CSpace - Persistent pattern matching engine

What is it?

CSpace is a high-performance pattern matching engine which allows complex patterns to be recognized from huge streams of events. Un-like classical pattern matching techniques CSpace allows to regonize complex patterns over large time-frames.

It can work with precisely defined behaviour patterns as well as discovering on the run typical behaviour patterns for individual parts of the system monitored.

CSpace is implemented using the InterSystems Caché database and works with low-level structures to achieve ultimate performance.

Where is it used?

CSpace is used as a core engine of the MyNetScope application for real-time computer network monitoring. An example of a complex pattern implemented in CSpace is the recognition of a successful /unsuccessful SSH attack from network traffic only (no need to use log files from computers).
CSpace is also used for implementing various detection methods, which detect anomalous behaviour in devices monitored (suspicious communication peers, suspicious changes of behaviour categories).