白丝美女被狂躁免费视频网站,500av导航大全精品,yw.193.cnc爆乳尤物未满,97se亚洲综合色区,аⅴ天堂中文在线网官网

Distributed digital security system

專利號
US11616790B2
公開日期
2023-03-28
申請人
CrowdStrike, Inc.(US CA Irvine)
發(fā)明人
David F. Diehl; Michael Edward Lusignan; Thomas Johann Essebier
IPC分類
H04L9/40; G06F16/2455; G06Q50/26
技術(shù)領(lǐng)域
event,data,security,engine,bounding,compute,rally,or,can,client
地域: CA CA Irvine

摘要

A distributed security system can include instances of a compute engine that can execute either locally in security agents on client devices or as cloud instances in a security network. Event data can be processed by elements of the distributed security system according to centrally-defined ontological definitions and/or configurations. Bounding managers of local security agents can control how much event data is sent to the security network. A storage engine in the security network can store event data received from client devices, can route event data to other elements of the security network, including cloud instances of the compute engine. An experimentation engine of the security network can also at least temporarily adjust other elements of the distributed security system during experiments or tests.

說明書

At block 408, the compute engine 102 can determine if a composition operation 302 applies to event data 122 in the event stream. As discussed above with respect to FIG. 3, the compute engine 102 may have criteria indicating when a composition operation 302 applies to event data 122. For example, the criteria may indicate that the composition operation 302 applies when event data 122 associated with a child process of a certain parent process is received, and/or that the composition operation 302 expects first event data 12 of a child process of the parent process to be received followed by second event data 122 of a child process of the parent process. If a composition operation 302 is found to apply to event data 122 at block 408, the compute engine 102 can move to block 410.

At block 410, the compute engine 102 can determine if a rally point 306 has been generated in association with the event data 122. If no rally point 306 has yet been generated in association with the event data 122, for example if the event data 122 is the first event data 122A as shown in FIG. 3, the compute engine 102 can create a rally point 306 at block 412 to store at least some portion of the event data 122, and the compute engine 102 can return to processing the event stream at block 402.

權(quán)利要求

1
微信群二維碼
意見反饋