Pervasive, domain and situational-aware, adaptive, automated, and coordinated big data analysis, contextual learning and predictive control of business and operational risks and security

• US 10,210,470 B2
• Filed: 04/13/2017
• Issued: 02/19/2019
• Est. Priority Date: 10/14/2011
• Status: Active Grant

• Current Assignee: Albeado Inc.
• Original Assignee: Albeado Inc.
• Inventors: Datta Ray, Partha
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US15/487,211
• Publication Number:
  US 20170220964A1
• Time in Patent Office: 677 Days
• Field of Search: None
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

Real time security, integrity, and reliability postures of operational (OT), information (IT), and security (ST) systems, as well as slower changing security and operational blueprint, policies, processes, and rules governing the enterprise security and business risk management process, dynamically evolve and adapt to domain, context, and situational awareness, as well as the controls implemented across the operational and information systems that are controlled. Embodiments of the invention are systematized and pervasively applied across interconnected, interdependent, and diverse operational, information, and security systems to mitigate system-wide business risk, to improve efficiency and effectiveness of business processes and to enhance security control which conventional perimeter, network, or host based control and protection schemes cannot successfully perform.

Claims

1. A computer-implemented method for analyzing, learning, predicting, and controlling business and operational risk of an enterprise, comprising:

conforming elemental processes in an enterprise-wide computer network to a processor-implemented self-similar structure comprising a plurality of data acquisition, analysis, learning, and inference applications, and business processes spread over a plurality of domains, said domains comprising any of operational processes and systems, information technology (IT) systems, and security systems;

representing elemental business and operational processes in each domain as a network supporting exchange of a transaction value that represents operational events or actions, wherein all elementary business processes in all of said domains are conceptually and logically interconnected and structurally similar to each other;

wherein the elemental processes in an enterprise are based on any of a physical or logical network, a conceptual network, and organizational structures;

wherein each element is represented by a node, and each of its relations or interactions with other elements is represented by an edge, the enterprise network having multiple types of nodes and multiple edges between nodes representing different types of relations and interactions between them, structural and functional; and

for all connected nodes, extending self-similarity to all layers in said network, wherein a smallest element is structurally any of a single data acquisition element, sensor, analysis, learning element, decision making element, actuator, and compute element, each element functionally supporting a single transaction between two elemental nodes;

acquiring data, organizing said data in tabular and networked graph data sets, and identifying statistically significant patterns and learning correlations in multiple dimensions and connected elements;

analyzing said organized data sets in different dimensions by correlating said data sets in a context of structural information concerning network, business processes, data sets, and other information comprising domain knowledge;

inferring normative and anomalous distribution of data in full enterprise systemic context across connected data sets of the enterprise network and multiple dimensions of transactional data representing operational events and business activities;

performing pervasive and persistent business risk and operational efficiency analysis to adapt to evolving situational knowledge and intelligence comprising any of normative and anomalous relationships and connections extracted from current and historical data, data values, distribution and patterns in data sets, and state information and activities in operational technology (OT) systems, IT systems, and security systems (ST);

providing autonomous and adaptive business and operational control capabilities, and enhanced business efficiency of target systems, subsystems, and elements at a plurality of hierarchical levels of said networks, wherein said hierarchical levels range from an entire enterprise-wide network and correlated data sets at a highest level to a single data transaction at a lowest level;

analyzing real-time transactions, incoming values in data sets, state information, and activities on said network elements, as well as elements of underlying enterprise business processes that are affected if and when security of an element is breached or business process efficiency is compromised and deviates from normative distribution; and

dynamically adapting said operational analysis and control capabilities, and efficiency at selected hierarchical levels and at selected time scales in response to enterprise data driven situational awareness and knowledge about domain specific normative models that is relevant to said OT, IT, and ST systems, as well as to subsystems and elements of said systems with regard to said underlying business processes.

2. The method of claim 1, wherein said situational knowledge and intelligence comprises current and historical data, data patterns and their interconnection representing operational activities and events and any change thereof, state information, compute and storage capabilities, capacities in monitoring, decision making, and control implementations, and adjustments thereof, and other transitions in any of said OT systems, IT systems, and ST systems, and an operational, business and security threat environment.

3. The method of claim 1, wherein said domain knowledge comprises business and operational processes, relational and connection information of operational data with other internal or external data and fact sets, and any change thereof, statistical and underlying physical models explaining operational, business and, security threat environment data.

4. The method of claim 1, wherein said security and business risk administration knowledge comprises business and operational policies, rules, implemented processes represented by the networked elements, constraints, configurations, and parameters.

5. The method of claim 1, wherein data and fact sets comprise context and provide information for structural and statistical analysis, learning, modeling of operational security and business risk and formulation of control actions for security and risk management.

