-realized object or partially-serialized object form to reduce the amount of memory used to store the network information;
wherein the network information is selected to be converted based upon one or more predetermined factors and the memory allocation module converts network information from partially-serialized objects back into fully-realized objects if the network security platform requests the network information after conversion from fully-realized objects into partially-serialized objects, the network security platform analyzing the network information in the fully-realized object form to detect network security threats.

### Claim 2 (depends on 1)

The system of claim 1 wherein the active memory comprises dynamic random access memory.

### Claim 3 (depends on 2)

The system of claim 2 wherein the memory allocation module selectively converts the network information by:
maintaining at least some of the plural objects with attribute values having fully-realized objects; and
converting at least some of the plural objects from attribute values having fully-realized objects to objects stored in serialized form without per-object overhead.

### Claim 4 (depends on 2)

The system of claim 2 wherein the memory allocation module selectively converts the network information by:
maintaining at least some of the plural objects with attribute values having fully-realized objects; and
converting at least some of the plural objects from attribute values having fully-realized objects to a fully serialized object with shared context to interpret the serialized representation.

### Claim 5 (depends on 2)

The system of claim 2 wherein the memory allocation module selectively converts the network information by:
maintaining at least some of the plural objects with attribute values having fully-realized objects; and
converting at least some of the plural objects from attributes having full-realized objects to plural fully serialized objects compressed into one or more pages.

### Claim 6 (depends on 2)

The system of claim 2 wherein the predetermined conditions comprise an anticipated access time for the network information.

### Claim 7 (depends on 2)

The system of claim 2 wherein the predetermined conditions comprise the complexity of attribute values of the fully-realized objects.