公开(公告)号：US11509706B1

公开(公告)日：2022-11-22

申请号：US17141148

申请日：2021-01-04

Applicant: SPLUNK INC.

Inventor： Marios Iliofotou ,  Ravi Bulusu ,  Ashwin Athalye ,  Sathya Kavacheri ,  Shekar Kesarimanglam

IPC: H04L67/02 ,  H04L67/306 ,  H04L67/50 ,  H04L67/1001

Abstract: A deployment manager executing in a distributed computing environment generates a user behavior analytics (UBA) deployment to process structured event data. The deployment manager configures a streaming cluster to perform streaming processing on real-time data and configures a batch cluster to perform batch processing on aggregated data. A configuration manager executing in the distributed computing environment interoperates with the deployment manager to update the UBA deployment with user-provided code and configurations that define streaming and batch models, among other things. In this manner, the deployment manager provides a scalable UBA deployment that can be customized, via the configuration manager, by a user.

公开(公告)号：US11838351B1

公开(公告)日：2023-12-05

申请号：US17991704

申请日：2022-11-21

Applicant: SPLUNK INC.

Inventor： Marios Iliofotou ,  Ravi Bulusu ,  Ashwin Athalye ,  Sathya Kavacheri ,  Shekar Kesarimanglam

IPC: H04L67/02 ,  H04L67/306 ,  H04L67/50 ,  H04L67/1001

CPC classification number: H04L67/02 ,  H04L67/1001 ,  H04L67/306 ,  H04L67/535

Abstract: A deployment manager executing in a distributed computing environment generates a user behavior analytics (UBA) deployment to process structured event data. The deployment manager configures a streaming cluster to perform streaming processing on real-time data and configures a batch cluster to perform batch processing on aggregated data. A configuration manager executing in the distributed computing environment interoperates with the deployment manager to update the UBA deployment with user-provided code and configurations that define streaming and batch models, among other things. In this manner, the deployment manager provides a scalable UBA deployment that can be customized, via the configuration manager, by a user.

公开(公告)号：US20190327251A1

公开(公告)日：2019-10-24

申请号：US16503181

申请日：2019-07-03

Applicant: SPLUNK INC.

Inventor： Sudhakar Muddu ,  Christos Tryfonas ,  Joseph Auguste Zadeh ,  Alexander Beebe Bond ,  Ashwin Athalye

IPC: H04L29/06 ,  G06N20/00 ,  G06N5/04 ,  G06F16/901 ,  G06F16/44 ,  G06F16/28 ,  G06F16/25 ,  H04L12/26 ,  G06F16/2457 ,  H04L12/24 ,  G06F3/0484 ,  G06K9/20 ,  G06F3/0482 ,  G06N5/02 ,  G06F17/22 ,  G06N7/00

Abstract: A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

公开(公告)号：US11258807B2

公开(公告)日：2022-02-22

申请号：US16503181

申请日：2019-07-03

Applicant: SPLUNK INC.

Inventor： Sudhakar Muddu ,  Christos Tryfonas ,  Joseph Auguste Zadeh ,  Alexander Beebe Bond ,  Ashwin Athalye

IPC: H04L9/00 ,  H04L29/06 ,  G06N20/00 ,  G06F16/25 ,  G06F16/28 ,  G06F16/44 ,  G06F16/901 ,  G06F16/2457 ,  H04L43/00 ,  G06F40/134 ,  G06N20/20 ,  G06N7/00 ,  G06F3/0482 ,  G06K9/20 ,  G06F3/0484 ,  G06F3/04847 ,  H04L41/0893 ,  H04L43/062 ,  H04L43/045 ,  H04L43/08 ,  G06F3/04842 ,  G06N5/04 ,  H04L41/14 ,  H04L41/22 ,  G06N5/02

Abstract: A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

公开(公告)号：US10389738B2

公开(公告)日：2019-08-20

申请号：US14929183

申请日：2015-10-30

Applicant: Splunk Inc.

