Granted Patent B2

US 12,189,791 · App. 18/133,884 · Granted Jan 7, 2025

Inventors: David F. Diehl (Minneapolis, MN); James Robert Plush (Lake Forest, CA); Timothy Jason Berger (Eastvale, CA)

Assignee: CrowdStrike, Inc.

G06F21/60G06F9/542H04L63/0892H04L63/105H04L63/1408

Abstract

Claims (121)

1. A computer-implemented method comprising:

receiving, by a network storage engine of a security network, and from one or more security agents executing at one or more client devices remote from the network storage engine, first event data associated with one or more events that have occurred at the one or more client devices;

providing, by the network storage engine, a first copy of the first event data to a network compute engine of the security network;

receiving, by the network storage engine at a first time, and from the network compute engine, a claim check for second event data, wherein:

the second event data is related to the first event data, and

the second event data has, at the first time, not been received by the network storage engine or the network compute engine;

receiving, by the network storage engine at a second time, the second event data associated with the claim check;

determining, by the network storage engine, that the claim check has been satisfied based on receipt of the first event data and the second event data; and

providing, by the network storage engine in response to determining that the claim check has been satisfied, the second event data and a second copy of the first event data to the network compute engine.

2. The computer-implemented method of claim 1 , wherein the network compute engine is configured to provide the claim check to the network storage engine in response to the network compute engine receiving the first copy of the first event data.

3. The computer-implemented method of claim 1 , wherein the network compute engine:

is configured to determine whether a stream of event data provided by the one or more security agents to the network storage engine includes event data corresponding to a behavior pattern associated with the first event data and the second event data, and

sends the claim check to the network storage engine in response to determining that:

the first copy of the first event data associated with the behavior pattern has been received by the network compute engine from the network storage engine; and

the second event data associated with the behavior pattern has not yet been received by the network compute engine from the network storage engine.

4. The computer-implemented method of claim 1 , wherein:

the first event data is associated with a child process executed on a client device of the one or more client devices, and

the second event data is associated with a parent process, executed on the client device, that spawned the child process on the client device.

5. The computer-implemented method of claim 1 , wherein the network compute engine is configured to:

disregard the first copy of the first event data after providing the claim check to the network storage engine, and

process the second copy of the first event data along with the second event data provided by the network storage engine in response to determining that the claim check has been satisfied.

6. The computer-implemented method of claim 1 , further comprising:

receiving, by the network storage engine, third event data;

providing, by the network storage engine, the third event data to the network compute engine;

receiving, by the network storage engine at a third time, and from the network compute engine, a second claim check for fourth event data, wherein:

the fourth event data is related to the third event data, and

the fourth event data has, at the third time, not been received by the network storage engine or the network compute engine;

determining, by the network storage engine at a fourth time, that the second claim check has expired based on the fourth event data not having arrived by the fourth time; and

re-sending, by the network storage engine, the third event data to the network compute engine in response to determining that the second claim check has expired.

7. The computer-implemented method of claim 1 , further comprising:

receiving, by the network storage engine at a third time, and from the network compute engine, a second claim check for third event data, wherein:

the third event data is related to the first event data,

the third event data has, at the third time, not been received by the network storage engine or the network compute engine, and

the second claim check is related to the claim check associated with the first event data and the second event data;

receiving, by the network storage engine at a fourth time, the third event data associated with the second claim check;

determining, by the network storage engine, that the second claim check has been satisfied based on receipt of the first event data and the third event data; and

providing, by the network storage engine, the second event data, the third event data, and the second copy of the first event data to the network compute engine in response to determining that:

the claim check has been satisfied, and

the second claim check has been satisfied.

8. The computer-implemented method of claim 7 , wherein:

the first event data is associated with a child process executed on a client device of the one or more client devices,

the second event data is associated with a parent process, executed on the client device, that spawned the child process on the client device, and

the third event data is associated with a grandparent process, executed on the client device, that spawned the parent process on the client device.

9. The computer-implemented method of claim 1 , wherein the claim check is part of a group of related claim checks, and the computer-implemented method further comprises:

generating, by the network storage engine, a dependency graph indicating dependencies between claim checks in the group of related claim checks;

receiving, by the network storage engine, an instance of event data; and

identifying, by the network storage engine, one or more claim checks in the group of related claim checks that are associated with the instance of event data, based on traversing the dependency graph in response to receipt of the instance of event data.

10. A computing system comprising:

one or more processors; and

memory storing computer-executable instructions associated with a network storage engine of a security network that, when executed by the one or more processors, cause the computing system to perform operations comprising:

receiving, from one or more security agents executing at one or more client devices remote from the network storage engine, first event data associated with one or more events that have occurred at the one or more client devices;

providing a first copy of the first event data to a network compute engine of the security network;

receiving, at a first time, and from the network compute engine, a claim check for second event data, wherein:

the second event data is related to the first event data, and

the second event data has, at the first time, not been received by the network storage engine or the network compute engine;

receiving, at a second time, the second event data associated with the claim check;

determining that the claim check has been satisfied based on receipt of the first event data and the second event data; and

providing, in response to determining that the claim check has been satisfied, the second event data and a second copy of the first event data to the network compute engine.

