Security Event Routing In a Distributed Hash Table

摘要

Embodiments include components of a computer defense network (CND) architecture, e.g. a content addressable network (CAN) gateway, a CAN peer or a CND controller. The gateway is configured to receive from a host a security event log that includes a protocol tag, and to securely forward the log to a selected one of a plurality of CAN peers based on the protocol tag. The CAN peer is configured to configured to filter the events based on an assigned communication protocol, and to produce a security report from the filtered events. The CND controller is configured to receive the filtered report from the peer and to defend the network against a threat based on the report.

主权项

1. An apparatus, comprising:
a processor; a memory coupled to said processor and containing instructions that when executed configure the processor to:
receive from a host a security event log including a protocol tag; andsecurely forward the security event log, to a selected one of a plurality of peers in a distributed hash table (DHT), based on the protocol tag.