Patent Document ID: 20170063896
Application ID: 14841634
Patent Flag: 0

Claim One:
1. A network security system comprising: a computation engine implemented using Apache Storm or Apache Spark Streaming, configured to receive unbounded first event data indicative of activity on a computer network, to detect first indicia of possible security breaches in a real-time processing mode based on the first event data, and to generate real-time analysis result data representing the first indicia for output to a user; an Apache Hadoop framework including a Hadoop Distributed File System (HDFS) to store the real-time analysis result data and second event data indicative of activity on the computer network, the second event data having been stored in the HDFS prior to analysis of the first event data by the computation engine; and an Apache Spark cluster computing engine operatively coupled to the computation engine and the Apache Hadoop framework, and configured to operate concurrently with the computation engine, the Apache Spark cluster computing engine further configured to retrieve, from the HDFS, the real-time analysis result data and the second event data, and to detect, in a batch mode, second indicia of possible security breaches based on the second event data and the real-time analysis result data.