Back to results
US 9,002,771 B2Granted
System, method, and computer program product for applying a rule to associated events
AssigneeMcAfee, Inc.
InventorsPaul Nicholas Gartside, Michael G. Bishop
Life of this patent
Estimating the term…
Abstract
A system, method, and computer program product are provided for applying a rule to associated events. In use, a plurality of events is associated based on at least one identifier. Additionally, at least one rule is applied to the associated events. Further, a reaction is performed based on the application of the at least one rule.
Claims20
A computer program product, embodied on a non-transitory computer readable medium, for performing operations comprising:
- determining whether a first event including a first communication of data satisfies a predefined rule;
- scoring the first event to produce a first result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the first event;
- identifying a second event based on an identifier of the first event and an identifier of the second event, wherein the second event includes a second communication of data separate from the first communication of data;
- scoring the second event to produce a second result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the second event;
- determining whether an aggregate score of the first and second results exceeds a threshold indicated in the predefined rule, in response to a determination that a time between an identification of the first event and the identifying the second event is within a temporal proximity;
- and
- performing a reaction in response to a determination that the aggregate score of the first and second results exceeds the threshold indicated in the predefined rule.
4 more elements
A security system, comprising:
- a processor coupled to a memory, wherein
- the processor is configured to
- determine whether a first event including a first communication of data satisfies a predefined rule;
- score the first event to produce a first result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the first event;
- identify a second event based on an identifier of the first event and an identifier of the second event, wherein the second event includes a second communication of data separate from the first communication of data;
- score the second event to produce a second result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the second event;
- determine whether an aggregate score of the first and second results exceeds a threshold indicated in the predefined rule, in response to a determination that a time between an identification of the first event and an identification of the second event is within a temporal proximity;
- and
- perform a reaction in response to a determination that the aggregate score of the first and second results exceeds the threshold indicated in the predefined rule.
6 more elements
A method to be performed in conjunction with a processor and a memory, the method comprising:
- determining whether a first event including a first communication of data satisfies a predefined rule;
- scoring the first event to produce a first result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the first event;
- identifying a second event based on an identifier of the first event and an identifier of the second event, wherein the second event includes a second communication of data separate from the first communication of data;
- scoring the second event to produce a second result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the second event;
- determining whether an aggregate score of the first and second results exceeds a threshold indicated in the predefined rule, in response to a determination that a time between an identification of the first event and the identifying the second event is within a temporal proximity;
- and
- performing a reaction in response to a determination that the aggregate score of the first and second results exceeds the threshold indicated in the predefined rule.
4 more elements
Dependencies are inferred from the claim text.