Method for detecting real-time event and server using the same

• US 10,097,570 B2
• Filed: 11/11/2016
• Issued: 10/09/2018
• Est. Priority Date: 04/26/2016
• Status: Active Grant

• Current Assignee: Seculayer Co., Ltd.
• Original Assignee: Seculayer Co., Ltd.
• Inventors: Won, Jong Seoung, Ryu, Jin Sang
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US15/514,874
• Publication Number:
  US 20180191749A1
• Time in Patent Office: 697 Days
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/40 Support for services or applications
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method for detecting a preset type of real-time event is provided. The method includes steps of: (a) a server loading or supporting other server to load a detection policy; and (b) the server detecting or supporting other server to detect an event in real-time from multiple input data by referring to the detection policy.

Claims

1. A method for detecting a preset type of real-time events, comprising steps of:

(a) loading, by a first server, a detection policy on the first server or supporting, by the first server, a second server in loading the detection policy on the second server; and

(b) detecting, by the first server, an event in real time from multiple input data according to the detection policy or supporting, by the first server, the second server in detecting the event in real-time from multiple input data according to the detection policy; and

wherein, at the step of (a), the first server executes two or more cluster modules including at least one filtering thread in loading the detection policy; and

wherein, at the step of (b), the first server executes the two or more cluster modules in recognizing an event element from the multiple input data according to the detection policy via the at least one filtering thread and executes an event detection module in detecting an event from information regarding the recognized event element according to the detection policy; and

wherein, at the step of (b), the first server executing the event detection module in detecting an event from the multiple input data in real-time by referring to at least one algorithm corresponding to a detection option of the detection policy; and

wherein the at least one algorithm is performed according to a reference time and a pre-set threshold n; and

wherein the at least one algorithm sets an event element, which satisfies at least one certain condition, among recognized event elements as a detected event, or the at least one algorithm sets the event element as a reference event element; and

wherein if the event element is set to a reference event element, the event element set to a reference event element refers to at least one of;

information on whether another event element, which is considered based on the reference event element, is recognized before or after a predetermined time has elapsed from a time of a generation of the reference event element, and

information on whether the another event element is recognized before or after the predetermined time has elapsed, with the another event element recognized consecutively for a predetermined amount of time, and then at least part of the another event element has been set as another detected event.

2. The method of claim 1, further comprising a step of:

(c) retaining or supporting, by the first server, the second server in retaining the detected event, wherein, at the step of (c), implementing, by the first server a detection policy management database in retaining the detected event.

3. The method of claim 2, wherein, at the step of (a), if a request to apply a change of the detection policy is recognized, executing, by the first server, the two or more cluster modules including at least one filtering thread in loading the detection policy;

and wherein, at the step of (b), if the request to apply the change of the detection policy is recognized, executing, by the first server, the event detection module in acquiring the detection policy in order to allow the event detection module to detect an event from the information on the recognized event element according to the detection policy.

4. The method of claim 1, wherein, at the step of (b), if a detection option of the detection policy is additional option, detecting or supporting, by the first server, the second server in detecting an event from the multiple input data in real-time according to an additional algorithm which is determined by referring to a pre-specified reference time;

and

wherein the detection according to the additional algorithm includes steps of;

performing or supporting, by the first server, if an event element is recognized as generated, the second server in performing processes of determining the recognized as generated event element as a detected event and of setting the recognized as generated event element as a reference event element, and

performing or supporting, by the first server, if another event element is recognized as generated before a lapse of the pre-specified reference time from the time of the generation of the reference event element, the second server in performing processes of not determining the another event element as a detected event and of setting the another event element as a newly updated reference event element and performing or supporting, by the first server, if another event element is recognized as generated after the lapse of the pre-specified reference time from the time of the generation of the reference event element, performing or supporting, by the second server, in performing processes of determining the another event element as a detected event and of setting the another event element as a newly updated reference event element.