6. The method of claim 1, wherein said security system monitors and analyzes an entire enterprise-wide network at a highest level to a single computer or end device at a lowest level and informs to quality and integrity of operational and business data acquired and stored as situational facts by correlating with anomalous actions and events in the IT and ST systems.

7. The method of claim 1, wherein data representing activities and events as acquired at, flowing through, or stored at each node as aggregation and statistical derivations , are organized as data sets comprising situational awareness concerning any of customer pull of finished goods, ordering data about material, production capacity, supply chain lead times data, patient volume and physical condition data during hospital admission or a clinical event, clinical resource availability including ICU configuration and occupancies, caregiver availability, gas pressure or voltage level in an utility network and time-series aggregations thereof.

8. The method of claim 1, wherein data representing domain knowledge comprises relational and connection information of operational data with other internal or external data and fact sets, and any change thereof including correlation of mining activity, logistical and transportation activity, and raw material availability at a production floor for providing context of supply chain risk analysis or new drug-drug-interaction correlated to clinical processes performed by doctors providing a context for clinical work flow risk at a hospital for connected statistical and underlying physical models explaining operational (OT), business (IT) and, security threat (ST) environment data and cross-domain learning.

9. The method of claim 1, wherein data representing security and business risk administration knowledge comprises data about business and operational policies, process and rules, constraints, configurations, trigger parameters, and ranges for implemented rules and processes represented in and learned from networked analysis, correlation, and control elements embedded in systems data and cross-domain control.

10. The method of claim 1, further comprising:

providing an operational security and business risk analysis engine algorithmically processing, learning, and correlating elemental, systemic, and cross-domain situational intelligence, cross-correlating data sets to logically and mathematically predict, validate, rank, and order situational operation security and business risk in a context comprising historical situational knowledge and domain knowledge about physical and underlying operational, business, and security processes and systems, both structurally and functionally; and

inferring and producing a dynamic operational risk and security control decision output based on operational policies, processes, and rules, constraints, configurations, trigger parameters, and ranges for implemented rules and processes for reporting and controlling enterprise operation, business, and security risk management, and for providing real-time and dynamic input back into coordinated learning and updating said situational intelligence, situational knowledge, and domain knowledge.

11. The method of claim 1, wherein said enterprise elements that are monitored and controlled (MCEs) comprise any of:

an entire enterprise-wide OT and IT network comprising any of hardware, firmware, and software analysis, learning, and prediction applications and interconnected and distributed systems within diverse geographical locations;

one or more subsystems of said enterprise-wide OT and IT network;

one or more information or data processing, analyzing, learning, and storage device;

one or more peripheral devices and embedded information devices for on-line monitoring, analyzing, predicting, decision making, and actuating controls;

one or more software elements within said peripheral devices and embedded information devices;

one or more messages and operational transactions represented by a collection of information and data elements, exchanged between or flowing through said elements, devices, subsystems, and systems; and

one or more messages and operational transactions represented by a collection of information and data elements, exchanged between or flowing through said enterprise-wide network or its elements with any element external to a monitored network.

12. A computer-implemented operational risk and business security big data driven analysis, learning, predicting, and control decision inference method, comprising:

providing a processor-implemented self-similar structure comprising a plurality of monitored and controlled elements (MCE) for each of a plurality of networks comprising any of a supply chain, production planning, demand forecast, inventory management, hospital clinical flow, clinical claims paid, and hospital admission and discharge;

deploying security and operation data and transaction monitoring, acquisition, analysis, learning, prediction, and inference pervasively around each MCE to monitor, analyze, and learn about said MCE'"'"'s structural connections and functional interactions with other MCEs, said security monitoring providing situational intelligence and computing short and long term business risk control decisions and security posture information from each producing MCE with other consuming MCEs;

based upon said self-similar structure, monitoring, analyzing, learning, and predicting security and operational risk state, said operational risk state comprising any of supply chain starvation, decreasing customer pull, uncorrelated order placement, security breach at a production site server, and inferring and adjusting control postures of all MCEs corresponding to various topological and structural attributes comprising any of geographical, organizational, and temporal hierarchies within a distributed architecture; and

pervasively monitoring security and operational data and patterns comprising any of intrusion events and data changes, statistically significant changes in states and functions, business outcomes comprising any of customer demand, inventory holding cost, product pricing, hospital resource utilization, and patient readmission rate and operational data comprising any of production level, operator attendance, raw material inventories, hospital resource availability and capacity, and lab tests ordered and medications prescribed and adaptively reconfiguring security and operation control capabilities, capacities, and operational parameters, ranges and thresholds at selected hierarchical levels and at selected time scales in response to enterprise situational knowledge that is relevant to networks of operational technology (OT) systems, information technology (IT) systems, and security systems (ST), as well as subsystems and elements of said networks with regard to underlying business processes, wherein said hierarchical levels range from an entire enterprise-wide network and business operation at a highest level to a single sensor, processor, or actuator, and information transaction at a lowest level;

