DETECTION OF ACTIVITY PATTERNS

• US 20100100693A1
• Filed: 03/27/2008
• Published: 04/22/2010
• Est. Priority Date: 03/30/2007
• Status: Active Grant

• Current Assignee: Symphonyai Netreveal Patent Limited
• Original Assignee: Detica Patent Ltd (BAE Systems Plc)
• Inventors: O'Leary, Kevin Mary, Hayes, Cecil, Colleran, Killian, Kerley, Paul
• Granted Patent: US 10,395,309 B2
• Time in Patent Office: Days
• US Class Current: 711/154
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes

Abstract

A monitoring system (1) comprises an interface (2) for receiving source alerts from at least one detection engine, a database (7) of historical events; and a classifier (3) for classifying received source alerts by linking a source alert with an historical event or a current source alert to provide a link, and providing said link as an output alert. The classifier comprises match methods (9) for processing source alerts and generating a score for extent of matching of a source alert with an historical event or current source alert, a voting engine (4) for weighting scores from the match methods (9), and a linking function (6) for determining that there is a link if a combination of the weighted outputs of a plurality of match methods exceeds a threshold. At least some match methods (9) are each associated with a specific field of a source alert such as a numerical value field or a name field of a source alert. A feedback function (6) notifies a case management system (5) of links, and the voting engine (4) receives from the case management system (5) feedback (11) of success of each match method (9), and adjusts match method weights (12) accordingly.

Claims

1-24. -24. (canceled)

25. A monitoring system comprising:

an interface for receiving source alerts from at least one detection engine,

a database of historical events;

a classifier for classifying received source alerts by linking a source alert with an historical event or a current source alert to provide a link, and providing said link as an output alert, wherein the classifier comprises;

a plurality of match methods for processing source alerts and generating a score for extent of matching of a source alert with an historical event or current source alert,

a voting engine for weighting scores from the match methods,

a linking function for determining that there is a link if a combination of the weighted outputs of a plurality of match methods exceeds a threshold.

26. The monitoring system as claimed in claim 25, wherein:

at least some match methods are each associated with a specific field of a source alert,

a match method processes a numerical value field of a source alert,

a match method processes a name field of a source alert, and

a match method processes risk quantifiers in source alerts.

27. The system as claimed in claim 25, wherein the voting engine is adapted to apply linear or non-linear functions to determine weights.

28. The system as claimed in claim 25, wherein:

the system comprises a feedback function for notifying a case management system of links,

the voting engine comprises a function for receiving from the case management system feedback of success of each match method, and for adjusting match method weights accordingly,

the voting engine is adapted to initialize a plurality of match method weights to be equal and to vary them according to success of each individual match method in identifying links, and

said feedback includes a number of false positives and a number of false negatives.

29. The monitoring system as claimed in claim 25, wherein the voting engine is adapted to lock score registers so that they can not be simultaneously accessed by more than one user, thus preserving the integrity of the data in the register

30. The monitoring system as claimed in claim 28, further comprising a timer to periodically trigger a process to query the historical event database to extract a set of records which are passed through the classifier, scored by the voting engine and linked together before being passed to the case management system, and wherein the timer is adapted to inspect the database and extract a set of grouped events according to search criteria, and the classifier is adapted to compare a source alert with other members of the group using a set of match methods, and wherein the linking function is adapted to insert a new database record comprising a unique key of the group, and a unique key for each linked alert, and a flag to indicate that the alerts are linked.

31. The monitoring system as claimed in claim 25, wherein the interface comprises an adapter for normalizing the source alerts, and wherein the adapter performs source alert validation, and wherein the adapter adds data to a source alert, and wherein the adapter dynamically retrieves data from a database to add to a source alert, and wherein the system comprises means for routing a source alert directly to the classifier, by-passing the adapter.

32. The monitoring system as claimed in claim 25, wherein the interface comprises an adapter for normalizing the source alerts, and wherein:

the adapter performs source alert validation, and

the adapter adds data to a source alert, and

the adapter dynamically retrieves data from a database to add to a source alert, the system is adapted to route a source alert directly to the classifier, by-passing the adapter; and

the system is adapted to instantiate adapter objects including memory buffers to temporarily hold messages until they can be processed.

33. The monitoring system as claimed in claim 25, wherein:

the interface comprises an adapter for normalizing the source alerts, and wherein the adapter performs source alert validation, and

the adapter adds data to a source alert, and

the adapter dynamically retrieves data from a database to add to a source alert, the system comprises means for routing a source alert directly to the classifier, by-passing the adapter;

the system is adapted to instantiate adapter objects including memory buffers to temporarily hold messages until they can be processed; and

each adapter object is adapted to fetch messages from a memory buffer and to execute a set of logical routines on individual fields of each source alert to perform validation of fields of the source alert to check that they meet quality tests.

34. The monitoring system as claimed in claim 25, wherein:

the system comprises a feedback function for notifying a case management system of links,

the voting engine comprises a function for receiving from the case management system feedback of success of each match method, and for adjusting match method weights accordingly,

the voting engine is adapted to initialize a plurality of match method weights to be equal and to vary them according to success of each individual match method in identifying links, and

said feedback includes a number of false positives and a number of false negatives; and

wherein said routines perform transformation of individual source alert fields into a required format or create additional fields which are combinations of existing fields.

35. The monitoring system as claimed in claim 25, further comprising a configuration function for configuring at least one of the components of the system, including the classifier.

36. The monitoring system as claimed in claim 25, further comprising a case management system for transmitting feedback to the classifier, and wherein:

the system comprises a feedback function for notifying a case management system of links,

the voting engine comprises a function for receiving from the case management system feedback of success of each match method, and for adjusting match method weights accordingly,

the voting engine is adapted to initialize a plurality of match method weights to be equal and to vary them according to success of each individual match method in identifying links, and

said feedback includes a number of false positives and a number of false negatives

37. The computer readable medium comprising software code for performing interface and classifier operations of a monitoring system of claim 25 when executing on a digital processor.