System and method for organizational risk analysis and reporting by mapping detected risk patterns onto a risk ontology
AssigneeSRC, Inc.
InventorsRobert J. DelZoppo, Eric Brown, Matthew Sweeney
Life of this patent
Estimating the term…
Abstract
A method for characterizing risk using an adaptive risk analysis engine. Following a user request for a risk analysis, online and/or offline factual information is retrieved by the engine and is used to produce risk indicators. The risk indicators are mapped onto risk ontology to produce risk factors which are then used to assess the level of risk. Parameters for the likelihood, impact, and external threat of the risk are calculated, and a risk assessment report is produced for the user.
Claims23
A computer-implemented method for analyzing risk at an individual or at an organizational level using an adaptive risk analysis engine, the method comprising:
- receiving a request for a risk analysis;
- retrieving factual information about both human and machine behavior from at least one online source and at least one offline source, said sources comprising at least one database source and at least one unstructured source;
- detecting, using a processor running the adaptive risk analysis engine, a pattern in said retrieved factual information;
- producing via induction a risk indicator from said detected pattern;
- determining, using the adaptive risk analysis engine, a risk indicator pattern from the produced risk indicator, wherein the adaptive risk analysis engine uses a risk policy defining threats faced by an organization to determine a risk to be asserted and at least one factor that mitigates or exacerbates the asserted risk;
- mapping, using the adaptive risk analysis engine, said risk indicator pattern and produce a risk factor, wherein the adaptive risk analysis engine dynamically consults a risk ontology;
- assessing a level of risk based on the risk factor;
- constructing impact, internal threat, and external threat parameters;
- and
- determining, based upon said threat parameters, whether reporting conditions have been met and when met producing a risk assessment report.
An adaptive risk analysis computer system comprising:
- a computer with an interface;
- a risk broker, said risk broker in communication with the computer and with a fact analyzer and a plurality of risk analyzers;
- a risk knowledge-base in communication with the risk broker, said risk knowledge-base containing a risk policy, said risk policy defining threats faced by an organization comprising a risk ontology and a plurality of rules for accessing and navigating said risk ontology;
- a threat environment database in communication with the risk analyzer;
- and
- factual information stored within a database, said factual information comprising both human and machine behavior extracted from at least one structured data source and at least one unstructured data source, said database in communication with said risk broker;
- wherein the fact analyzer detects a pattern in the factual information stored within said database and produces a risk indicator via induction from the detected pattern to determine a risk to be asserted and at least one factor that mitigates or exacerbates the asserted risk, and further wherein the risk analyzer determines a risk indicator pattern from the risk indicator, maps the risk indicator pattern onto a risk ontology to produce a risk factor by dynamically consulting the risk ontology, assesses a level of risk based on the risk factor, constructs impact, internal threat, and external threat parameters, determines whether reporting conditions have been met based upon said threat parameters, and produces a risk assessment report when said reporting conditions have been met.
Dependencies are inferred from the claim text.