Storing log data efficiently while supporting querying to assist in computer network security
US9031916B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Dec 28, 2007 |
| Grant date | May 12, 2015 |
| Priority date | — |
| Expiry date | May 28, 2033 |
Classification
- Technology area (CPC Y)Emerging Cross-Sectional Technologies
- CPC primaryY10S707/99953
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A logging system includes an event receiver and a storage manager. The receiver receives log data, processes it, and outputs a data “chunk.” The manager receives data chunks and stores them so that they can be queried. The receiver includes buffers that store events and a metadata structure that stores metadata about the contents of the buffers. The metadata includes a unique identifier associated with the receiver, the number of events in the buffers, and, for each “field of interest,” a minimum value and a maximum value that reflect the range of values of that field over all of the events in the buffers. A chunk includes the metadata structure and a compressed version of the contents of the buffers. The metadata structure acts as a search index when querying event data. The logging system can be used in conjunction with a security information/event management (SIEM) system.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.