Method and apparatus for processing real-time accumulated data for integrated analysis based on flow
The real-time cumulative data processing method addresses the inefficiencies in searching full-packet data by using a mapping table to index packet and flow information, enabling high-speed searches and enhancing the speed of cyber threat recognition and response.
WO2025079764A1 Publication Date: 2025-04-17QUAD MINERS CO LTD
5 Cites 2 Cited by
Patent Information
- Application Number
- PCT/KR2023/016853
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2023-10-11
- Filing Date
- 2023-10-27
- Publication Date
- 2025-04-17
AI Technical Summary
Technical Problem
Existing full-packet collection and analysis network detection and response technologies face significant challenges in efficiently searching for specific packets within large amounts of data, leading to prolonged times in recognizing and responding to cyber threats.
Method used
A real-time cumulative data processing method and device that centers packet data collection on flow information, utilizing a mapping table to index packet and flow information, allowing for high-speed search and retrieval of relevant data.
Benefits of technology
Enables rapid search and identification of packet information corresponding to specific flow conditions, significantly reducing the time required for security managers to recognize and respond to cyber attacks.
✦ Generated by Eureka AI based on patent content.
Abstract
A technical problem to be solved by the present invention is to provide a method for processing real-time accumulated data so as to rapidly search for a packet corresponding to a search condition from a large amount of data called a full packet. The method comprises: a network packet information reception step of acquiring at least one piece of information from flow information including 5-tuple information and package information including meta information, content information, threat detection information, asset information, URL information, and IP information; a step of generating a mapping table in which identification information of the package information and identification information of the flow information are indexed; and a step of generating data specialized for the flow information and storing, in a database, the data including the mapping table.
Need to check novelty before this filing date? Find Prior Art