Patent SG-11201806334W-A (SG)
Title: Method and system for compression and optimization of in-line and in-transit information security data
Inventor: LIM KENG LENG ALBERT
IPC: H04L12/26
Filed: 2016-02-15
Abstract: Start ) Select a Set of Raw Alerts 410 Select a Digital Signature in Chronological Order 420 415 425 Add Digital Signature to Severity Database 430 Digital Signature Incidence > Threshold? Mark Raw Alerts with Unmatched Digital Signature as Non-Redundant Raw Alert O FIGURE 4 W O 20 17 / 142475 Al 455 Generate Digital Signatures for each Raw Alert Aggregate, Compress and Encryp Non-Redundant Raw Alerts (12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (10) International Publication Number (43) International Publication Date WO 2017/142475 Al 24 August 2017 (24.08.2017) WIPO I PCT 1111111111111101110111111111110101111101110101111101011111111111111111111111110111111 (51) International Patent Classification: H04L 12/26 (2006.01) G06F 17/40 (2006.01) GO6F 21/55 (2013.01) (21) International Application Number: PCT/SG2016/050075 (22) International Filing Date: 15 February 2016 (15.02.2016) (25) Filing Language: English (26) Publication Language: English (71) Applicant: CERTIS CISCO SECURITY PTE LTD [SG/SG]; 20 Jalan Afifi, Certis Cisco Centre, Singapore 409179 (SG). (72) Inventor: LIM, Keng Leng Albert; c/o Certis Cisco Se- curity Pte Ltd, 20 Jalan Afifi, Certis Cisco Centre, Singa- pore 409179 (SG). (74) Agent: ALLEN & GLEDHILL LLP; One Marina Boulevard #28-00, Singapore 018989 (SG). (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JP, KE, KG, KN, KP, KR, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). [Continued on next page] — (54) Title: METHOD AND SYSTEM FOR COMPRESSION AND OPTIMIZATION OF IN-LINE AND IN-TRANSIT INFORM- ATION SECURITY DATA (57) : This document discloses a method and system for just-in-time compression and optimization of raw unstruc- tured in-line and in-transit data by identifying low entropy data blocks or duplicated information security information in raw computer security alerts within a series of time windows. In particular, the method and system automatically manages; processes; and optimizes in-line and in-transit data blocks or raw information security alerts received from a plurality of in- formation surveillance sources and/or peripheral monitoring devices simultaneously. The data blocks or raw information security alerts that are found to be unique in the various time windows are transposed into meta-definition tables to be fur- ther processed while redundant data blocks or raw alerts con- tained within each particular time window are identified, marked and processed accordingly. WO 2017/142475 Al 1#11101M011010112010EMOMOIDIEHOIMMIUMOVOIMIE Published: — with international search report (Art. 21(3))