Constructing event distributions via a streaming scoring operation
AssigneeForcepoint LLC
InventorsChristopher Poirel, William Renner, Eduardo Luiggi, Phillip Bracikowski
Life of this patent
Estimating the term…
Abstract
A method, system and computer-usable medium for performing a streaming scoring operation, comprising: receiving a stream of events, the stream of events comprising a plurality of events; ingesting the plurality of events; extracting features from the plurality of events to provide extracted features; and, generating a streaming scoring value based upon the extracted features.
Claims20
A computer-implementable method for performing a streaming scoring operation, comprising:
- receiving a stream of events, the stream of events comprising a plurality of events, each of the plurality of events referring to an occurrence of an action performed by an entity;
- ingesting the plurality of events into a streaming query framework;
- extracting features from the plurality of events to provide extracted features via the streaming query framework;
- generating a streaming scoring value based upon the extracted features via the streaming query framework;
- and,
- using the streaming scoring value to identify anomalous, abnormal, unexpected or malicious behavior associated with the entity.
A system comprising:
- a processor;
- a data bus coupled to the processor;
- and
- a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
- receiving a stream of events, the stream of events comprising a plurality of events, each of the plurality of events referring to an occurrence of an action performed by an entity;
- ingesting the plurality of events into a streaming query framework;
- extracting features from the plurality of events to provide extracted features via the streaming query framework;
- generating a streaming scoring value based upon the extracted features via the streaming query framework;
- and,
- using the streaming scoring value to identify anomalous, abnormal, unexpected or malicious behavior associated with the entity.
A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
- receiving a stream of events, the stream of events comprising a plurality of events, each of the plurality of events referring to an occurrence of an action performed by an entity;
- ingesting the plurality of events into a streaming query framework;
- extracting features from the plurality of events to provide extracted features via the streaming query framework;
- generating a streaming scoring value based upon the extracted features via the streaming query framework;
- and,
- using the streaming scoring value to identify anomalous, abnormal, unexpected or malicious behavior associated with the entity.
Dependencies are inferred from the claim text.