Juniper Networks, Inc.

Beijing Didi Infinity Technology and Development Co., Ltd.

Dongsheng Mu

Liwei Ren

Qingming Ma

Xianzhi Li

Jianhua Gu

Sanjay Gupta

Zeyong Lin

Event information of a computing device is obtained. The event information characterizes events occurring at the computing device. Two or more of the events are grouped into an event group. The event group defines an activity. The event group is classified to classify the activity. The activity and one or more related activities are chained into a sequence. The sequence defines a behavior. Context is added to the sequence to determine a contextual behavior. A security threat is detected based on the contextual behavior.

Multi-layer data model for security analytics

In one example, a network device includes a network interface that receives a packet, a storage card that stores session data for monitored network sessions, a plurality of service processing cards that process packets of respective subsets of the network sessions, wherein each of the service processing cards comprises a respective memory to store session data for the respective subset of the network sessions processed by the corresponding service processing card, and a switch fabric coupled to the network interface, the storage card, and the plurality of service processing cards. One or more of the plurality of service cards process the received packet based on the session data stored by the storage card. The one or more of the plurality of service cards retrieve the session data for the network session to which the packet corresponds from the storage card and store the retrieved session data in the respective memory.

Storing session information in network devices

Growing community of inventors

San Ramon, CA, United States of America

Dongsheng Mu