Granted Patent B2

US 9,071,637 · App. 13/677,121 · Granted Jun 30, 2015

Abstract

Claims (54)

1. A method for maintaining network security, the method comprising:

sensing network telemetry information at plural network resources;

communicating the network telemetry information to an active memory interfaced with a processor, the processor executing plural network security modules, each network security module having an input specification, an output specification and a logic specification, the logic specification defining a memory allocation in the active memory for each of the security modules; and

maintaining network security by investigating network telemetry information with one or more of the security modules using the telemetry information stored in the active memory to detect network security threats and by neutralizing the detected network security threats with one or more of the security modules in response to detecting of predetermined network telemetry information in the active memory;

wherein the output of the one or more security modules that investigate network telemetry information is linked to the input of the one or more modules that neutralize the detected network security threats with a publish and subscribe relationship defined with tables in the active memory.

2. The method of claim 1 further comprising:

identifying the network telemetry information associated with the input specification of each network security module; and

storing the identified network telemetry information to active memory allocated to each of the network security modules based on the association of the identified network telemetry information with active memory allocated for the network security modules.

3. The method of claim 2 further comprising:

maintaining the network security modules in an inactive state;

detecting storage of information to active memory; and

activating each of the network security modules only in response to detecting of storage of information to active memory associated with the network security modules.

4. The method of claim 3 further comprising:

determining that the storage of information to active memory exceeds the active memory allocated to one of the network security modules; and

in response to determining, discarding the oldest information stored in active memory allocated to the one of the network security modules.

5. The method of claim 4 wherein discarding the oldest information stored in active memory comprises:

deleting the information from the active memory; and

communicating the information to a database for analysis.

6. The method of claim 2 further comprising:

identifying at least some of the network telemetry information lacking an association with any of the input specifications of the network security modules; and

discarding the at least some of the network telemetry information from the active memory.

7. The method of claim 6 wherein discarding further comprises storing the at least some of the network telemetry information in a database for analysis.

8. The method of claim 2 wherein maintaining network security further comprises investigating network telemetry information with one or more of the security modules using one or more outputs of one or more security modules.

9. The method of claim 1 further comprising:

monitoring the active memory usage by each of the network security modules; and

altering the active memory associated with one or more of the network security modules based upon the active memory usage.

10. A system for maintaining network security, the system comprising:

one or more processors operable to process information;

a network interface operable to receive network telemetry information;

an active memory operable to store predetermined of the network telemetry information in one or more tables;

plural network security modules operable to execute on the processor to investigate and neutralize network security operations with information stored in the active memory; and

a memory allocation module interfaced with the active memory and the network security modules, the memory allocation module operable to associate each network security module with one or more tables in an allocated area of the active memory, at least one network security module subscribed to a table that stores network telemetry information used as an input by the network security module and that receives the network telemetry information substantially as the network telemetry information is received at the network interface, the at least one network security module publishing investigation results of the network telemetry information to one or more tables subscribed to by another network security module that a neutralizes network threat.

11. The system of claim 10 wherein the memory allocation module is further operable to:

maintain the network security modules in an inactive state;

activate each of the network security modules if network telemetry information is stored in the active memory allocated area associated with each network security module; and

return each network security module to an inactive state after processing the network telemetry information in the active memory allocated area.

12. The system of claim 10 wherein the active memory is random access memory.

13. The system of claim 10 wherein the memory allocation module is further operable to:

determine that storage of network telemetry information to active memory exceeds the capacity of one of the allocated areas; and

in response to determining, discard the oldest information stored in the one of the allocated areas.

14. The system of claim 10 wherein the memory allocation module is further operable to:

compare network telemetry information with inputs specifications of the network security modules; and

store network telemetry information in the active memory only if the network telemetry information matches an input specification for at least one network security module.

15. The system of claim 10 wherein the memory allocation module is further operable to alter the size of the allocated areas in response to usage of the allocated areas.

16. The system of claim 10 wherein the plural security modules investigate and neutralize network security operations with common network telemetry information stored in the allocated areas.

17. A non-transitory machine readable medium comprising instructions operable to:

receive network telemetry information from network resources;

selectively store the network telemetry information to a predetermined area of an active memory only if the network telemetry information matches an input specification for at least one of plural network security modules; and

activate one or more of the plural network security modules to process network telemetry information, the activating in response to the storing of the network telemetry information in the predetermined area associated with the one or more of the plural network security modules, the activating initiated by publication of network telemetry information to the predetermined area of the active memory and subscription of the at least one of the plural network security modules to predetermined area of the active memory.

18. The machine readable medium of claim 17 further comprising instructions operable to:

track the length of time that network telemetry information is stored in the active memory; and

discard network telemetry information after a predetermined length of time.

19. The machine readable medium of claim 17 wherein each network security module comprises an input specification, a logic specification and an output specification, and wherein at least one output specification of at least one network security module maps to an input specification of at least one network security module.

20. The machine readable medium of claim 19 wherein the logic specification of each network security module defines the size of the predetermined area of the active memory for storing network telemetry information defined by the associated input specification.

Assignments (14)