# US 9,811,927 B2 · Universal actor correlator > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,811,927 B2 - Document ID: US9811927B2 - Status: Granted - Kind: B2 - Application number: 14/633,925 - Filed: 2015-02-27 - Published: 2015-10-08 - Granted: 2017-11-07 - Earliest claimed: 2013-03-15 - Assignees: Click Security, Inc. - Applicants: Click Security, Inc. - Inventors: Victoria L. Rowland; Brian Smith - Web page: https://patentgrep.com/patent/US9811927B2 ## CPC - G06T 11/26: Drawing of charts or graphs - G06F 21/60: Protecting data - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/104: {Grouping of entities} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Precorrelation of data applied to use cases by a module intermediate to the data and use cases provides normalized data across multiple sources for more effective analysis. For example, network sensors provide network telemetry to a precorrelation core, which extracts and normalizes the data to correlate actors to events. Universal actor correlation improves visualizations by creating a mesh of events tied to each other through a common actor. ## Claims ### Claim 1 A network security system comprising: plural network sensors at plural locations operable to detect network telemetry information and stream the network telemetry information to a network location, the network telemetry information including events, each event having at least one of plural types of actor identifiers; and a precorrelation core stored in non-transitory memory and interfaced with the data source, the precorrelation core storing the network telemetry information in tables of random access memory by the types of actor identifier of each event, the precorrelation core associating events and actors by comparing actor identifiers for the tables to identify each event of different tables having common actor identifier information, wherein the network telemetry information tables include an IP address table and a type of event, the type of event is an authentication event, the precorrelation core operable to associate authentication events by dynamically assigned IP addresses; and a graphical user interface interfaced with the precorrelation core and operable to present the identified events of the different tables having common actor identifier information. ### Claim 2 (depends on 1) The network security system of claim 1 wherein the graphical user interface further comprises a fan out graphical user interface depicting events as nodes related to each other with interconnecting lines. ### Claim 3 (depends on 1) The network security system of claim 1 wherein the network telemetry information tables include at least a table having an IP address actor identifier, a table having an IP address and hostname actor identifier, and a table having an IP address, hostname and user name actor identifier. ### Claim 4 (depends on 1) The network security system of claim 1 wherein the precorrelation core further stores the network telemetry information in tables by the type of event and type of actor identifier. ### Claim 5 (depends on 4) The network security system of claim 4 wherein the type of event further includes at least a flow event, an access event, a security event, and a policy event. ### Claim 6 (depends on 1) The network security system of claim 1 wherein the precorrelation core identifies real identities, each real identity including one or more masquerade identities, the one or more masquerade identities associated with the real identities by temporal statistical analysis. ### Claim 7 A method for monitoring network security, the method comprising: streaming network telemetry information from plural sensors to random access memory accessible by a precorrelation core; storing the network telemetry information as plural events in the random access memory, each of the plural events stored by type in one of plural tables based upon entity identifier information associated with each event; associating plural events of plural tables with a common entity by correlating entity identifier information in different tables, wherein the plural tables include an IP address table and a type of event, the type of event comprising an authentication event, the method further comprising associating authentication events by dynamically assigned IP addresses; and presenting a visualization of the association of the plural events by interconnecting nodes that share entity identifier information. ### Claim 8 (depends on 7) The method of claim 7 wherein the presenting a visualization further comprises depicting a fan out graph that interrelates at least first and second nodes having no common identifier information. ### Claim 9 (depends on 7) The method of claim 7 wherein storing the network telemetry information further comprises storing the network telemetry information in one of at least a table having an IP address entity identifier, a table having an IP address and hostname entity identifier, and a table having an IP address, hostname and user name entity identifier. ### Claim 10 (depends on 7) The method of claim 7 wherein storing the network telemetry information further comprises storing the network telemetry information in tables by the type of event and type of actor identifier. ### Claim 11 (depends on 10) The method of claim 10 wherein the type of event further includes at least a flow event, an access event, a security event, and a policy event.