5. The method of claim 1, wherein, at the step of (b), if a detection option of the detection policy is an additional option, detecting or supporting, by the first server, the second server in detecting an event from the multiple input data in real-time according to an additional algorithm which is determined by referring to a pre-specified reference time;

and

wherein the detection according to the additional algorithm includes steps of;

performing or supporting, by the first server, if an event element is recognized as generated, the second server in performing processes of not determining the recognized as generated event element as a detected event and of setting the recognized as generated event element as a reference event element, and

performing or supporting, by the first server, if another event element is recognized as generated before a lapse of the pre-specified reference time from the time of the generation of the reference event element, the second server in performing processes of determining the another event element as a detected event and of setting the another event element as a newly updated reference event element and performing or supporting, by the first server, if another event element is recognized as generated after the lapse of the pre-specified reference time from the time of the generation of the reference event element, performing or supporting, by the second server, in performing processes of not determining the another event element as a detected event and of setting the another event element as a newly updated reference event element.

6. The method of claim 1, wherein, at the step of (b), if a detection option of the detection policy is an additional option, detecting or supporting, by the first server, the second server in detecting an event from the multiple input data in real-time according to an additional algorithm;

and

wherein the detection according to the additional algorithm includes a step of;

determining or supporting, by the first server, if an event element is recognized to be generated, the second server in determining the recognized event element as a detected event.

7. The method of claim 1, wherein, at the step of (b), if a detection option of the detection policy is an additional option, detecting or supporting, by the first server, the second server in detecting an event in real-time from the multiple input data according to an additional algorithm which is determined by referring to a pre-specified reference time and the preset threshold n;

and

wherein the detection according to the additional algorithm includes steps of;

performing or supporting, by the first server, if consecutive n event elements are recognized as generated within the pre-specified reference time, the second server in performing processes of determining a predefined m-th event element among the firstly recognized n event elements as a detected event and of setting the m-th event element as a reference event element, and

performing or supporting, by the first server, if consecutive n other event elements are recognized as generated after a time of the generation of the reference event element and all the recognized n other event elements are generated before a lapse of the pre-specified reference time from the time of the generation of the reference event element, the second server in performing processes of not determining the recognized n other event elements as detected events and of setting an m-th event element among the recognized n other event elements as a newly updated reference event element and performing or supporting, by the first server, else if consecutive n other event elements are recognized as generated after the time of the generation of the reference event element and at least one of the recognized n other event elements is generated after the lapse of the pre-specified reference time from the time of the generation of the reference event element, performing or supporting, by the second server, in performing processes of determining an m-th event element among the recognized n other event elements as a detected event and of determining the m-th event element among the recognized n other event elements as a newly updated reference event element.

8. The method of claim 1, wherein, at the step of (b), if a detection option of the detection policy is an additional option, detecting or supporting, by the first server, the second server in detecting an event in real-time from the multiple input data according to an additional algorithm which is determined by referring to a pre-specified reference time and the preset threshold n;

and

wherein the detection according to the additional algorithm includes steps of;

performing or supporting, by the first server, if consecutive n event elements are recognized as generated within the pre-specified reference time, the second server in performing processes of not determining the recognized as generated n event elements as detected events and of setting an m-th event element among the recognized as generated n event elements as a reference event element, and

performing or supporting, by the first server, if consecutive n other event elements are recognized as generated after the time of the generation of the reference event element and all the recognized n other event elements are generated before a lapse of the pre-specified reference time from the time of the generation of the reference event element, the second server in performing processes of determining an m-th event element among the recognized n other event elements as a detected event and of determining the m-th event element among the recognized n other event elements as a newly updated reference event element and performing or supporting, by the first server, if consecutive n other event elements are recognized to be generated after the time of the generation of the reference event element and at least one of the recognized n other event elements is generated after the lapse of the pre-specified reference time from the time of the generation of the reference event element, performing or supporting, by the second server, in performing processes of not determining the recognized n other event elements as detected events and of setting an m-th event element among the recognized n other event elements as a newly updated reference event element.

