The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Nov. 17, 2020
Filed:
Oct. 08, 2019
Sas Institute Inc., Cary, NC (US);
Bryan C. Harris, Cary, NC (US);
Glen R. Goodwin, Laurel, MD (US);
Sean Riley Dyer, Leawood, KS (US);
Alexius Kofi Ameyaw Boakye, Jr., Ellicott City, MD (US);
Christopher Francis Smith, Clarksburg, MD (US);
Pankaj Ramesh Telang, Cary, NC (US);
Damian Tane Herrick, Cary, NC (US);
SAS Institute Inc., Cary, NC (US);
Abstract
An authentication packet including a user identifier is received. The user identifier identifies a user of a second computing device being monitored by the first computing device. Authentication data is parsed from the authentication packet. A peer group identifier is determined that identifies a peer group to which the user is assigned. Members of the peer group are identified based on an expected network activity behavior. The authentication data and the peer group identifier are buffered into a first event block object and into a second event block object. The first event block object is sent to a first source window of an event stream processing engine (ESPE) that processes a netflow packet. The second event block object is sent to a second source window of the ESPE that processes the authentication packet. The first source window and the second source window are different source windows of the ESPE.