Patent ID: 7961633

Claim:
A high speed threat detection system, comprising: a plurality of network sources to generate network data comprising a plurality of raw events; and a data analysis unit to receive the network data from the network sources, the data analysis unit comprising a slicing unit to package the network data into a plurality of slices, wherein each of the slices comprises a predetermined chunk of the network data, a relational database engine to organize the slices into a plurality of windows, wherein each window is associated with a distinct pattern, comprises a rolling set of the slices that match a data relationship requirement for the distinct pattern associated with the particular window, and comprises a fixed time boundary over which the slices enter and exit the particular window and over which the distinct pattern associated with the particular window can emerge from the rolling set of slices, and analyze, for each window, the corresponding rolling set of slices to detect an instance of the pattern associated with the particular window, and a pattern identification unit to identify which of the detected pattern instances are to be reviewed by an operator, and an output device to output the pattern instances to be reviewed by the operator.