Methods, systems, computer program products and data structures for hierarchical organization of data associated with security events

• US 20060070127A1
• Filed: 09/15/2005
• Published: 03/30/2006
• Est. Priority Date: 09/28/2004
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Kraemer, James R., Friedlander, Robert R.
• Granted Patent: US 8,782,780 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 16/2457 with adaptation to user needs
• CPC Class Codes: G06F 16/282 Hierarchical databases, e.g. IMS, LDAP data stores or Lotus Notes
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 50/26 Government or public services business processes related to the transportation industry G06Q50/40
• CPC Class Codes: G16H 10/20 for electronic clinical trials or questionnaires
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16H 70/00 ICT specially adapted for the handling or processing of medical references

Abstract

Methods, data structures, systems and computer program products are provided for organizing security data. A triggering security event is hierarchically related to at least one additional security event based on a possible relationship between the triggering security event and the at least one additional security event in a computer database environment.

Claims

1. A method of organizing security data comprising hierarchically relating a triggering security event with at least one additional security event based on a possible relationship between the triggering security event and the at least one additional security event in a computer database environment.

2. The method of claim 1, further comprising:

receiving a request specifying the triggering security event at the computer database environment; and

providing the at least one additional security event possibly associated with the specified triggering security event responsive to the request.

3. The method of claim 2, further comprising:

determining a likelihood that the triggering security event and the at least one additional security event are related exceeds a predetermined threshold; and

generating an alert indicating that the predetermined threshold has been exceeded if it is determined that the predetermined threshold has been exceeded.

4. The method of claim 1, wherein the at least one additional security event comprises security events occurring at different times within a specified time period and/or a specified location.

5. The method of claim 1, further comprising identifying the triggering security event based on at least one identified pattern defining security events.

6. The method of claim 5, further comprising fine tuning the identified patterns and/or adding identified patterns to the computer database environment based on the triggering security event and/or the at least one additional security event.

7. The method of claim 6, further comprising automatically fine tuning the identified patterns and/or adding the identified patterns based on normal patterns, the normal patterns including season of the year, holidays, climatic norms and abnormalities and/or events of national and international significance.

8. The method of claim 5, wherein the at least one identified pattern is identified based on purchases made, actions taken, data flows and/or money flows.

9. The method of claim 1, wherein the possible relationship between the triggering security event and the at least one additional security event comprises a relationship between people associated with the triggering security event and the at least one additional security event.

10. A data structure for organizing security data in a computer database environment embodied in a computer readable medium, comprising:

a triggering security event object at a first level of hierarchy in a computer database environment; and

at least one additional security event data objects at a second level of the hierarchy in the computer database environment that is lower than the of the first level of the hierarchy, wherein the at least one additional security event data objects are identified based on a possible relationship between the triggering security event object and the at least one additional security event object.

11. The data structure of claim 10, wherein the at least one additional security event object comprises data associated with security events occurring at different times within a specified time period and/or a specified location.

13. The system of claim 11, wherein the processor circuit is further configured to receive a request specifying the triggering security event object and provide the at least one additional security event object possibly associated with the specified triggering security event object responsive to the request.

14. The system of claim 13, wherein the processor is further configured to determine a likelihood that the triggering security event object and the at least one additional security event object are related exceeds a predetermined threshold and generate an alert indicating that the predetermined threshold has been exceeded if it is determined that the predetermined threshold has been exceeded.

12. A system for organizing security data comprising:

a database environment configured to store a triggering security event object at a first level of hierarchy in a computer database environment and at least one additional security event object at a second level of the hierarchy in the computer database environment that is lower than the of the first level of the hierarchy, wherein the at least one additional security event object is identified based on a possible relationship between the triggering security event object and the at least one additional security object; and

a processor circuit configured to hierarchically relate the triggering security event object to the at least one additional security event object.

15. The system of claim 12, wherein the at least one additional security event object comprises data associated with security events occurring at different times within a specified time period and/or a specified location.

16. The system of claim 12, wherein the processor is further configured to identify the triggering security event object based on at least one identified pattern defining security events.

17. The system of claim 16, wherein the processor is further configured to fine tune the identified patterns and/or add identified patterns to the database environment based on the triggering security event object and/or the at least one additional security event object.

18. The system of claim 16, wherein the at least one identified pattern is identified based on purchases made, actions taken, data flows and/or money flows.

19. The system of claim 12, wherein the possible relationship between the triggering security event and the at least one additional security event comprises a relationship between people associated with the triggering security event and the at least one additional security event.

20. A computer program product for organizing security data comprising:

computer readable storage medium having computer readable program code embodied in said medium, the computer readable program code comprising;

computer readable program code configured to hierarchically relate a triggering security event with at least one additional security event based on a possible relationship between the triggering security event and the at least one additional security event in a computer database environment.

21. The computer program product of claim 20, further comprising:

computer readable program code configured to receive a request specifying the triggering security event at the computer database environment; and

computer readable program code configured to provide the at least one additional security event possibly associated with the specified triggering security event responsive to the request.

22. The computer program product of claim 21, further comprising:

computer readable program code configured to determine a likelihood that the triggering security event and the at least one additional security event are related exceeds a predetermined threshold; and

computer readable program code configured to generate an alert indicating that the predetermined threshold has been exceeded if it is determined that the predetermined threshold has been exceeded.

23. The computer program product of claim 20, wherein the at least one additional security event comprises security events occurring at different times within a specified time period and/or a specified location.

24. The computer program product of claim 20, further comprising computer readable program code configured to identify the triggering security event based on at least one identified pattern defining security events.

25. The computer program product of claim 24, further comprising computer readable program code configured to fine tune the identified patterns and/or add identified patterns to the computer database environment based on the triggering security event and/or the at least one additional security event.

26. The computer program product of claim 24, wherein the at least one identified pattern is identified based on purchases made, actions taken, data flows and/or money flows.

27. The computer program product of claim 20, wherein the possible relationship between the triggering security event and the at least one additional security event comprises a relationship between people associated with the triggering security event and the at least one additional security event.