11. The computing system of claim 10 , wherein:

the first event data is associated with a child process executed on a client device of the one or more client devices, and

the second event data is associated with a parent process, executed on the client device, that spawned the child process on the client device.

12. The computing system of claim 10 , wherein the operations further comprise:

receiving third event data;

providing the third event data to the network compute engine;

receiving, at a third time, and from the network compute engine, a second claim check for fourth event data, wherein:

the fourth event data is related to the third event data, and

the fourth event data has, at the third time, not been received by the network storage engine or the network compute engine;

determining, at a fourth time, that the second claim check has expired based on the fourth event data not having arrived by the fourth time; and

re-sending the third event data to the network compute engine in response to determining that the second claim check has expired.

13. The computing system of claim 10 , wherein the operations further comprise:

receiving, at a third time, and from the network compute engine, a second claim check for third event data, wherein:

the third event data is related to the first event data,

the third event data has, at the third time, not been received by the network storage engine or the network compute engine, and

the second claim check is related to the claim check associated with the first event data and the second event data;

receiving, at a fourth time, the third event data associated with the second claim check;

determining that the second claim check has been satisfied based on receipt of the first event data and the third event data; and

providing the second event data, the third event data, and the second copy of the first event data to the network compute engine in response to determining that:

the claim check has been satisfied, and

the second claim check has been satisfied.

14. The computing system of claim 13 , wherein:

the first event data is associated with a child process executed on a client device of the one or more client devices,

the second event data is associated with a parent process, executed on the client device, that spawned the child process on the client device, and

the third event data is associated with a grandparent process, executed on the client device, that spawned the parent process on the client device.

15. The computing system of claim 10 , wherein the claim check is part of a group of related claim checks, and the operations further comprise:

generating a dependency graph indicating dependencies between claim checks in the group of related claim checks;

receiving an instance of event data; and

identifying one or more claim checks in the group of related claim checks that are associated with the instance of event data, based on traversing the dependency graph in response to receipt of the instance of event data.

16. One or more non-transitory computer-readable media storing computer-executable instructions associated with a network storage engine of a security network that, when executed by one or more processors, cause the network storage engine to:

receive, from one or more security agents executing at one or more client devices remote from the network storage engine, first event data associated with one or more events that have occurred at the one or more client devices;

provide a first copy of the first event data to a network compute engine of the security network;

receive, at a first time, and from the network compute engine, a claim check for second event data, wherein:

the second event data is related to the first event data, and

the second event data has, at the first time, not been received by the network storage engine or the network compute engine;

receive, at a second time, the second event data associated with the claim check;

determine that the claim check has been satisfied based on receipt of the first event data and the second event data; and

provide, in response to determining that the claim check has been satisfied, the second event data and a second copy of the first event data to the network compute engine.

17. The one or more non-transitory computer-readable media of claim 16 , wherein:

the first event data is associated with a child process executed on a client device of the one or more client devices, and

the second event data is associated with a parent process, executed on the client device, that spawned the child process on the client device.

18. The one or more non-transitory computer-readable media of claim 16 , wherein the computer-executable instructions further cause the network storage engine to:

receive third event data;

provide the third event data to the network compute engine;

receive, at a third time, and from the network compute engine, a second claim check for fourth event data, wherein:

the fourth event data is related to the third event data, and

the fourth event data has, at the third time, not been received by the network storage engine or the network compute engine;

determine, at a fourth time, that the second claim check has expired based on the fourth event data not having arrived by the fourth time; and

re-send the third event data to the network compute engine in response to determining that the second claim check has expired.

19. The one or more non-transitory computer-readable media of claim 16 , wherein the computer-executable instructions further cause the network storage engine to:

receive, at a third time, and from the network compute engine, a second claim check for third event data, wherein:

the third event data is related to the first event data,

the third event data has, at the third time, not been received by the network storage engine or the network compute engine, and

the second claim check is related to the claim check associated with the first event data and the second event data;

receive, at a fourth time, the third event data associated with the second claim check;

determine that the second claim check has been satisfied based on receipt of the first event data and the third event data; and

provide the second event data, the third event data, and the second copy of the first event data to the network compute engine in response to determining that:

the claim check has been satisfied, and

the second claim check has been satisfied.

20. The one or more non-transitory computer-readable media of claim 16 , wherein the claim check is part of a group of related claim checks, and the computer-executable instructions further cause the network storage engine to:

generate a dependency graph indicating dependencies between claim checks in the group of related claim checks;

receive an instance of event data; and

identify one or more claim checks in the group of related claim checks that are associated with the instance of event data, based on traversing the dependency graph in response to receipt of the instance of event data.

Assignments (1)

Continuity (2)

References Cited (194)