Granted Patent B2

US 8,949,181 · App. 11/355,044 · Granted Feb 3, 2015

Abstract

Claims (45)

1. A system for enabling users to arrange input data according to a set time of input creation comprising:

a means for storing input data wherein said input data represents computer network events,

a working memory comprising a statevar and a scheduler comprising an update thread and a stack;

wherein the statevar is configured to notify the scheduler of input data changes;

wherein the statevar comprises at least one element of a hash table of the working memory;

wherein the scheduler is configured to modify at least one value of the statevar;

wherein the scheduler is configured to notify the stack of changes in the statevar; and

wherein the update thread tracks changes to the statevar.

2. The system of claim 1 wherein the working memory further comprises a set of threshold variables, wherein each threshold variable comprises:

a timeline comprising time periods, the time periods comprising at least one current time period, at least one future time period, at least one past time period, and a history time period,

wherein the time periods each comprise a plurality of time frames.

3. The system of claim 2 wherein the threshold variables are configured to trigger tuples in an over threshold breach scenario, the over threshold breach scenario occurring when a number of input values received by the threshold variable per time period becomes equal to a set threshold value.

4. The system of claim 2 wherein the threshold variables are configured to trigger tuples in a time over threshold scenario, the time over threshold scenario occurring when a number of input values received by the threshold variable per time period becomes equal to or greater than a set threshold value for a set amount of time.

5. The system of claim 2 wherein:

the system is configured to identify the threshold variables by a named location in the working memory; and the system is configured to increment the threshold variables.

6. The system of claim 5 wherein the system indexes the threshold variables by an alert type.

7. The system of claim 5 wherein the system indexes the threshold variables by a tuple type.

8. The system of claim 2 wherein:

the threshold variables are configured to maintain data and the data's type associated with an event; and the threshold variables are configured to maintain a time slice in which the data was received.

9. The system of claim 1 wherein the system is configured to identify the statevar by a named location in working memory.

10. The system of claim 1 wherein the system is configured to change the value of the statevar by a terminal node from a match network.

11. The system of claim 1 wherein statevar is hashed by zero or more data constraints in a merged-key configuration.

12. The system of claim 1 wherein:

the statevar is configured to create a tuple;

the tuple comprises accumulated data; and

the system comprises a match network that processes the accumulated data.

13. A process for allocating inputs within a timeline comprising:

receiving an input within a response window wherein said input represents a computer network event;

in response to receiving the input within the response window, updating a timeline and calculating a time period to increment;

determining whether a distinct field occurs;

in response to the distinct field not occurring, incrementing a period count;

after incrementing the period count, determining whether the process has reached an end of the period count;

after reaching the end of the period count, entering a threshold sub-routine.

14. The process of claim 13 , wherein the threshold sub-routine comprises:

comparing an under threshold to the response window;

in response to the under threshold being greater than the response window, determining whether the under threshold is less than a time over threshold;

in response to the under threshold not being less than the time over threshold, determining whether the under threshold has become greater than a threshold variable count;

in response to the under threshold being greater than the threshold variable count, finding a next under threshold and determining whether the threshold sub-routine passed an over threshold;

in response to the threshold sub-routine having passed an over threshold, creating a bridge with another threshold and dropping the time over threshold.

15. The process of claim 13 , wherein the threshold sub-routine comprises:

determining whether a time period is equal to a threshold value;

in response to the time period not being equal to the threshold value, determining whether the time period, minus one, is equal to or greater than the threshold value;

in response to the time period, minus one, not being equal to or greater than the threshold value, searching for either an under threshold or high response window;

in response to finding either the under threshold or high response window, raising a threshold flag, storing an over threshold in a time period state, adding an element to a time over threshold table, and searching for the over threshold;

in response to finding the over threshold, searching for either an under threshold or high response window.

Assignments (9)