US 10,313,365 B2 · Cognitive offense analysis using enriched graphs

Abstract

An automated method for processing security events begins upon receipt of information representing an offense. Based in part on context data extracted from the offense, an offense context graph is built. The offense context graph comprises nodes and edges, with an edge therein representing a relationship between a pair of nodes, at least one of the nodes being a root node representing an entity associated with the offense. The method then continues by mining information about other events that are determined to share a local contextual relationship with the offense represented by the offense context graph. This operation generates an enriched offense context graph. The enriched offense context graph is then pruned to identify an offense context for further examination. Pruning may involve applying a metric to events associated with the offense and removing nodes that, based on evaluation of the metric, do not contribute to the offense.

Claims24

Dependent claims

A method to improve a capability of a security system to process security event data, comprising:

receiving information representing an offense;
building an offense context graph based in part on context data extracted about the offense, the offense context graph comprising nodes and edges, with an edge therein representing a relationship between a pair of nodes, at least one of the nodes being a root node representing an entity initially associated with the offense, and wherein one or more nodes linked together around the root node represent details of the offense;
mining information about one or more other events that are determined to share a local contextual relationship with the offense represented by the offense context graph to generate an enriched offense context graph;
and
pruning the enriched offense context graph to identify an offense context for further examination by the security system;
wherein the security system is implemented at least in part on a data processing system comprising hardware, and one or more of the receiving, building, mining and pruning operations are carried out in software executed on the hardware.

3 more elements

An apparatus to improve a capability of a security system to process security event data, comprising:

a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions operative to:
receive information representing an offense;
build an offense context graph based in part on context data extracted about the offense, the offense context graph comprising nodes and edges, with an edge therein representing a relationship between a pair of nodes, at least one of the nodes being a root node representing an entity initially associated with the offense, and wherein one or more nodes linked together around the root node represent details of the offense;
mine information about one or more other events that are determined to share a local contextual relationship with the offense represented by the offense context graph to generate an enriched offense context graph;
and
prune the enriched offense context graph to identify an offense context for further examination by the security system.

4 more elements

A computer program product in a non-transitory computer readable medium for use in a data processing system to improve a capability of a security system to process security event data, the computer program product holding computer program instructions that, when executed by the data processing system, are operative to:

receive information representing an offense;
build an offense context graph based in part on context data extracted about the offense, the offense context graph comprising nodes and edges, with an edge therein representing a relationship between a pair of nodes, at least one of the nodes being a root node representing an entity initially associated with the offense, and wherein one or more nodes linked together around the root node represent details of the offense;
mine information about one or more other events that are determined to share a local contextual relationship with the offense represented by the offense context graph to generate an enriched offense context graph;
and
prune the enriched offense context graph to identify an offense context for further examination by the security system.

2 more elements

Dependencies are inferred from the claim text.

Cognitive offense analysis using enriched graphs

Life of this patent

Cognitive offense analysis using enriched graphs

Life of this patent

Abstract

Claims24