9. The method of claim 1, wherein, at the step of (b), if a detection option of the detection policy is a an additional option, detecting or supporting, by the first server, the second server in detecting an event in real-time from the multiple input data according to a an additional algorithm which is determined by referring to a pre-specified reference time and the preset threshold n;

and

wherein the detection according to the additional algorithm includes steps of;

performing or supporting, by the first server, if consecutive n event elements are recognized as generated within the pre-specified reference time, the second server in performing processes of determining a predefined m-th event element among the recognized n event elements as a detected event and of setting an n-th event element as a reference event element, and

performing or supporting, by the first server, if another event element is recognized as generated after the time of the generation of the reference event element and if all consecutive n event elements, with the another event element as an n-th event element, are generated after the time of the generation of the reference event element and if a difference between a time of generation of a first event element and that of an n-th event element among the consecutive n event elements is same or less than the pre-specified reference time, performing or supporting, by the second server, in performing processes of determining an m-th event element among the consecutive n event elements as a detected event and of setting the n-th event element among the consecutive n event elements as a newly updated reference event element.

10. The method of claim 1, wherein, at the step of (b), if a detection option of the detection policy is a an additional option, detecting or supporting, by the first server, the second server in detecting an event in real-time from the multiple input data according to a an additional algorithm which is determined by referring to a pre-specified reference time p and the preset threshold n;

and

wherein the detection according to the additional algorithm includes steps of;

setting or supporting, by the first server, the second server in setting a starting time t0 of detection, at which the detection starts, as a starting time t of schedule, and

performing or supporting, by the first server, upon a lapse of the pre-specified reference time p from the starting time t of a schedule, if at least n event elements are recognized to be generated during a time from t to t+p, the second server in performing processes of determining at least one of the recognized n event elements as a detected event or time t+p as an event generation time, and of setting t+p as a new starting time t of the schedule and setting or supporting, by the first server, if no n event elements are recognized to be generated during a time from t to t+p, and determining that no event is detected during the time from t to t+p, the second server in setting t+p as a new starting time t of the schedule.

11. The method of claim 1, wherein, at the step of (a), performing or supporting, by the first server, the second server in performing a process of deciding an integrity of the loaded detection policy by using input data for verification.

12. The method of claim 1, wherein the input data includes at least one of text data or binary data.

13. The method of claim 1, wherein the detection policy includes a detection rule set query expressing a rule for detecting an event element in the multiple input data as a query;

and wherein, at the step of (b), determining or supporting, by the first server, the second server in determining input data satisfying the detection rule set query among the multiple input data as an event element.

14. The method of claim 1, wherein the detection policy includes a unique field, or a unique field and a unique field threshold x;

and wherein, at the step of (b), if the unique field threshold is included in the detection policy, filtering or supporting, by the first server, the second server in filtering x or less input data whose unique field values are the same with one another as one piece of input data and if the unique field threshold is not included in the detection policy, filtering or supporting, by the first server, the second server in filtering the input data whose unique field values are the same as one piece of input data.

15. A first server for detecting a preset type of real-time events, comprising:

a memory;

a communication interface for loading a detection policy on the first server or for supporting a second server in loading the detection policy on the second sever; and

a computer processor for detecting an event in real-time from multiple input data according to the detection policy or for supporting the second server in detecting the event in real-time from multiple input data according to the detection policy; and

wherein the communication interface supports two or more cluster applications executed by the computer processor, including at least one filtering thread to load the detection policy; and

wherein the computer processor executes the two or more cluster applications to recognize an event element from the multiple input data according to the detection policy via the at least one filtering thread and also executes an event detection application to detect an event from information regarding the recognized event element according to the detection policy; and

wherein the computer processor executes the event detection application to detect an event from the multiple input data in real-time by executing at least one algorithm configured to correspond to a detection option of the detection policy; and

wherein the at least one algorithm during execution accesses a reference time and a pre-set threshold n; and

wherein the at least one algorithm, when executed, instructs the computer processor to set an event element, which satisfies at least one certain condition, among recognized event elements as a detected event, or instructs the computer processor to set the event element as a reference event element; and

wherein if the event element is set to a reference event element, the event element set to a reference event element refers to at least one of;

information on whether another event element, which is considered based on the reference event element, is recognized before or after a predetermined time has elapsed from a time of a generation of the reference event element, and

information on whether the another event element is recognized before or after the predetermined time has elapsed, with the another event element recognized consecutively for a predetermined amount of time, and then at least part of the another event element has been set as another detected event.