Inventor： Sudhakar Muddu ,  Christos Tryfonas ,  Joseph Auguste Zadeh ,  Alexander Beebe Bond ,  Ashwin Athalye

IPC: H04L9/00 ,  H04L29/06 ,  G06N20/00 ,  G06F16/25 ,  G06F16/28 ,  G06F16/44 ,  G06F16/901 ,  G06F16/2457 ,  G06N7/00 ,  G06F3/0482 ,  G06K9/20 ,  G06F3/0484 ,  H04L12/24 ,  H04L12/26 ,  G06F17/22 ,  G06N5/04

Abstract: A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

公开(公告)号：US11086974B2

公开(公告)日：2021-08-10

申请号：US15715079

申请日：2017-09-25

Applicant: Splunk Inc.

Inventor： Marios Iliofotou ,  Ravi Bulusu ,  Ashwin Athalye ,  Sathya Kavacheri ,  Shekar Kesarimanglam

IPC: G06F21/31 ,  G06F16/35 ,  G06F16/335

Abstract: A deployment manager executing in a distributed computing environment generates a user behavior analytics (UBA) deployment to process structured event data. The deployment manager configures a streaming cluster to perform streaming processing on real-time data and configures a batch cluster to perform batch processing on aggregated data. A configuration manager executing in the distributed computing environment interoperates with the deployment manager to update the UBA deployment with user-provided code and configurations that define streaming and batch models, among other things. In this manner, the deployment manager provides a scalable UBA deployment that can be customized, via the configuration manager, by a user.

公开(公告)号：US10887369B2

公开(公告)日：2021-01-05

申请号：US15715082

申请日：2017-09-25

Applicant: Splunk Inc.

Inventor： Marios Iliofotou ,  Ravi Bulusu ,  Ashwin Athalye ,  Sathya Kavacheri ,  Shekar Kesarimanglam

IPC: H04L29/08

Abstract: A deployment manager executing in a distributed computing environment generates a user behavior analytics (UBA) deployment to process structured event data. The deployment manager configures a streaming cluster to perform streaming processing on real-time data and configures a batch cluster to perform batch processing on aggregated data. A configuration manager executing in the distributed computing environment interoperates with the deployment manager to update the UBA deployment with user-provided code and configurations that define streaming and batch models, among other things. In this manner, the deployment manager provides a scalable UBA deployment that can be customized, via the configuration manager, by a user.

公开(公告)号：US20170063888A1

公开(公告)日：2017-03-02

申请号：US14929183

申请日：2015-10-30

Applicant: Splunk Inc.

Inventor： Sudhakar Muddu ,  Christos Tryfonas ,  Joseph Auguste Zadeh ,  Alexander Beebe Bond ,  Ashwin Athalye

IPC: H04L29/06 ,  G06N99/00

CPC classification number: H04L63/1416 ,  G06F3/0482 ,  G06F3/0484 ,  G06F3/04842 ,  G06F3/04847 ,  G06F16/24578 ,  G06F16/254 ,  G06F16/285 ,  G06F16/444 ,  G06F16/9024 ,  G06F17/2235 ,  G06K9/2063 ,  G06N5/022 ,  G06N5/04 ,  G06N7/005 ,  G06N20/00 ,  H04L41/0893 ,  H04L41/145 ,  H04L41/22 ,  H04L43/00 ,  H04L43/045 ,  H04L43/062 ,  H04L43/08 ,  H04L63/06 ,  H04L63/1408 ,  H04L63/1425 ,  H04L63/1433 ,  H04L63/1441 ,  H04L63/20 ,  H04L2463/121 ,  H05K999/99

Abstract: A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

Abstract translation: 安全平台采用多种技术和机制来检测计算机网络环境中的安全相关异常和威胁。 安全平台是“大数据”驱动，并采用机器学习来执行安全分析。 安全平台执行用户/实体行为分析（UEBA）以检测与安全性相关的异常和威胁，而不管这种异常/威胁是否已知。 安全平台可以包括用于检测异常和威胁的实时路径和批处理路径/模式。 通过视觉呈现具有风险评级和支持证据的分析结果，安全平台使网络安全管理员能够响应检测到的异常或威胁，并及时采取行动。