In-memory storage and search system for event management in network security

The performance of network security applications greatly depends on the amount of network-related events that can be kept in memory. Storing a larger number of events in memory can facilitate tasks like correlation analysis in intrusion detection, locating traces of intrusions, and real-time packet analysis. In this paper, we present a patent provisioned storage and search system that can be used for efficient and flexible insertion, search, and management of network security events in memory. It was motivated by the ternary tree data structure and has been adapted to meet the needs of security-related applications. We have performed simulations to show that it outperforms traditional hash methods in terms of memory storage and search efficiency.