Patent ID: 6971028
Filing Date: 2005-11-29
Classification: G06F,H04L

Abstract:
1. A method for detecting and processing attacks on a computer network, comprising: receiving a plurality of successive sets of data each set each set being associated with a corresponding security event associated with the computer network; placing each set of data in a selected one of a plurality of queues based at least in part on a queue selection algorithm by which sets of data associated with related security events are grouped into the same queue while sets of data associated with unrelated security events are spread across different queues; and processing the sets of data by: wherein the queue selection algorithm includes performing a first computation on a first at least a portion of the set of data to obtain a first index, performing a second computation on a second at least a portion of the set of data to obtain a second index, and selecting a queue for the set of data being processed based at least in part on the first and second indices, such that sets of data having the same values for both the first at least a portion of the set of data and the second at least a portion of the set of data are placed in the same queue; whereby a critical set of data associated with a critical security event is timely selected for processing even under circumstances in which numerous sets of data associated with a corresponding set of security events that are related to each other but not to the critical security event are received prior to the critical set of data being received.