Apparatus and method for prioritized grouping of data representing events

• US 20060074621A1
• Filed: 08/31/2004
• Published: 04/06/2006
• Est. Priority Date: 08/31/2004
• Status: Abandoned Application

• Current Assignee: Securimine Software Inc.
• Original Assignee: Securimine Software Inc.
• Inventors: Rachman, Ophir
• Application Number:
  US10/931,297
• Publication Number:
  US 20060074621A1
• Time in Patent Office: Days
• US Class Current: 703/22
• CPC Class Codes: G06Q 90/00 Systems or methods specially adapted for administrative, commercial, financial, managerial or supervisory purposes, not involving significant data processing

Abstract

An apparatus and method for the grouping and prioritization of data events using behavioral modeling. The number of events to be analyzed is reduced by generating a behavioral model comprising modeling events groups, by grouping similar events into event groups, by calculating and assigning priority indicators based on the characteristics of the event groups and the behavioral model.

Claims

1. An apparatus having an at least one central processing unit and an at least one storage device, for the grouping and prioritizing of events, the apparatus comprising:

a behavioral model builder component to generate and store a behavioral model, said behavioral model comprises;

at least one modeling event group, the modeling event group comprises an at least one modeling parameter classification associated with a parameter type wherein one or more parameter values are stored;

the

modeling events group are associated with one or more events having similar parameter values.

2. The apparatus of claim 1 further comprising a behavioral model storage to store the behavioral model.

3. The apparatus of claim 1 wherein the behavioral model further comprises modeling patterns.

4. The apparatus of claim 1 further comprises:

‘

an event storage component to receive at least one event from event collector components, to store the received at least one event and to transfer the received at least one event to one or more of the behavioral model builder and model storage component and to the event analyzer component; and

an events storage to receive at least one event from the event storage component, to hold the at least one event as a stored event entity and to provide the at least one event entity to the event analyzer component.

5. The apparatus of claim 3 wherein the event entity is a data record.

6. The apparatus of claim 3 wherein the event entity stored in the event storage comprises;

an at least one event parameter comprising a parameter type indicator and a parameter value; and

an event identifier to uniquely identify the event.

7. The apparatus of claim 1 wherein the behavioral model further comprises an at least one modeling pattern relating to the modeling events.

8. The apparatus of claim 3 wherein the event entity stored in the event storage comprises an at least one timestamp to indicate a specific point in time associated with the at least one event.

9. The apparatus of claim 1 further comprising an event analyzer component to associate an at least one event with a modeling event group, and to calculate the priority indicator of the at least one event in accordance with the characteristics of the associated modeling events group information stored in the modeling events group in the behavioral model and the quality of matching achieved between the event information stored in the modeling events group in the behavioral model and the characteristics of the event.

10. Within a computerized platform having an at least one central processing unit and at least one storage device, a method for the grouping and prioritization of events, the method comprising:

generating a behavioral model comprising one or more behavioral modeling event groups based on one or more characteristics of one or more modeling events;

grouping one or more events into an modeling event groups based on the characteristics of the events and based on the characteristics of one or more substantially matching modeling event groups in the behavioral model.

11. The method of claim 10 wherein generating of the behavioral model comprises:

calculating the modeling classifications by the modeling event parameter values; and

calculating the modeling events groups.

12. The method of claim 10 wherein generating of the behavioral model further comprises:

finding the relevant modeling patterns; and

storing the modeling events, modeling patterns and modeling parameters into the behavioral model.

13. The method of claim 10 further comprises:

defining a set of events participating in the building of the behavioral model; and

reducing the number of events by performing a sampling process.

14. The method of claim 10 wherein grouping the modeling events into the modeling event groups comprises:

calculating the modeling events groups; and

matching the events groups to the modeling events groups in the behavioral model.

15. The method of claim 10 wherein calculating the priority value comprises:

calculating a quality value indicating the match quality of the event group with the modeling event group in the behavioral model to generate an event group priority value.

16. The apparatus of claim 10 wherein an event is an occurrence represented by data elements.

17. The method of claim 11 further comprising the steps of determining a priority value characterizing the event group;

and assigning the priority value to the event group.

18. Within a computerized platform having an at least one central processing unit and at least one storage device, a method for the grouping and prioritization of events, the method comprising:

receiving events to be analyzed;

calculating one or more event groups based on parameters values associated with the events;

for each event group associate an at least one modeling event group associated with a behavioral model;

determined match quality value for the event group based on the distance of the event group to the modeling event group in the behavioral model;

determined the number of patterns in the behavioral model that are violated with the parameters of the events in the events group;

factoring the number of violations with the match quality value of the event group; and

generating a priority value.

19. The method of claim 18 further comprises the step of defining a set of events to be analyzed.

20. The method of claim 18 further comprises printing or displaying a priority report or a priority display based on the priority values of the event groups.

21. The method of claim 18 wherein the step of associating a modeling event group is based on the distance between the event group and the modeling event group within a behavioral model.

22. The method of claim 18 further comprising the step of normalizing the priority value.

23. The method of claim 18 wherein the grouping of the events is performed in real time.

24. The method of claim 18 wherein the grouping of the events is performed periodically or triggered manually.

25. The method of claim 18 wherein calculating and assigning priority values to the event groups is performed in real time.

26. The method of claim 18 calculating and performing priority values to the events groups is performed periodically or triggered manually.

27. A computer readable storage medium containing a set of instructions for a general purpose computer, the set of instructions comprising and event analyzer, said event analyzer performing the following steps:

receiving events to be analyzed;

calculating one or more event groups based on parameters values associated with the events;

for each event group associate a modeling event group associated with a behavioral model;

determined match quality value for the event group based on the distance of the event group to the modeling event group in the behavioral model;

determined the number of patterns in the behavioral model that are violated with the parameters of the events in the events group;

factoring the number of violations with the match quality value of the event group; and

generating a priority value.