Computer Security Data Storage Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer and network security systems face challenges in efficiently retrieving and storing computer security data, as existing methods often lead to increased storage requirements and inefficiencies in data retrieval due to the complexity of managing multiple identifiers associated with security events.
Innovation Solution
The implementation of a system that uses two data structures: a tuple association table to store identifier tuples corresponding to computer security events and a computer security data table to store associated data, allowing for efficient retrieval and reduced storage needs by organizing data into time buckets and source types, enabling fast and scalable data retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If computer security data is stored with multiple identifiers associated with each event, then data completeness and accuracy are improved, but storage requirements and data retrieval complexity increase
Solution Approach 1:
The patent segments the data storage structure into two separate tables: a first table for storing identifier tuples and a second table for storing computer security data. This segmentation allows the system to store multiple identifiers efficiently while reducing redundancy and optimizing storage space utilization.
Solution Approach 2:
The patent implements a nested data structure where identifier tuples are stored in the first table and linked to computer security data in the second table. This nesting approach allows multiple identifiers to be associated with security events in a compact, hierarchical manner that reduces overall storage requirements.
2Measurement precision
If multiple identifiers are stored for each computer security event, then data retrieval accuracy is improved, but data retrieval speed and efficiency deteriorate
Solution Approach 1:
By dividing the data into two separate tables with clear relationships, the patent enables efficient querying where the first table can be searched for identifier tuples and the second table can be searched for security data independently, improving retrieval speed while maintaining accuracy.
Solution Approach 2:
The patent introduces an intermediary structure (the first table storing identifier tuples) that mediates between the query process and the actual security data storage. This intermediary layer enables fast lookup and association of identifiers with their corresponding security events, improving both speed and accuracy.
3Ease of operation
If complex data structures are used to manage multiple identifiers, then data organization and retrieval are improved, but system complexity and difficulty of operation increase
Solution Approach 1:
The patent simplifies the system by segmenting the data management into two straightforward tables with clear purposes: one for identifiers and one for security data. This segmentation reduces the complexity of managing multiple identifiers while maintaining effective data organization.
Solution Approach 2:
The patent creates a universal data organization model that can handle various types of identifiers and security events through a consistent two-table structure. This multi-functional approach simplifies operations by providing a unified method for data management that works across different scenarios.
Data Source
AI summary
The subject matter of this specification generally relates to computer security. In some implementations, a method includes maintaining a first data structure that stores arrays of identifier tuples. Each identifier tuple corresponds to a respective computer security event and includes one or more identifiers for a computing element associated with the computer security event. Each array of identifier tuples corresponds to a respective identifier and only includes identifier tuples that include the corresponding identifier. A second data structure that stores arrays of computer security data is maintained. Each array of computer security data corresponds to a respective identifier tuple stored in the first data structure and only includes computer security data associated with each identifier in the corresponding identifier tuple. A query that specifies a first identifier for a first computing element is received. Identifier tuples that each include the first identifier are obtained from the first data structure.