发明名称 |
STORING LOG DATA EFFICIENTLY WHILE SUPPORTING QUERYING TO ASSIST IN COMPUTER NETWORK SECURITY |
摘要 |
A logging system includes an event receiver and a storage manager. The receiver receives log data, processes it, and outputs a data “chunk.” The manager receives data chunks and stores them so that they can be queried. The receiver includes buffers that store events and a metadata structure that stores metadata about the contents of the buffers. The metadata includes a unique identifier associated with the receiver, the number of events in the buffers, and, for each “field of interest,” a minimum value and a maximum value that reflect the range of values of that field over all of the events in the buffers. A chunk includes the metadata structure and a compressed version of the contents of the buffers. The metadata structure acts as a search index when querying event data. The logging system can be used in conjunction with a security information/event management (SIEM) system. |
申请公布号 |
EP2097824(A2) |
申请公布日期 |
2009.09.09 |
申请号 |
EP20070870034 |
申请日期 |
2007.12.28 |
申请人 |
ARCSIGHT, INC. |
发明人 |
HUANG, WEI;TANG, WENTING;BEEDGEN, CHRISTIAN, F. |
分类号 |
G06F21/00;G06F11/34;G06F17/30;G06F21/55;H04L12/24;H04L12/26 |
主分类号 |
G06F21/00 |
代理机构 |
|
代理人 |
|
主权项 |
|
地址 |
|