Meta-event generation based on time attributes

Abstract

First stage meta-events are generated based on analyzing time attributes of base events received from a network component. Second stage meta-events are generated based on a number of the first stage meta-events that have a time attribute falling within a time period. An amount of time that has passed since a most-recent second stage meta-event was generated is determined, and if a threshold time period does not exceed the amount of time that has passed since the most-recent second stage meta-event was detected, a third stage meta-event is determined.

1 - 41 . (canceled) 
     
     
         42 . A computer-implemented method, comprising:
 generating first stage meta-events based on analyzing time attributes of base events received from at least one network component;   generating second stage meta-events based on a number of the first stage meta-events that have a time attribute falling within a time period;   determining an amount of time that has passed since a most-recent second stage meta-event was generated; and   if a threshold time period does not exceed the amount of time that has passed since the most-recent second stage meta-event was detected, generating a third stage meta-event.   
     
     
         43 . The method of  claim 42 , wherein generating first stage meta-events comprises:
 identifying a first rule that indicates a threshold number of base events and a first time period;   determining how many base events include a time attribute that falls within the first time period; and   when the threshold number of base events does not exceed the number of base events whose time attributes fall within the first time period, generating a first stage meta-event.   
     
     
         44 . The method of  claim 43 , comprising:
 activating the first rule dynamically.   
     
     
         45 . The method of  claim 43 , comprising:
 detecting improper rule syntax.   
     
     
         46 . The method of  claim 43 , comprising:
 detecting a loop condition generated by the first rule.   
     
     
         47 . The method of  claim 43 , comprising:
 detecting rule feedback.   
     
     
         48 . The method of  claim 43 , comprising:
 filtering the base events based on a condition before determining how many base events include a time attribute that falls within the first time period.   
     
     
         49 . The method of  claim 48 , wherein filtering the base events based on the condition comprises discarding the base events that do not satisfy the condition. 
     
     
         50 . The method of  claim 42 , wherein the at least one network component comprises an intrusion detection system. 
     
     
         51 . The method of  claim 42 , comprising:
 aligning time of the base events generated by different network components.   
     
     
         52 . The method of  claim 42 , comprising:
 performing an action specified by the first rule to notify an individual of the first-stage meta-events.   
     
     
         53 . A system, comprising:
 data storage to store base events received from at least one network component; and   a processor to
 generate first stage meta-events based on analyzing time attributes of base events received from at least one network component, generating second stage meta-events based on a number of the first stage meta-events that have a time attribute falling within a time period, 
 determine an amount of time that has passed since a most-recent second stage meta-event was generated, and 
 if a threshold time period does not exceed the amount of time that has passed since the most-recent second stage meta-event was detected, generate a third stage meta-event. 
   
     
     
         54 . The system of  claim 53 , wherein the processor to generate first stage meta-events comprises the processor to identify a first rule that indicates a threshold number of base events and a first time period, determine how many base events include a time attribute that falls within the first time period, and when the threshold number of base events does not exceed the number of base events whose time attributes fall within the first time period, generate a first stage meta-event. 
     
     
         55 . The system of  claim 54 , wherein the processor is to activate the first rule dynamically. 
     
     
         56 . The system of  claim 54 , wherein the processor is to detect improper rule syntax. 
     
     
         57 . The system of  claim 54 , wherein the processor is to detect a loop condition generated by the first rule. 
     
     
         58 . The system of  claim 54 , wherein the processor is to filter the base events based on a condition before determining how many base events include a time attribute that falls within the first time period. 
     
     
         59 . The system of  claim 58 , wherein the processor is to discard the base events that do not satisfy the condition. 
     
     
         60 . A non-transitory computer readable medium storing machine readable instructions that when executed perform instructions to:
 generate first stage meta-events based on analyzing time attributes of base events received from at least one network component;   generate second stage meta-events based on a number of the first stage meta-events that have a time attribute falling within a time period;   determine an amount of time that has passed since a most-recent second stage meta-event was generated; and   if a threshold time period does not exceed the amount of time that has passed since the most-recent second stage meta-event was detected, generate a third stage meta-event.