SYSTEM AND METHOD FOR MANAGING NETWORK AND SECURITY EVENTS VIA SUPERIMPOSING DATA

摘要

An integrated network flow and security information management system and method is provided, more particularly, an integrated network flow and security information management system and method which leverages a process of superimposing and cross referencing common events and attributes in order to increase the speed of searches, completeness of searches and size of dataset (flow data). In particular, the process of superimposing may increase the amount of information that can be processed, while accelerating the search, thereby providing the user with more responsive acts of pivoting and scoping leading to a more complete response to network errors and threats.

主权项

1. A method for gathering a plurality of data and representing the results, the method comprising:
collecting events sharing the same derived key in a pre-defined sliding window; superimposing the events in the pre-defined sliding window into a single record to form superimposed events; and superimposing attributes from the plurality of data into an aggregated summary structure to form superimposed attributes. superimposed tags with results prior to results being delivered to the user or requesting process