Patent ID: 8326881

Claim:
A system comprising: a network device, that includes a processor and a memory, to: process, for detecting one or more attempted security breaches, each of a plurality of log records to generate a respective value corresponding to each of the plurality of log records, identify, based on the value corresponding to a log record of the plurality of log records, a first entry of a plurality of entries of a data structure, generate, based on one or more fields of the log record, a data value, associate the data value with a list of values associated with the first entry, when the data value does not match another value of the list of values, insert a tag into the first entry to form a modified entry after associating the data value with the list of values, analyze each of the plurality of entries of the data structure, identify, based on the tag of the first entry of the plurality of entries and the data value, the modified entry, perform, after identifying the modified entry, an evaluation of the data value associated with the modified entry to detect an attempted security breach, and modify, upon completion of the evaluation of the data value, the tag of the modified entry to cause the modified entry to no longer be identified as a modified entry.