Kumar Saurabh

US Patent:

7509677, Mar 24, 2009

Filed:

May 4, 2004

Appl. No.:

10/839613

Inventors:

Kumar Saurabh - Santa Clara CA, US
Kenny Tidwell - Los Altos CA, US

Assignee:

ArcSight, Inc. - Cupertino CA

International Classification:

G06F 7/04
H04L 9/32
G06F 17/30
G06F 11/30

US Classification:

726 23, 726 22, 726 24, 726 25, 726 26, 726 27, 726 3, 726 4, 726 5, 726 6, 726 7, 713182, 713188, 709223, 709224, 709225, 709226, 709227

Abstract:

Patterns can be discovered in security events collected by a network security system. In one embodiment, the present invention includes collecting and storing security events from a variety of monitor devices. In one embodiment, a subset of the stored security events is provided to a manager as an event stream. In one embodiment, the present invention further includes the manager discovering one or more previously unknown event patterns in the event stream.

US Patent:

7861299, Dec 28, 2010

Filed:

Aug 9, 2007

Appl. No.:

11/836251

Inventors:

Kenny C. Tidwell - Los Altos CA, US
Kumar Saurabh - Daly City CA, US
Debabrata Dash - Sunnyvale CA, US
Hugh S. Njemanze - Los Altos CA, US
Pravin S. Kothari - San Jose CA, US

Assignee:

ArcSight, Inc. - Cupertino CA

International Classification:

G06F 11/00

US Classification:

726 22, 726 23, 726 25

Abstract:

A network security system is provided that receives information from various sensors and can analyze the received information. In one embodiment of the present invention, such a system receives a security event from a software agent. The received security event includes a target address and an event signature, as generated by the software agent. The event signature can be used to determine a set of vulnerabilities exploited by the received security event, and the target address can be used to identify a target asset within the network. By accessing a model of the target asset, a set of vulnerabilities exposed by the target asset can be retrieved. Then, a threat can be detected by comparing the set of vulnerabilities exploited by the security event to the set of vulnerabilities exposed by the target asset.

US Patent:

7984502, Jul 19, 2011

Filed:

Oct 1, 2008

Appl. No.:

12/243838

Inventors:

Kumar Saurabh - Mountain View CA, US
Kenny C. Tidwell - Los Altos CA, US

Assignee:

Hewlett-Packard Development Company, L.P. - Houston TX

International Classification:

G06F 7/04
G06F 12/14
H04L 9/00

US Classification:

726 23, 726 22, 726 24, 726 25, 726 26, 726 27, 713182, 713188

Abstract:

Patterns can be discovered in events collected by a network system. In one embodiment, the present invention includes collecting and storing events from a variety of monitor devices. In one embodiment, a subset of the stored events is provided to a manager as an event stream. In one embodiment, the present invention further includes the manager discovering one or more previously unknown event patterns in the event stream.

US Patent:

20080104046, May 1, 2008

Filed:

Oct 24, 2007

Appl. No.:

11/923502

Inventors:

Anurag Singla - Mountain View CA, US
Kumar Saurabh - Daly City CA, US
Kenny Tidwell - Los Altos CA, US

Assignee:

ARCSIGHT, INC. - Cupertino CA

International Classification:

G06F 17/30

US Classification:

707004000, 707E17014

Abstract:

A session table includes one or more records, where each record represents a session. Session record information is stored in various fields, such as key fields, value fields, and timestamp fields. Session information is described as keys and values in order to support query/lookup operations. A session table is associated with a filter, which describes a set of keys that can be used for records in that table. A session table is populated using data contained in security information/events. Rules are created to identify events related to session information, extract the session information, and use the session information to modify a session table. A session table is partitioned so that the number of records in each session table partition is decreased. A session table is processed periodically so that active sessions are moved to the current partition.