16. The first server of claim 15, wherein the computer processor implements a detection policy management database to retain the detected event.

17. The first server of claim 16, wherein, if a request to apply a change of the detection policy is recognized, the computer processor executes the two or more cluster applications including the at least one filtering thread to load the detection policy and if the request to apply the change of the detection policy is recognized, the computer processor executes the event detection application to acquire the detection policy in order to allow the executed event detection application to detect an event from the information on the recognized event element according to the detection policy.

18. The first server of claim 15, wherein, if a detection option of the detection policy is an additional option, the computer processor detects or supports the second server to detect an event from the multiple input data in real-time according to an additional executed algorithm which is determined by referring to a pre-specified reference time;

and

wherein the detection according to the additional executed algorithm comprises;

the computer processor, if an event element is recognized as generated, executing or supporting the second server to execute processes to determine the recognized as generated event element as a detected event and to set the recognized as generated event element as a reference event element, and

the computer processor, if another event element is recognized as generated before a lapse of the pre-specified reference time from the time of the generation of the reference event element, executing or supporting the second server to execute processes to not determine the another event element as a detected event and to set the another event element as a newly updated reference event element, and the computer processor, if another event element is recognized as generated after the lapse of the pre-specified reference time from the time of the generation of the reference event element, executing or supporting the second server to execute processes to determine the another event element as a detected event and to set the another event element as a newly updated reference event element.

19. The first server of claim 15, wherein, if a detection option of the detection policy is an additional option, the computer processor detects or supports the second server to detect an event from the multiple input data in real-time according to an additional executed algorithm which is determined by referring to a pre-specified reference time;

and

wherein the detection according to the additional executed algorithm comprises;

the computer processor, if an event element is firstly recognized as generated, executing or supporting the second server to execute processes to determine the recognized as generated event element as a detected event and to set the recognized as generated event element as a reference event element; and

the computer processor, if another event element is recognized as generated before a lapse of the pre-specified reference time from the time of the generation of the reference event element, executing or supporting the second server to execute processes to determine the another event element as a detected event and to set the another event element as a newly updated reference event element, and the computer processor, if another event element is recognized as generated after the lapse of the pre-specified reference time from the time of the generation of the reference event element, executing or supporting the second server to execute processes to not determine the another event element as a detected event and to set the another event element as a newly updated reference event element.

20. The first server of claim 15, wherein, if a detection option of the detection policy is an additional option, the computer processor detects or supports the second server to detect an event from the multiple input data in real-time according to an additional executed algorithm;

and

wherein the detection according to the additional executed algorithm comprises;

the computer processor, if an event element is recognized as generated, determines or supports the second server to determine the recognized event element as a detected event.

21. The first server of claim 15, wherein, if a detection option of the detection policy is an additional option, the computer processor detects or supports the second server to detect an event in real-time from the multiple input data according to an additional executed algorithm which is determined by referring to a pre-specified reference time and a preset threshold n;

and

wherein the detection according to the additional executed algorithm comprises;

the computer processor, if consecutive n event elements are recognized as generated within the pre-specified reference time, executing or supporting the second server to execute processes to determine a predefined m-th event element among the recognized n event elements as a detected event and of setting the m-th event element as a reference event element, and

the computer processor, if consecutive n other event elements are recognized as generated after a time of the generation of the reference event element and all the recognized n other event elements are generated before a lapse of the pre-specified reference time from the time of the generation of the reference event element, executing or supporting the second server to execute processes to not determine the recognized n other event elements as detected events and to set an m-th event element among the recognized n other event elements as a newly updated reference event element, and the computer processor, else if consecutive n other event elements are recognized as generated after the time of the generation of the reference event element and at least one of the recognized n other event elements is generated after the lapse of the pre-specified reference time from the time of the generation of the reference event element, executing or supporting the second server to execute processes to determine an m-th event element among the recognized n other event elements as a detected event and of determining an m-th among the recognized n other event elements as a newly updated reference event element.

