Method and system for processing intelligence information

• US 10,116,595 B2
• Filed: 04/15/2013
• Issued: 10/30/2018
• Est. Priority Date: 06/27/2002
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Malden, Matthew Scott, Israel, Daniel Edward, Pinkerton, Robert Brent, Bishop, Jr., Frank Warren, Patel, Prashant B., Nash, Christopher Scott, Viswanathan, Rahul, Abichandani, Arun, Yelkur, Rajani, Wong, Hang Yee, Chan, Jackson
• Primary Examiner(s): Ouellette, Jonathan
• Application Number:
  US13/862,994
• Publication Number:
  US 20130227046A1
• Time in Patent Office: 2,024 Days
• Field of Search: 705 11-912, 705301, 705325
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A method and system for routing intelligence information related to security. The security system provides rules that identify conditions and routing instructions that are to be applied to intelligence information. A security organization may create and modify rules to ensure the appropriate routing of intelligence information in a timely manner. The security system may receive intelligence information from various sources. Regardless of the form or source of intelligence information, the security system analyzes the intelligence information to determine whether any conditions of the rules are satisfied. When a condition of a rule is satisfied, the security system sends a notification of the intelligence information in accordance with the routing instructions for that rule. In this way, intelligence information can be automatically and quickly routed to the appropriate security personnel for further processing.

Claims

1. A method in a computer system for routing intelligence information relating to security, the method comprising:

obtaining, by the computer system, a set of rules that each include one or more conditions and corresponding routing instructions, wherein a condition specifies at least a source from which a piece of intelligence information was received, and wherein the corresponding routing instructions specify one or more recipients to whom the piece of intelligence information is to be routed;

receiving, by the computer system, intelligence information relating to security;

analyzing, by the computer system, the intelligence information to identify at least one transformation to be applied to transform the intelligence information into a set of common objects that correspond to a security object model;

transforming, by the computer system, the intelligence information to the set of common objects corresponding to the security object model;

identifying, by the computer system, at least one alias of at least one suspect referenced in the transformed intelligence information based at least in part on a security database;

storing, by the computer system, the transformed intelligence information in the security database, the transformed intelligence information being associated in the security database with the at least one alias of the at least one suspect;

analyzing, by the computer system, the transformed intelligence information to determine whether any conditions of the set of rules are satisfied; and

when a condition of a rule is satisfied, sending a notification describing the intelligence information to a category of agents in accordance with the routing instructions of the rule, wherein the notification includes at least the intelligence information and information referencing the identified suspect.

2. The method of claim 1 wherein the intelligence information is received via an electronic mail message.

3. The method of claim 1 wherein the intelligence information is received via a data entry display page.

4. The method of claim 1 wherein the routing instructions indicate that the intelligence information is to be queued for processing by available security personnel.

5. The method of claim 4 wherein the available security personnel is qualified to process the intelligence information.

6. The method of claim 4 wherein the available security personnel has security to review the intelligence information.

7. The method of claim 1, the method further comprising:

determining, by the computer system, that the intelligence information includes a new alias for the at least one suspect referenced in the intelligence information;

updating, by the computer system, the security database to associate the new alias with data corresponding to the at least one suspect.

8. A non-transitory computer storage medium storing computer-executable instructions that, when executed, cause a computer system to perform a computer-implemented method comprising:

obtaining a set of rules that each include one or more conditions and corresponding routing instructions, wherein a condition specifies at least a source from which a piece of intelligence information was received, and wherein the corresponding routing instructions specify one or more recipients to whom the piece of intelligence information is to be routed,

receiving intelligence information relating to security,

analyzing the intelligence information to identify at least one transformation to be applied to transform the intelligence information into a set of common objects that correspond to a security object model;

transforming the intelligence information to the set of common objects corresponding to the security object model;

identifying at least one alias of at least one suspect referenced in the transformed intelligence information based at least in part on a security database;

storing the transformed intelligence information in the security database, the transformed intelligence information being associated in the security database with the at least one alias of the at least one suspect;

analyzing the transformed intelligence information to determine whether any conditions of the set of rules are satisfied, and

when a condition of a rule is satisfied, sending a notification describing the intelligence information to a category of agents in accordance with the routing instructions of the rule, wherein the notification includes at least the intelligence information and information referencing the identified suspect.

9. The computer program product of claim 8, wherein the intelligence information is received via an electronic mail message.

10. The computer program product of claim 8, wherein the intelligence information is received via a data entry display page.

11. The computer program product of claim 8, wherein the routing instructions indicate that the intelligence information is to be queued for processing by available security personnel.

12. The computer program product of claim 11, wherein the available security personnel is qualified to process the intelligence information.

13. The computer program product of claim 11, wherein the available security personnel has security to review the intelligence information.

14. A computer system comprising:

a processor;

a computer-readable storage medium coupled to the processor; and

a plurality of instructions, encoded in the computer-readable storage medium and configured to cause the processor to

obtain a set of rules that each include one or more conditions and corresponding routing instructions, wherein a condition specifies at least a source from which a piece of intelligence information was received, and wherein the corresponding routing instructions specify one or more recipients to whom the piece of intelligence information is to be routed,

receive intelligence information relating to security,

analyze the intelligence information to identify at least one transformation to be applied to transform the intelligence information into a set of common objects that correspond to a security object model;

transform the intelligence information to the set of common objects corresponding to the security object model;

identify at least one alias of at least one suspect referenced in the transformed intelligence information based at least in part on a security database;

store the transformed intelligence information in the security database, the transformed intelligence information being associated in the security database with the at least one alias of the at least one suspect;

analyze the transformed intelligence information to determine whether any conditions of the set of rules are satisfied, and

send a notification describing the intelligence information to a category of agents in accordance with the routing instructions of the provided rule, when a condition of a rule is satisfied, wherein the notification includes at least the intelligence information and information referencing the identified suspect.

15. The computer system of claim 14, wherein the routing instructions indicate that the intelligence information is to be queued for processing by available security personnel.