IP Library › Granted Patent US 12705223

Granted Patent B2

US 12705223 · App. 17/902,628 · Granted Aug 11, 2026

Selective addition of datum to a tree data structure

Inventors: Daniel W. Brown (Ipswich, MA); Johnathan Hoyt (Reading, MA); Sseziwa A. Mukasa (Salem, MA); Thomas R. Hobson (Brookline, MA)

Assignee: Crowdstrike, Inc.

G06F16/2246 G06F16/2379

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12705223
App. No.: 17/902,628
Granted: Aug 11, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A value is assigned to a rate threshold for adding child nodes to a distinct parent node in a tree data structure. A first datum comprising a first variable assigned a first value and a second variable assigned a first value is added to the tree at a first timestamp, by adding to the first level in the tree a first parent node representing the first variable assigned the first value and adding to the second level in the tree a first child node representing the second variable assigned the first value and connected by a first directed edge from the first parent node. A second datum comprising the first variable assigned the first value and the second variable assigned a second value is received at a second timestamp. The method blocks adding to the second level in the tree a second child node representing the second variable assigned the second value and connected by a second directed edge from the first parent node when a rate based on the first timestamp and the second timestamp exceeds the rate threshold.

Claims (62)

1 . A computer-implemented method for adding datum comprising a plurality of associated or related variables to a tree data structure (“tree”), in which a first level in the tree comprises a plurality of parent nodes, each parent node representing a distinct one of a plurality of values for a first of the plurality of variables, and in which a second level in the tree comprises a plurality of child nodes, each child node representing a distinct one of a plurality of values for a second of the plurality of variables that is different than the first of the plurality of variables, and each child node connected by a directed edge with one of the plurality of parent nodes where a distinct one of the plurality of values for the first of the plurality of variables is associated with or related to the distinct one of the plurality of values for the second of the plurality of variables, the computer-implemented method comprising:

identifying and selectively blocking adding to the tree datum comprising a plurality of associated or related variables relating to a user logging in to a plurality of computers to distribute software to or update software on the plurality of computers, or datum comprising a plurality of associated or related variables relating to a plurality of users all logging in to a same computer used as a bastion host, while limiting memory allocated to the tree, limiting computing resources allocated to accessing the tree in memory, and increasing a probability of successfully searching for datum comprising a plurality of associated and related variables relating to unique, infrequent, distinct, or anomalous events, by identifying and selectively adding to the tree datum comprising the plurality of associated and related variables relating to the unique, infrequent, distinct, or anomalous events, by:

for each of the plurality of parent nodes in the first level in the tree:

assigning a value to a respective one of a plurality of rate threshold variables for adding child nodes to the parent node in the tree;

adding, at a first timestamp (t1), a first datum, comprising a first variable (a) assigned a first value (a1) and a second variable (b) assigned a first value (b1), to the tree, by adding to the first level in the tree the parent node representing the first variable (a) assigned the first value (a1) and then adding to the second level in the tree a first child node representing the second variable (b) assigned the first value (b1) and connected by a first directed edge with the parent node where the first variable (a) assigned the first value (a1) is associated with or related to the second variable (b) assigned the first value (b1);

receiving at a second timestamp (t2) a second datum comprising the first variable (a) assigned the first value (a1) and the second variable (b) assigned a second value (b2) that is distinct from the first value (b1) assigned to the second variable of the first datum;

blocking, when a rate based on the first timestamp (t1) and the second timestamp (t2) exceeds the value assigned to the respective rate threshold variable, adding to the second level in the tree a second child node representing the second variable (b) assigned the second value (b2) and connected by a second directed edge with the parent node where the first variable (a) assigned the first value (a1) is associated with or related to the second variable (b) assigned the second value (b2); and

adding, when the rate based on the first timestamp (t1) and the second timestamp (t2) is less than the value assigned to the respective rate threshold variable, to the second level in the tree the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node where the first variable (a) assigned the first value (a1) is associated with or related to the second variable (b) assigned the second value (b2).

2 . The method of claim 1 , wherein adding, at the first timestamp (t1), the first datum, comprising the first variable (a) assigned the first value (a1) and the second variable (b) assigned the first value (b1), to the tree, further comprises assigning to a first attribute (last added child node) associated with the parent node a value indicating the first child node is a last child node added and connected by a directed edge with the parent node at the first timestamp (t1).

3 . The method of claim 2 , wherein blocking, when the rate based on the first timestamp (t1) and the second timestamp (t2) exceeds the value assigned to the respective rate threshold variable, adding to the second level in the tree the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node, further comprises assigning to a second attribute (last block state) associated with the parent node a value indicating that a last attempt to add a child node connected by a directed edge with the parent node was blocked at the second timestamp (t2).

