Risk adaptive protection

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• receiving a stream of data from a data source, the stream of data comprising a plurality of events, the plurality of events comprising electronically-observable interactions by a user, the electronically-observable interactions being observed through at least one of an electronic device, a computer system and a software application executing on the computing system;
• processing the steam of data to identify entity information and event information, the entity information comprising heterogeneous entity information, the event information comprising heterogeneous event information, the processing being performed by a data preprocessor module of a genericized data model management system;
• transforming the entity information into transformed entity data and the event information into transformed event data, the transforming conforming to a genericized data model, the genericized data model comprising a data model that defines a general relational type along with at least one of an entity and event related by the general relational type, the transforming being performed by a data transformation module of a genericized data model management system;
• storing the transformed entity data and the transformed event data in a data repository;
• and,
• performing a security analytics operation using the transformed entity data and the transformed event data, the security analytics operation being performed by a security analytics system executing on a hardware processor, the security analytics operation accessing the transformed entity data and the transformed event data from the data repository, the security analytics operation processing the transformed entity data and the transformed event data to identify a possible security breach.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• receiving a stream of data from a data source, the stream of data comprising a plurality of events, the plurality of events comprising electronically-observable interactions by a user, the electronically-observable interactions being observed through at least one of an electronic device, a computer system and a software application executing on the computing system;
• processing the steam of data to identify entity information and event information, the entity information comprising heterogeneous entity information, the event information comprising heterogeneous event information, the processing being performed by a data preprocessor module of a genericized data model management system;
• transforming the entity information into transformed entity data and the event information into transformed event data, the transforming conforming to a genericized data model, the genericized data model comprising a data model that defines a general relational type along with at least one of an entity and event related by the general relational type, the transforming being performed by a data transformation module of a genericized data model management system;
• storing the transformed entity data and the transformed event data in a data repository;
• and,
• performing a security analytics operation using the transformed entity data and the transformed event data, the security analytics operation being performed by a security analytics system executing on a hardware processor, the security analytics operation accessing the transformed entity data and the transformed event data from the data repository, the security analytics operation processing the transformed entity data and the transformed event data to identify a possible security breach.