Abstract

A system for processing cybersecurity monitoring data includes a load balancing operator coupled to at least one incoming data stream. The load balancing operator is operable to distribute cybersecurity monitoring messages amongst a plurality of collector processing units operable to generate monitoring records from the received cybersecurity monitoring messages in a first format. A plurality of parser sub-units coupled to the plurality of collector processing sub-units are operable to generate parsed monitoring records by converting the received monitoring records from the first format to a second format. A combiner operator coupled to the plurality of parser sub-units is operable to combine the parsed monitoring records from the plurality of parser sub-units into a synchronous output data stream. The system is configured such that data flows sequentially from the load balancing operator to the plurality of collector processing sub-units and to the plurality of parser sub-units to the combiner operator.

IPC Classes  ?

• H04L 43/04 - Processing captured monitoring data, e.g. for logfile generation
• H04L 69/168 - Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] specially adapted for link layer protocols, e.g. asynchronous transfer mode [ATM], synchronous optical network [SONET] or point-to-point protocol [PPP]
• H04L 69/164 - Adaptation or special uses of UDP protocol

Abstract

A system for processing network flow monitoring data includes a data collection input coupled to at least one incoming data stream; a load balancing operator is operable to distribute the network monitoring messages amongst a plurality of downstream processing units; a plurality of collector processing sub-units downstream from the load balancing operator are operable to generate network flow records from the received network monitoring messages in a first format; a plurality of parser sub-units coupled to the plurality of collector processing sub-units are operable to generate parsed network flow records by converting the received network flow records from the first format to a second format; and a combiner operator coupled to the plurality of parser sub-units is operable to combine the parsed network flow records from the plurality of parser sub-units into a synchronous output data stream.

IPC Classes  ?

• H04L 12/26 - Monitoring arrangements; Testing arrangements
• H04L 29/06 - Communication control; Communication processing characterised by a protocol

Abstract

A system for processing streaming data includes a data collection input coupled to at least one incoming data stream; a plurality of data processing sub-units operable to receive an input data stream, modify data in the input data stream, and output an outgoing data stream that includes the modified data; a plurality of operators connecting the data collection input, the plurality of data processing sub-units, and at least one data output unit in a directed acyclic graph in which data flows from the data collection input through the plurality of data processing sub-units to the at least one data output unit. At least some data processing units are directly connected to a sub-unit input operator that transmits data using the User Datagram Protocol (UDP) and at least some data processing units are directly connected to a sub-unit output operator that receives data using UDP.

IPC Classes  ?

• H04L 29/06 - Communication control; Communication processing characterised by a protocol
• H04L 12/26 - Monitoring arrangements; Testing arrangements