4 . The method of claim 1 , wherein adding the first datum to the tree comprises:

receiving at the first timestamp (t1) the first datum comprising the first variable (a) assigned the first value (a1) and the second variable (b) assigned the first value (b1);

searching the first level in the tree for, and when not found, adding to the first level in the tree, the parent node representing the first variable (a) assigned the first value (a1); and

searching the second level in the tree for, and when not found, adding to the second level in the tree, the first child node representing the second variable (b) assigned the first value (b1) and connected by the first directed edge with the parent node.

5 . The method of claim 1 , wherein blocking, when the rate based on the first timestamp (t1) and the second timestamp (t2) exceeds the value assigned to the respective rate threshold variable, adding to the second level in the tree the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node, comprises:

searching the second level in the tree for the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node, and when not found,

when the rate based on the first timestamp (t1) and the second timestamp (t2) exceeds the value assigned to the respective rate threshold variable, blocking adding to the second level in the tree the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node.

6 . The method of claim 5 , wherein searching the second level in the tree for the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node, and when not found, the method further comprising:

when the rate based on the first timestamp (t1) and the second timestamp (t2) is below the rate threshold, adding to the second level in the tree the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node.

7 . The method of claim 6 , further comprising assigning to a first attribute (last added child node) associated with the parent node a value indicating the second child node is a last child node added and connected by a directed edge with the parent node at the second timestamp (t2).

8 . The method of claim 7 , further comprising assigning to a second attribute (last block state) associated with the parent node a value indicating that a last attempt to add a child node connected by a directed edge with the parent node was allowed at the second timestamp (t2).

9 . The method of claim 3 , further comprising:

receiving at a third timestamp (t3) a third datum comprising the first variable (a) assigned the first value (a1) and the second variable (b) assigned a third value (b3) that is distinct from the first value (b1) assigned to the second variable of the first datum;

blocking, when a rate based on the second timestamp (t2) and the third timestamp (t3) exceeds the value assigned to the respective rate threshold variable, adding to the second level in the tree a second child node representing the second variable (b) assigned to the third value (b3) and connected by a second directed edge with the parent node; and

assigning to the second attribute (last block state) associated with the parent node a value indicating that a last attempt to add a child node connected by a directed edge with the parent node was blocked at the third timestamp (t3).

10 . The method of claim 9 , wherein blocking, when the rate based on the second timestamp (t2) and the third timestamp (t3) exceeds the value assigned to the respective rate threshold variable, adding to the second level in the tree the second child node representing the second variable (b) assigned the third value (b3) and connected by the second directed edge with the parent node, comprises:

searching the second level in the tree for the second child node representing the second variable (b) assigned the third value (b3) and connected by the second directed edge with the parent node, and when not found,

when the rate based on the second timestamp (t2) assigned to the first attribute (last added child node) or the second attribute (last block state), and the third timestamp (t3), exceeds the value assigned to the respective rate threshold variable,

assigning to the second attribute (last block state) associated with the parent node a value indicating that the last attempt to add a child node connected by a directed edge with the parent node was blocked at the third timestamp (t3).

11 . The method of claim 10 , wherein searching the second level in the tree for a second child node representing the second variable (b) assigned the third value (b3) and connected by the second directed edge with the parent node and when not found, further comprises:

when the rate based on the second timestamp (t2) assigned to the first attribute (last added child node) or the second attribute (last block state), and the third timestamp (t3), is below the value assigned to the respective rate threshold variable:

adding to the second level in the tree the second child node representing the second variable (b) assigned the third value (b3) and connected by the second directed edge with the parent node; and

12 . The method of claim 9 , wherein searching the second level in the tree for the second child node representing the second variable (b) assigned the third value (b3) and connected by the second directed edge with the parent node and when not found, when the rate based on the second timestamp (t2) assigned to the first attribute (last added child node) or the second attribute (last block state), and the third timestamp (t3), exceeds the value assigned to the respective rate threshold variable, further comprises assigning to the first attribute (last added child node) associated with the parent node a null value or deleting the first attribute.

13 . The method of claim 1 , wherein assigning the value to the respective rate threshold variable for adding child nodes to the parent node in the tree, comprises assigning the value to the respective rate threshold variable responsive to a current rate at which child nodes are being added to the parent node.

