Fortinet, Inc.

Santosh Rao

Partha P Bhattacharya

Wenjun Cai

Network identity to User Identity and location mapping information can be found in various logs (such as Active Directory logs, DHCP logs, VPN logs, and WLAN authentication logs) and certain files such as router Layer 2 or 3 forwarding tables. For a large organization, this mapping can be dynamic. Accurate user identity and location information is crucial to assessing the security risk associated with a host and take corrective action. This invention discloses a distributed in-memory user database update methodology for keeping track of large scale dynamically updating network to user identity mappings. The technique is further configurable for specific users, specific devices or for specific attributes in the metadata.

User and IoT (internet of things) apparatus tracking in a log management system

Metadata is received for different log events, from a plurality of regional controller nodes, implemented at least partially in hardware and geographically-dispersed around the data communication network for proximity to network devices. Each of the log events is reported by the network devices to a regional collector node of the plurality of regional controller nodes. Log events concerning a user authenticating to a network device that is geographically proximate to the user and comprising at least user identity aspect and a location aspect for specific users of stations serviced by the network devices, are detected. Feasibility of location changes can be determined to identify possible identity theft.

Spatiotemporal credential leak detection to prevent identity fraud using a log management system

Event record purging is selectively enforced in a high volume log system. A plurality of data retention policies is received for one or more data types. Each data retention policy can describe a retention duration for enforcement of different data types with respect to online retention and offline retention. Only online compressed file from a period of time potentially containing event records with an expiring retention duration are uncompressed. Other files are ignored to save I/O bandwidth for supporting queries of event records. Some implementations search records using the index as well.

Growing community of inventors

Fremont, CA, United States of America

Santosh Rao