Back to results
US 9,811,927 B2Granted
Universal actor correlator
AssigneeClick Security, Inc.
InventorsVictoria L. Rowland, Brian Smith
Life of this patent
Estimating the term…
Abstract
Precorrelation of data applied to use cases by a module intermediate to the data and use cases provides normalized data across multiple sources for more effective analysis. For example, network sensors provide network telemetry to a precorrelation core, which extracts and normalizes the data to correlate actors to events. Universal actor correlation improves visualizations by creating a mesh of events tied to each other through a common actor.
Claims11
A network security system comprising:
- plural network sensors at plural locations operable to detect network telemetry information and stream the network telemetry information to a network location, the network telemetry information including events, each event having at least one of plural types of actor identifiers;
- and
- a precorrelation core stored in non-transitory memory and interfaced with the data source, the precorrelation core storing the network telemetry information in tables of random access memory by the types of actor identifier of each event, the precorrelation core associating events and actors by comparing actor identifiers for the tables to identify each event of different tables having common actor identifier information, wherein the network telemetry information tables include an IP address table and a type of event, the type of event is an authentication event, the precorrelation core operable to associate authentication events by dynamically assigned IP addresses;
- and
- a graphical user interface interfaced with the precorrelation core and operable to present the identified events of the different tables having common actor identifier information.
2 more elements
A method for monitoring network security, the method comprising:
- streaming network telemetry information from plural sensors to random access memory accessible by a precorrelation core;
- storing the network telemetry information as plural events in the random access memory, each of the plural events stored by type in one of plural tables based upon entity identifier information associated with each event;
- associating plural events of plural tables with a common entity by correlating entity identifier information in different tables, wherein the plural tables include an IP address table and a type of event, the type of event comprising an authentication event, the method further comprising associating authentication events by dynamically assigned IP addresses;
- and
- presenting a visualization of the association of the plural events by interconnecting nodes that share entity identifier information.
2 more elements
Dependencies are inferred from the claim text.