14 . The method of claim 4 , wherein searching the second level in the tree for, and when not found, adding to the second level in the tree, the first child node representing the second variable (b) assigned the first value (b1) and connected by the first directed edge with the parent node, further comprises assigning to the second attribute (last block state) associated with the parent node a value indicating that a last attempt to add a child node connected by a directed edge with the parent node was allowed at the first timestamp (t1).

15 . A non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to add datum comprising a plurality of associated or related variables to a tree data structure (“tree”), in which a first level in the tree comprises a plurality of parent nodes, each parent node representing a distinct one of a plurality of values for a first of the plurality of variables, and in which a second level in the tree comprises a plurality of child nodes, each child node representing a distinct one of a plurality of values for a second of the plurality of variables that is different than the first of the plurality of variables, and each child node connected by a directed edge with one of the plurality of parent nodes where a distinct one of the plurality of values for the first of the plurality of variables is associated with or related to the distinct one of the plurality of values for the second of the plurality of variables, the instructions to cause the one or more processors to perform operations comprising:

for each of the plurality of parent nodes in the first level of the tree:

assigning a value to a rate threshold for adding child nodes to a distinct parent node in the tree;

16 . The non-transitory computer-readable media of claim 15 , wherein adding, at the first timestamp (t1), the first datum, comprising the first variable (a) assigned the first value (a1) and the second variable (b) assigned the first value (b1), to the tree, further comprises assigning to a first attribute (last added child node) associated with the parent node a value indicating the first child node is a last child node added and connected by a directed edge with the parent node at the first timestamp (t1).

17 . The non-transitory computer-readable media of claim 16 , wherein blocking, when the rate based on the first timestamp (t1) and the second timestamp (t2) exceeds the value assigned to the respective rate threshold variable, adding to the second level in the tree the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge the parent node, further comprises assigning to a second attribute (last block state) associated with the parent node a value indicating that a last attempt to add a child node connected by a directed edge with the parent node was blocked at the second timestamp (t2).

18 . The non-transitory computer-readable media of claim 15 , wherein blocking, when the rate based on the first timestamp (t1) and the second timestamp (t2) exceeds the rate threshold, adding to the second level in the tree the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node, comprises:

19 . The non-transitory computer-readable media of claim 18 , wherein searching the second level in the tree for the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node, and when not found, further comprising:

when the rate based on the first timestamp (t1) and the second timestamp (t2) is below the value assigned to the respective rate threshold variable, adding to the second level in the tree the second child node representing the second variable (b) assigned the second value (b2) and connected by the second directed edge with the parent node.

20 . The non-transitory computer-readable media of claim 17 , further comprising:

21 . A computer-implemented method for adding datum comprising a user variable and a host variable to a tree data structure (“tree”), in which a first level in the tree comprises a plurality of parent nodes, each parent node representing a distinct one of a plurality of values for the user variable that identifies a distinct one of a plurality of users, and in which a second level in the tree comprises a plurality of child nodes, each child node representing a distinct one of a plurality of values for the host variable that identifies a distinct one of a plurality of hosts and connected by a directed edge from one of the plurality of parent nodes where a user identified by the distinct one of the plurality of values for the user variable has logged on to a host identified by the distinct one of the plurality of values for the host variable, the computer-implemented method comprising:

for each of the plurality parent nodes in the first level in the tree:

assigning a value to a respective one of a plurality of rate threshold variables for adding child nodes to the parent node in the tree;

adding, at a first timestamp, a first datum, comprising a user variable assigned a first value identifying a distinct one of the plurality of users and a host variable assigned a first value identifying a first distinct one of the plurality of hosts, to the tree, by adding to the first level in the tree the parent node representing the user variable assigned the first value identifying the distinct one of the plurality of users and then adding to the second level in the tree a first child node representing the host variable assigned the first value identifying the distinct one of the plurality of hosts and connected by a first directed edge with the parent node where the distinct one of the plurality of users identified by the first value for the user variable has logged on to the first distinct one of the plurality of hosts identified by the first value assigned to the host variable;

receiving at a second timestamp a second datum comprising a user variable assigned the first value identifying the distinct one of the plurality of users and a host variable assigned a second value identifying a second distinct one of the plurality of hosts different than the first value identifying the first distinct one of the plurality of hosts assigned to the host variable of the first datum; and

blocking, when a rate based on the first timestamp and the second timestamp exceeds the value assigned to the respective rate threshold variable, adding to the second level in the tree a second child node representing the host variable assigned the second value identifying the second distinct one of the plurality of hosts and connected by a second directed edge with the parent node where the distinct one of the plurality of users identified by the first value for the user variable has logged on to the second distinct one of the plurality of hosts identified by the second value assigned to the host variable.