Automated security analytics platform with multi-level representation conversion for space efficiency and incremental persistence
View Patent ↗Active memory for managing network telemetry information, or other types of information stored as objects, has objects partially-serialized to allow greater amounts of information to store in a memory of a given size with slightly increased retrieval times. Storing additional information in an active memory provides an overall increase in network security platform responsiveness by allowing a greater amount of information to be accessible from the active memory instead of archive.
1. A system for managing network information stored in an active memory for interaction with a network security platform, the system comprising:
a processor operable to process the network information by executing the network security platform to retrieve the network information from the active memory;
an active memory interfaced with the processor, the active memory storing the network information for access by the processor;
a memory allocation module interfaced with the active memory and operable to convert one or more selected objects of the network information in the active memory from fully-realized objects to partially-serialized objects, the one or more selected objects of the network information stored in only one of the fully-realized object or partially-serialized object form to reduce the amount of memory used to store the network information;
wherein the network information is selected to be converted based upon one or more predetermined factors and the memory allocation module converts network information from partially-serialized objects back into fully-realized objects if the network security platform requests the network information after conversion from fully-realized objects into partially-serialized objects, the network security platform analyzing the network information in the fully-realized object form to detect network security threats.
2. The system of claim 1 wherein the active memory comprises dynamic random access memory.
3. The system of claim 2 wherein the memory allocation module selectively converts the network information by:
maintaining at least some of the plural objects with attribute values having fully-realized objects; and
converting at least some of the plural objects from attribute values having fully-realized objects to objects stored in serialized form without per-object overhead.
4. The system of claim 2 wherein the memory allocation module selectively converts the network information by:
maintaining at least some of the plural objects with attribute values having fully-realized objects; and
converting at least some of the plural objects from attribute values having fully-realized objects to a fully serialized object with shared context to interpret the serialized representation.
5. The system of claim 2 wherein the memory allocation module selectively converts the network information by:
maintaining at least some of the plural objects with attribute values having fully-realized objects; and
converting at least some of the plural objects from attributes having full-realized objects to plural fully serialized objects compressed into one or more pages.
6. The system of claim 2 wherein the predetermined conditions comprise an anticipated access time for the network information.
7. The system of claim 2 wherein the predetermined conditions comprise the complexity of attribute values of the fully-realized objects.