Patent application EP18166930A (EP), filed 2018-04-12
Publication number: EP3399454A1
Title: LEAST RECENTLY USED (LRU)-BASED EVENT SUPPRESSION
Abstract: A security agent can implement a least recently used (LRU)-based approach to suppressing events observed on a computing device. The security agent may observe events that occur on a computing device. These observed events may then be inserted into a LRU table that tracks, for a subset of the observed events maintained in the LRU table, a rate-based statistic for multiple event groups in which the subset of the observed events are classified. In response to a value of the rate-based statistic for a particular event group satisfying a threshold for the LRU-table, observed events that are classified in the event group can be sent to a remote security system with suppression by refraining from sending, to the remote security system, at least some of the observed events in the event group. The security agent may cease suppression after the rate-based statistic falls below a predetermined threshold level.
IPC codes: G06F  21/    55            A I
H04L  29/    06            A I
H04W   4/    08            A I
Claims: number: 1
text: A method comprising:
number: 2
text: The method of claim 1, further comprising tracking the rate-based statistic for the event group in the LRU table by:
number: 3
text: The method of claim 2, wherein determining that the value of the rate-based statistic for the event group satisfies the threshold associated with the LRU table comprises:
number: 4
text: The method of claim 3, wherein the threshold comprises a first threshold, the method further comprising:
number: 5
text: The method of claim 3, wherein the threshold comprises a first threshold, the method further comprising:
number: 6
text: The method of claim 2, wherein inserting the observed events into the LRU table comprises inserting an observed event that is classified in the event group into the LRU table by:
number: 7
text: The method of any preceding claim, wherein the LRU table comprises a first LRU table, the threshold comprises a first threshold associated with the first LRU table, the rate-based statistic comprises a first rate-based statistic, and the multiple event groups comprise multiple first event groups, the method further comprising:
number: 8
text: A system comprising:
number: 9
text: The system of claim 8, wherein the security agent is further configured to be executed by the one or more processors to track the rate-based statistic for the event group in the LRU table by:
number: 10
text: The system of claim 8, wherein the LRU table comprises a first LRU table, the threshold comprises a first threshold associated with the first LRU table, the rate-based statistic comprises a first rate-based statistic, and the multiple event groups comprise multiple first event groups, and wherein the security agent is further configured to be executed by the one or more processors to:
number: 11
text: The system of claim 10, wherein:
number: 12
text: The system of claim 11, wherein the second set of event properties is a subset of the first set of event properties.
number: 13
text: The system of claim 12, wherein:
number: 14
text: The system of claim 11, wherein the second set of event properties includes a node degree property, and wherein a value of the node degree property for the additional event group indicates a number of sub-processes created by a process corresponding to an observed event that is classified in the additional event group.
number: 15
text: A computer program that, when executed by one or more processors of a computing device, is configured to perform the method of any one of claims 1 to 7.
Office action: search_report, dated 2018-11-07
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: US2006150248A1
ref_type: patent
severity: background
ref_id: US2011055925A1
ref_type: patent
severity: background
ref_id: US2014143869A1
ref_type: patent
severity: background
ref_id: US2006150248
ref_type: patent
severity: novelty_destroying
ref_id: US2011055925
ref_type: patent
severity: background
ref_id: US2014143869
ref_type: patent
severity: background
Final disposition: pending (2018-11-07)