22. The first server of claim 15, wherein, if a detection option of the detection policy is an additional option, the computer processor detects or supports the second server to detect an event in real-time from the multiple input data according to an additional executed algorithm which is determined by referring to a pre-specified reference time and a preset threshold n;

and

wherein the detection according to the additional executed algorithm comprises;

the computer processor, if consecutive n event elements are recognized as generated within the pre-specified reference time, executing or supporting the second server to execute processes to not determine the recognized as generated n event elements as detected events and to set an m-th event element among the recognized n event elements as a reference event element; and

the computer processor, if consecutive n other event elements are recognized as generated after the time of the generation of the reference event element and all the recognized n other event elements are generated before a lapse of the pre-specified reference time from the time of the generation of the reference event element, executing or supporting the second server to execute processes to determine an m-th event element among the recognized n other event elements as a detected event and to determine an m-th event element among the recognized n other event elements as a newly updated reference event element, and the computer processor, if consecutive n other event elements are recognized as generated after the time of the generation of the reference event element and at least one of the recognized n other event elements is generated after the lapse of the pre-specified reference time from the time of the generation of the reference event element, executing or supporting the second server to execute processes to not determine the recognized n other event elements as detected events and to set an m-th event element among the recognized n other event elements as a newly updated reference event element.

23. The first server of claim 15, wherein, if a detection option of the detection policy is an additional option, the computer processor detects or supports the second server to detect an event in real-time from the multiple input data according to an additional executed algorithm which is determined by referring to a pre-specified reference time and a preset threshold n;

and

wherein the detection according to the additional executed algorithm comprises;

the computer processor, if consecutive n event elements are recognized as generated within the pre-specified reference time, executing or supporting the second server to execute processes to determine a predefined m-th event element among the recognized n event elements as a detected event and to set an n-th event element as a reference event element; and

the computer processor, if another event element is recognized as generated after the time of the generation of the reference event element and if all consecutive n event elements, with the another event element as an n-th event element, are generated after the time of the generation of the reference event element and if a difference between a time of generation of first event element and that of an n-th event element among the consecutive n event elements is the same or less then the pre-specified reference time, executing or supporting the second server to execute processes to determine an m-th event element among the consecutive n event elements as a detected event and to set an n-th event element among the consecutive n event elements as a newly updated reference event element.

24. The first server of claim 15, wherein, if a detection option of the detection policy is an additional option, the computer processor detects or supports the second server to detect an event in real-time from the multiple input data according to an additional executed algorithm which is determined by referring to a pre-specified reference time p and a preset threshold n;

and

wherein, according to the additional executed algorithm, the computer processor sets or supports the second server to set a starting time t0 of detection, at which the detection starts, as a starting time t of schedule; and

upon a lapse of the pre-specified reference time p from the starting time t of schedule, the computer processor, if at least n event elements are recognized to be generated during a time from t to t+p, executes or supports the second server to execute processes of determining at least one of the recognized n event elements as a detected event or time t+p as an event generation time, and of setting t+p as a new starting time t of schedule and the processor, the processor, if no n event elements are recognized to be generated during a time from t to t+p, executes or supports the second server to execute processes of determining that no event is detected during the time from t to t+p and sets or supports the second server to set t+p as a new starting time t of schedule.

25. The first server of claim 15, wherein the computer processor executes or supports the second server to execute a process to decide an integrity of the loaded detection policy by using input data for verification.

26. The first server of claim 15, wherein the input data includes at least one of text data or binary data.

27. The first server of claim 15, wherein the detection policy includes a detection rule set query expressing a rule for detecting an event element in the multiple input data as a query;

and wherein the computer processor determines or supports the second server to determine input data satisfying the detection rule set query among the multiple input data as an event element.

28. The first server of claim 15, wherein the detection policy includes a unique field, or a unique field and a unique field threshold x;

and wherein, if the unique field threshold is included in the detection policy, the computer processor filters or supports the second server to filter x or less input data whose unique field values are same with one another as one piece of input data and if the unique field threshold is not included in the detection policy, the processor filters or supports the second server to filter the input data whose unique field values are same as one piece of input data.