Automated Security Analytics Platform with Multi-Level Representation Conversion for Space Efficiency and Incremental Persistence

摘要

Active memory for managing network telemetry information, or other types of information stored as objects, has objects partially-serialized to allow greater amounts of information to store in a memory of a given size with slightly increased retrieval times. Storing additional information in an active memory provides an overall increase in network security platform responsiveness by allowing a greater amount of information to be accessible from the active memory instead of archive.

主权项

1. A method for managing network information stored in an active memory for interaction with a network security platform, the method comprising:
storing the network information as plural objects in the active memory in non-serialized form; accessing at least some of the plural objects from the active memory with the network security platform; selectively converting less than all of the plural objects into a serialized form for storage in the active memory; and accessing at least some of the less than all of the plural objects that were converted into serialized form with the network security platform from the active memory to detect a network security threat, the accessing performed at least in part by converting the at least some of the less than all of the plural objects from the serialized form to the non-serialized form.