providing an operational security and business risk analysis engine algorithmically processing, learning, and correlating elemental, systemic, and cross-domain situational intelligence, and cross-correlating data sets to logically and mathematically predict, validate, rank, and order situational operation security and business risk in a context comprising historical situational knowledge and domain knowledge about physical and underlying operational, business and security processes and systems, both structurally and functionally; and

inferring and producing a dynamic decision output based on the operational policies, process and rules, constraints, configurations, trigger parameters, and ranges for implemented rules and processes for reporting and controlling enterprise operation, business, and security risk management and for providing real-time and dynamic input back into coordinated learning and updating of said situational intelligence, situational knowledge, and domain knowledge.

13. The method of claim 12, wherein said situational knowledge comprises any of current and historically monitored situational data and transactions, patterns and interconnections representing operational activities and events and any change thereof, situational changes, control implementations, and adjustments thereof, and other transitions in any of said OT systems, IT systems, ST systems.

14. The method of claim 12, wherein said domain knowledge comprises business and operational processes, relational and connection information of operational data with other internal or external data and fact sets, and any change thereof, statistical and underlying physical models explaining operational, business, and security threat environment data and various learning.

15. The method of claim 12, wherein said security and business risk administration knowledge comprises business and operational policies, rules, implemented processes represented by the networked elements, constraints, configurations, and parameters.

16. The method of claim 12, wherein said data and fact sets comprise context and provide information for structural and statistical analysis, learning, and modeling for operational security and business risk and formulation of control actions for security and risk management.

17. The method of claim 12, wherein said MCEs comprise fractal objects and networks that are similar in structure and functions on all scales, and polymorphic, in that they are overloaded to take on different context-dependent data analysis, learning, and prediction and operate accordingly by selection and configuration of available functions, capabilities, constraints, parameters, ranges, and scales, with each other, wherein said MCEs differ only in scope of input data, scale of structure, scope of function, and output results.

18. The method of claim 12, wherein said OT systems comprise one or more industrial control systems (ICSs), said ICSs comprising any of production systems, inventory management systems, and hospital clinical flow management system, and further comprising embedded devices for monitoring, analyzing, predicting, and controlling performance of other physical process resources.

19. The method of claim 12, further comprising:

providing an operational security and business risk analysis engine algorithmically analyzing big data comprising situational data and transactions, patterns and interconnections representing operational activities and events and any change thereof, learning and correlating elemental, systemic and cross-domain situational intelligence, cross-correlating data sets to logically and mathematically predict, validate, rank, and order situational operation security and business risk in a context comprising historical situational knowledge and domain knowledge about the physical and underlying operational, business and security processes and systems, both structurally and functionally; and

inferring and producing a dynamic control decision output based on operational policies, process and rules, constraints, configurations, trigger parameters, and ranges for implemented rules and processes for reporting and controlling enterprise operation, business, and security risk management, and for providing real-time and dynamic input back into coordinated learning and updating of said situational intelligence, situational knowledge, and domain knowledge.

20. A computer-implemented networked business risk and operational security big data driven analysis, learning, prediction and control method, comprising:

providing an enterprise-wide computer network; and

providing a plurality of clusters of subsystems in said network, each subsystem comprising a plurality of lower level subsystems and individual computers and data analysis, learning, prediction and control applications, said individual computers and data analysis, learning, prediction and control applications, in turn, comprising a plurality of other smaller monitored and controlled elements (MCE) comprising any of computers, sensors, data acquisition, storage, analysis, learning, and business risk and operational security prediction and control systems at every level within the enterprise-wide computer network, and underlying business processes;

wherein each cluster comprises one or more computers designated as a server or client, wherein said computers within each cluster communicate with each other through physical network configurations and logical messaging structures, wherein a computer comprises any of a real computer and a virtual computer; and

providing a conceptual and computational model of situational knowledge, business risk and security control knowledge in a formal, machine-interpretable form comprising a combination of tabular data set and node-and-edge graphs;

wherein columns in the table and nodes in the graphs represent any of monitored data, transaction values, message content and meta-data, operational events, and security activity comprising situational data as well as business risk and operational security control policy and rule related facts and data elements;

wherein edges in the graph represent structural connection and functional interaction among situational data elements as discovered in the data, transaction, and exchanged messages as well as known structural connections and dependencies among facts and data elements representing risk control policies and security rules;