US Patent:

7260844, Aug 21, 2007

Filed:

Sep 3, 2003

Appl. No.:

10/655062

Inventors:

Kenny Tidwell - Los Altos CA, US
Kumar Saurabh - Santa Clara CA, US
Debabrata Dash - Sunnyvale CA, US
Hugh S. Njemanze - Los Altos CA, US
Pravin S. Kothari - San Jose CA, US

Assignee:

ArcSight, Inc. - Cupertino CA

International Classification:

G06F 11/00

US Classification:

726 22, 726 23, 726 25

Abstract:

A network security system is provided that receives information from various sensors and can analyse the received information. In one embodiment of the present invention, such a system receives a security event from a software agent. The received security event includes a target address and an event signature, as generated by the software agent. The event signature can be used to determine a set of vulnerabilities exploited by the received security event, and the target address can be used to identify a target asset within the network. By accessing a model of the target asset, a set of vulnerabilities exposed by the target asset can be retrieved. Then, a threat can be detected by comparing the set of vulnerabilities exploited by the security event to the set of vulnerabilities exposed by the target asset.

US Patent:

20210349953, Nov 11, 2021

Filed:

Jul 22, 2021

Appl. No.:

17/383066

Inventors:

- Redwood City CA, US
Christian Friedrich Beedgen - San Carlos CA, US
Kumar Saurabh - Menlo Park CA, US
Bruno Kurtic - Belmont CA, US

International Classification:

G06F 16/951
G06F 16/248
G06Q 10/06
H04L 29/06
G06F 16/242
G06F 16/28
G06F 16/2458
H04L 12/26
G06F 16/2455
G06F 21/55
G06F 21/56
G06F 16/245

Abstract:

Single-click delta analysis is disclosed. A user query of status information collected from one or more monitored devices is received from a user. In response to receiving an indication from the user to determine a variance between different portions of the collected status information, a target query and a baseline query are generated using the user query. The generated target query and the generated baseline query are performed, respectively, against data in a data store including the status information collected from the one or more monitored devices. A target set of status information results and a baseline set of status information results are obtained in response to performing, respectively, the generated target query and the generated baseline query. The obtained target and baseline sets of results are combined. Output indicative of a variance between the target and baseline sets of status information results is provided based at least in part on the combining.

US Patent:

20200272622, Aug 27, 2020

Filed:

May 11, 2020

Appl. No.:

16/872180

Inventors:

- Redwood City CA, US
Christian Friedrich Beedgen - San Carlos CA, US
Kumar Saurabh - Menlo Park CA, US
Bruno Kurtic - Belmont CA, US

International Classification:

G06F 16/242
G06F 16/28
H04L 29/06
G06F 16/951
G06F 16/2455
G06Q 10/06
G06F 16/2458
G06F 21/55
G06F 16/248
H04L 12/26
G06F 21/56

Abstract:

Single-click delta analysis is disclosed. A user query of status information collected from one or more monitored devices is received from a user. In response to receiving an indication from the user to determine a variance between different portions of the collected status information, a target query and a baseline query are generated using the user query. The generated target query and the generated baseline query are performed, respectively, against data in a data store including the status information collected from the one or more monitored devices. A target set of status information results and a baseline set of status information results are obtained in response to performing, respectively, the generated target query and the generated baseline query. The obtained target and baseline sets of results are combined. Output indicative of a variance between the target and baseline sets of status information results is provided based at least in part on the combining.

US Patent:

20170228460, Aug 10, 2017

Filed:

Jan 13, 2017

Appl. No.:

15/406281

Inventors:

- Redwood City CA, US
Christian Friedrich Beedgen - San Carlos CA, US
Kumar Saurabh - Menlo Park CA, US
Bruno Kurtic - Belmont CA, US

International Classification:

G06F 17/30

Abstract:

Single-click delta analysis is disclosed. A user query of status information collected from one or more monitored devices is received from a user. In response to receiving an indication from the user to determine a variance between different portions of the collected status information, a target query and a baseline query are generated using the user query. The generated target query and the generated baseline query are performed, respectively, against data in a data store including the status information collected from the one or more monitored devices. A target set of status information results and a baseline set of status information results are obtained in response to performing, respectively, the generated target query and the generated baseline query. The obtained target and baseline sets of results are combined. Output indicative of a variance between the target and baseline sets of status information results is provided based at least in part on the combining.