Method and system for advanced scenario based alert generation and processing

A computer based method for generating alerts to a behavior as represented in data, the method comprising the steps of:

• receiving, on a periodic basis, data from at least one source;
• transforming the data from a first format associated with the at least one source to data in a second format for subsequent analysis;
• storing the data in the second format to a dataset;
• retrieving a behavior description, wherein the behavior description contains a plurality of conditions related to events and entities, the plurality of conditions related to events and entities being indicative of the specific behavior;
• retrieving a portion of the dataset;
• and
• performing detection processing, wherein the detection processing includes detection of relationships among events and entities in the portion of the dataset;
• and generating a plurality of alerts, wherein the plurality of alerts is indicative of the specific behavior.

A computer based method for generating alerts to a behavior as represented in data, the method comprising the steps of:

• receiving, on a periodic basis, data from at least one source;
• transforming the data from a first format associated with the at least one source to data in a second format for subsequent analysis;
• storing the data in the second format to a dataset;
• receiving an advanced scenario, wherein the advanced scenario contains a plurality of events and entities related to a behavior description and
• reference to at least one algorithm for identifying the plurality of events and entities;
• retrieving a portion of the dataset;
• and
• performing detection processing, wherein the detection processing includes the detection of the plurality of events and entities in the portion of the dataset using the at least one algorithm;
• and
• generating a plurality of alerts, wherein the plurality of alerts is indicative of the specific behavior.

A computer program embodied on a computer-readable medium for generating alerts to a specific behavior as represented in data, the computer program comprising:

• a code segment for receiving, on a periodic basis, data from at least one source;
• a code segment for transforming the data from a first format associated with the at least one source to data in a second format for subsequent analysis;
• a code segment for storing the data in the second format to a dataset;
• a code segment for retrieving an advanced scenario, wherein the advanced scenario defines a behavior of interest;
• a code segment for retrieving a portion of the dataset;
• and
• a code segment for applying the advanced scenario to the portion of the dataset to perform detection processing wherein the detection processing produces one or more matches wherein the matches are indicative of an instantiation of the advanced scenario in the portion of the dataset.

A computer program embodied on a computer-readable medium for generating alerts to a specific behavior as represented in data, the computer program comprising:

• a code segment for receiving, on a periodic basis, data from at least one source;
• a code segment for transforming the data from a first format associated with the at least one source to data in a second format for subsequent analysis;
• a code segment for storing the data in the second format to a dataset;
• a code segment for retrieving a behavior description, wherein the behavior description contains a plurality of conditions related to events and entities, the plurality of conditions related to events and entities being indicative of the specific behavior;
• a code segment for retrieving a portion of the dataset;
• and
• a code segment for performing detection processing, wherein the detection processing includes detection of relationships among events and entities in the portion of the dataset;
• and
• a code segment for generating a plurality of alerts, wherein the plurality of alerts is indicative of the specific behavior.

A computer program embodied on a computer-readable medium for generating alerts to a specific behavior as represented in data, the computer program comprising:

• a code segment for receiving, on a periodic basis, data from at least one source;
• a code segment for transforming the data from a first format associated with the at least one source to data in a second format for subsequent analysis;
• a code segment for storing the data in the second format to a dataset;
• a code segment for receiving an advanced scenario, wherein the advanced scenario contains a plurality of events and entities related to a behavior description and reference to at least one algorithm for identifying the plurality of events and entities;
• a code segment for retrieving a portion of the dataset;
• and
• a code segment for performing detection processing, wherein the code segment for detection processing includes code for detection of the plurality of events and entities in the portion of the dataset using the at least one algorithm;
• and
• a code segment for generating a plurality of alerts, wherein the plurality of alerts is indicative of the specific behavior.