wherein nodes have attributes and values representing properties of the elements representing the node as well as attributes and values comprising thresholds and ranges representing properties of elements comprising risk control policy and security rule nodes;

wherein nodes comprise any of multiple types, said types comprising any of suppliers, raw materials, customers, finished products, production operators, manufacturing machines representing the situational knowledge about supply chain or physicians, patients, lab tests, diagnosed diseases, prescribed medications, all representing situational knowledge about clinical work flow or payment processing flow in a hospital business;

wherein node attribute values are found or discovered in transactions, messages, data patterns, and statistical derivation;

wherein edges have label attributes representing relations and interconnections between nodes as well as dependencies among risk control policy and security rule nodes, and values representing statistical probability, strength of relationships, threshold of dependency and frequency of interactions as discovered in data, transactions, and exchanged messages; and

wherein multiple edges exist between a same pair of nodes representing different types of relations, dependencies and interactions between the nodes as discovered in the data, both structural and functional;

providing a conceptual and computational model of domain knowledge comprising any of structural and correlational data patterns between any of goods and raw material, geo location and lead time of suppliers, lead time and inventory holding cost, machine failure and on-time delivery miss, and market factors and demand pull variance by customers for supply chain business risk analysis or between seasonality, patient age, and patient volume and admission causes in a hospital, between physician specialty, disease diagnosis accuracy, and clinical cost and outcome for clinical operation risk analysis.

21. The method of claim 20, wherein said conceptual and computational model of domain knowledge is in a formal, machine-interpretable form as a node-and-edge graph comprising:

wherein nodes represent domain related facts and data set elements;

wherein edges represent known structural connection and functional interaction among facts and data elements;

wherein nodes have attributes and values representing properties of elements representing the node;

wherein nodes are of multiple types said types comprising any of suppliers, raw materials, customers, finished products, production operators, manufacturing machines representing domain knowledge about supply chain or physicians, patients, lab tests, diagnosed diseases, prescribed medications, all representing the domain knowledge about clinical work flow or payment processing flow in a hospital business;

wherein edges have label attributes representing relations and interconnections and values representing statistical probability, strength of relationships, and frequency of interactions; and

wherein multiple edges exist between same pair of nodes representing different types of relations and interactions between them, both structural and functional.

22. The method of claim 20 further comprising:

providing a processor-implemented formal networked business risk and operational security threat prioritization and control inference processor which processes both a situational intelligence graph and a domain knowledge graph to learn and analyze structural and functional correlation across situation data in a context of domain knowledge and to identify and prioritize anomalies representing business and operational risk as well as processes a business risk and security control blueprint, policy, and rule graph to learn and analyze structural and functional correlation across prioritized anomalous situational data representing business risk and operational security in a context of business risk and security control knowledge;

said formal networked business risk and operational security threat prioritization and control inference processor further comprising;

statistical algorithms to analyze prioritized business risk and operational security situational data attributes;

graph processing algorithms to identify structure and attributes of a situational data cluster and correlate them in context of domain knowledge driven data clusters or a subset thereof; and

learning algorithms to identify anomalous situational data and patterns and predict business risks and operational security represented by them using a combination of statistical quantification and network graph feature analysis and computing anomaly impact on business and operational outcome; and

ordering and ranking algorithms to prioritize statistically significant anomalous situations influencing business risks and operational security; and

learning algorithms to identify a best statistical match of anomalous situational data and patterns representing business risk and operational security to available ranges and thresholds of business risk control rules, using a combination of statistical quantification and network graph feature analysis and computing control impact on business and operational outcome.

23. The method of claim 22, wherein a control inference process comprises any of matching statistical features for business risk and security risk represented by a situational anomaly comprising any of raw material inventory depletion below a threshold, increase in production lead time above a threshold, and market competition revenue rate increase above a threshold for supply chain business risk control to a set of control actions encoded as a rule target guided by risk management and security control policies, and blueprint and comparing cost of target control actions comprising any of outsourcing corresponding customer orders, taking a hit on on-time-delivery, lowering cost to customer through free shipment, and choosing a most cost effective risk control match.

24. The method of claim 20, wherein said situational knowledge comprises any of current and historical data patterns comprising any of raw material lead time by suppliers, pricing variance by suppliers, geo location of suppliers, machine failure and downtime at factory floor, and goods demand pull variance by customers for supply chain business risk analysis or patient volume and admission causes in a hospital, physician and hospital resource availability for clinical operation risk analysis;

wherein said business risk and operational security control knowledge comprises any of control choices for on-time delivery (OTD) requirements by customers, control choice allowed by service level agreements on lead time variance, controlling cost liabilities of vendor managed inventories for supply chain business risk control, and pandemic, emergency, and surge management agreements on patient diversion with partner or referral hospitals for clinical operation risk control.