Asynchronous data processing in extended detection and response systems

Patent metadata

Field	Value
Publication number	US-12531892-B2
Application number	US-202318454553-A
Country	US
Kind code	B2
Filing date	Aug 23, 2023
Priority date	Apr 24, 2023
Publication date	Jan 20, 2026
Grant date	Jan 20, 2026

Abstract

This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.

First claim

What is claimed is:

1 . A method comprising:
receiving, from a first computing entity, a request to obtain a first device identifier for a computing device identified by a second device identifier, wherein the request comprises a first indication of the second device identifier and a second indication of a first time, and wherein the first device identifier is a common device identifier across a plurality of monitoring components interacting with an Extended Detection and Response (XDR) system; receiving, from a second computing entity associated with a first monitoring component of the plurality of monitoring components, first monitoring data associated with the computing device, wherein the first monitoring data is recorded before the first time but is received within a threshold period of the first time, and wherein threshold period is determined based on a wait period and a smoothing window size, and further wherein the first monitoring data comprises a third indication of a third device identifier for the computing device; determining, at a second time after the threshold period, a monitoring data batch based on the first monitoring data and the smoothing window size; determining the first device identifier based on the monitoring data batch, wherein determining the first device identifier comprises:
determining a correlation between the second device identifier and the third device identifier, and
mapping the correlation to the first device identifier; and
providing the first device identifier to the first computing entity.

2 . The method of claim 1 , further comprising:
receiving second monitoring data associated with the computing device, wherein the second monitoring data is recorded before the first monitoring data but received after the first monitoring data and within the threshold period; and determining the monitoring data batch to represent that the second monitoring data is recorded before the first monitoring data.

3 . The method of claim 1 , wherein the smoothing window size represents a number of timesteps after the first time whose respective monitoring data should be included in the monitoring data batch.

4 . The method of claim 1 , further comprising:
based on receiving the request, providing a retry indication to the first computing entity, wherein the retry indication comprises the second time.

5 . The method of claim 1 , wherein the first computing entity is a monitoring component and providing the first device identifier comprises:
providing feedback data representing one or more device identifiers determined for the computing device based on the monitoring data batch.

6 . The method of claim 1 , wherein the first computing entity is configured to determine a security prediction associated with the computing device based on the first monitoring data.

7 . The method of claim 1 , wherein the first computing entity is configured to perform a responsive operation in relation to the computing device based on the first monitoring data.

8 . The method of claim 1 , wherein determining the monitoring data batch comprises:
determining a batch size representing a constraint on a first number of timesteps associated with the monitoring data batch; determining a second number of timesteps associated with the threshold period; determining a third number of timesteps based on a deviation between the first number and the second number; and determining the monitoring data batch to comprise a first window associated with the third number and a second window associated with the second number, wherein the first window is associated with a period before the first time and the second window is associated with a period during and after the first time.

9 . The method of claim 1 , wherein:
the first time is associated with generation of the request, the second time is associated with generation of the monitoring data batch, and a deviation between the first time and the second time is determined based on the threshold period.

10 . A system comprising:
one or more processors; and one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, from a first computing entity, a request to obtain a first device identifier for a computing device identified by a second device identifier, wherein the request comprises a first indication of the second device identifier and a second indication of a first time, and wherein the first device identifier is a common device identifier across a plurality of monitoring components interacting with an Extended Detection and Response (XDR) system;
receiving, from a second computing entity associated with a first monitoring component of the plurality of monitoring components, first monitoring data associated with the computing device, wherein the first monitoring data is recorded before the first time but is received within a threshold period of the first time, and wherein threshold period is determined based on a wait period and a smoothing window size, and further wherein the first monitoring data comprises a third indication of a third device identifier for the computing device;
determining, at a second time after the threshold period, a monitoring data batch based on the first monitoring data and the smoothing window size;
determining the first device identifier based on the monitoring data batch, wherein determining the first device identifier comprises:
determining a correlation between the second device identifier and the third device identifier, and
mapping the correlation to the first device identifier; and

providing the first device identifier to the first computing entity.

11 . The system of claim 10 , the operations further comprising:
receiving second monitoring data associated with the computing device, wherein the second monitoring data is recorded before the first monitoring data but received after the first monitoring data and within the threshold period; and determining the monitoring data batch to represent that the second monitoring data is recorded before the first monitoring data.

12 . The system of claim 10 , wherein the smoothing window size represents a number of timesteps after the first time whose respective monitoring data should be included in the monitoring data batch.

13 . The system of claim 10 , the operations further comprising:
based on receiving the request, providing a retry indication to the first computing entity, wherein the retry indication comprises the second time.

14 . The system of claim 10 , wherein the first computing entity is a monitoring component and providing the first device identifier comprises:
providing feedback data representing one or more device identifiers determined for the computing device based on the monitoring data batch.

15 . The system of claim 10 , wherein the first computing entity is configured to determine a security prediction associated with the computing device based on the first monitoring data.

16 . The system of claim 10 , wherein the first computing entity is configured to perform a responsive operation in relation to the computing device based on the first monitoring data.

17 . One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving, from a first computing entity, a request to obtain a first devi

Assignees

• Cisco Tech Inc

Inventors

• Jirsik Tomas
• Skarda Cenek
• Sislak David
• Hlavac Jaroslav

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L43/067

  using time frame reporting · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title