Back to results
US 2013/0086632 A1Published application
System, method, and computer program product for applying a rule to associated events
AssigneeMcAfee, Inc.
InventorsPaul Nicholas Gartside, Michael G. Bishop
Life of this patent
Estimating the term…
Abstract
A system, method, and computer program product are provided for applying a rule to associated events. In use, a plurality of events is associated based on at least one identifier. Additionally, at least one rule is applied to the associated events. Further, a reaction is performed based on the application of the at least one rule.
Claims15
1-20. (canceled)
A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:
- associating a plurality of events based on an identifier that is common to the plurality of events, wherein the plurality of events are associated with a separate communication of data indicative of unwanted activity;
- and
- determining whether the plurality of events exceed a threshold indicated in a rule, wherein at least the portion of the rule indicates a temporal proximity between at least some of the plurality of events that were associated;
- and
- applying the rule after determining the plurality of events exceeds the threshold.
2 more elements
A security system, comprising:
- a processor coupled to a memory, wherein the security system is configured to:
- associate a plurality of events based on an identifier that is common to the plurality of events, wherein the plurality of events are associated with a separate communication of data indicative of unwanted activity;
- determine whether the plurality of events exceed a threshold indicated in a rule, wherein at least the portion of the rule indicates a temporal proximity between at least some of the plurality of events that were associated;
- and
- apply the rule after determining the plurality of events exceeds the threshold.
2 more elements
A method to be performed in conjunction with a processor and a memory, comprising:
- associating a plurality of events based on an identifier that is common to the plurality of events, wherein the plurality of events are associated with a separate communication of data indicative of unwanted activity;
- determining whether the plurality of events exceed a threshold indicated in a rule, wherein at least the portion of the rule indicates a temporal proximity between at least some of the plurality of events that were associated;
- and
- applying the rule after determining the plurality of events exceeds the threshold.
1 more element
Dependencies are inferred from the claim text.