Pattern Detection and Recommendation

• US 20110246483A1
• Filed: 12/06/2010
• Published: 10/06/2011
• Est. Priority Date: 03/21/2006
• Status: Abandoned Application

• Current Assignee: Northrop Grumman Systems Corporation (Northrop Grumman Corporation)
• Original Assignee: 21st Century Technologies, Inc.
• Inventors: Marcus, Sherry, Darr, Timothy P.
• Application Number:
  US12/960,762
• Publication Number:
  US 20110246483A1
• Time in Patent Office: Days
• US Class Current: 707/748
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

In one or more embodiments, one or more methods and/or systems described can perform receiving a pattern; determining that components of the received pattern match corresponding components of patterns that have not been rated by a user but have been rated by other users in the user'"'"'s community; calculating multiple predictive ratings corresponding to the patterns; ranking the patterns based on the predictive ratings; and recommending one or more of the top-ranked patterns to the user. In one or more embodiments, calculating multiple predictive ratings corresponding to the patterns can include calculating multiple correlation coefficients. In one example, calculating multiple correlation coefficients can be based on the other users'"'"' ratings of the patterns. In another example, calculating multiple correlation coefficients can be based on the other users'"'"' ratings of one or more components of the patterns.

Claims

1. A method, comprising:

receiving network event data;

determining a network pattern from the network event data;

determining a plurality of network patterns based on a plurality of components of the network pattern, wherein each of the plurality of network patterns includes the plurality of components of the network pattern;

accessing a data structure that includes a plurality of vectors corresponding to a plurality of users, wherein each vector of the plurality of vectors includes a plurality of ratings corresponding to the plurality of network patterns;

calculating, based on the plurality of ratings, a plurality of predictive ratings corresponding to the plurality of network patterns;

ranking the plurality of network patterns based on the plurality of predictive ratings; and

after said ranking, recommending at least a first ranked network pattern of the plurality of network patterns.

2. The method of claim 1,

wherein the plurality of vectors is a plurality of arrays of elements corresponding to the plurality of users;

and

wherein each array of elements of the plurality of arrays of elements includes the plurality of ratings corresponding to the plurality of network patterns.

3. The method of claim 1, wherein the plurality of ratings corresponding to the plurality of network patterns includes a plurality of component ratings corresponding to at least one of the plurality of components of the network pattern.

4. The method of claim 1, wherein one or more of the plurality of components of the network pattern include respective one or more of a source Internet protocol (IP) address, a destination IP address, a source media access control (MAC) address, a destination MAC address, a source port number, a destination port number, a protocol, an ingress interface identification, a type of service identification, a packet length, and a sequence number.

5. The method of claim 1,

wherein at least two of the plurality of users are included in a community of users;

wherein said calculating, based on the plurality of ratings, the plurality of predictive ratings corresponding to the plurality of network patterns is further based on a vector of the plurality of vectors corresponding to a user of the plurality of users; and

wherein the user is included in the community of users.

6. The method of claim 5, wherein the community of users includes a plurality of network analysts.

7. The method of claim 1, wherein said accessing the data structure includes indexing into the data structure utilizing at least one index to access at least one rating of the plurality of ratings.

8. The method of claim 7, wherein the least one index include a memory offset, a row of a table of a database, or a column of the table of the database.

9. The method of claim 1, further comprising:

initiating graph pattern matching within an input graph that represents a social network, the graph pattern matching utilizing pre-defined social network analysis metrics to provide a context for finding a true match, wherein the graph pattern matching locates one or more matched graphs within the input graph including similar inter-connections among nodes as a target graph pattern; and

analyzing each matched graph of the one or more matched graphs using social network analysis metrics-based context from at least one of local node attributes within the matched graph and non-local node attributes, external to the matched graph, to determine when the matched graph is a true match;

wherein the network pattern is included in the one or more matched graphs and is a true match.

10. The method of claim 1,

wherein said calculating, based on the plurality of ratings, the plurality of predictive ratings corresponding to the plurality of network patterns includes calculating a plurality of correlation coefficients;

and

wherein calculating each predictive rating of the plurality of predictive ratings includes summing a plurality of products, wherein each product of the plurality of products is produced from a plurality of factors, wherein a first factor of the plurality of factors is a correlation coefficient of the plurality of correlation coefficients.

11. The method of claim 10, wherein a second factor of the plurality of factors is a rating of the plurality of ratings less an average rating for a user of the plurality of users.

12. The method of claim 1,

wherein said calculating, based on the plurality of ratings, the plurality of predictive ratings corresponding to the plurality of network patterns includes calculating a plurality of correlation coefficients;

and

wherein said calculating the plurality of correlation coefficients includes;

calculating a first sum of first values, wherein each of the first values includes a first rating of the plurality of ratings corresponding to a user of the plurality of users and a first network pattern of the plurality of network patterns; and

calculating a second sum of second values, wherein each of the second values includes a second rating of the plurality of ratings corresponding to another user of the plurality of users and the first network pattern of the plurality of network patterns.

13. The method of claim 12, wherein said calculating, based on the vector of the plurality of vectors corresponding to the user of the plurality of users and the plurality of vectors, the plurality of correlation coefficients includes:

calculating a quotient, wherein the quotient includes a dividend that is based on the first sum of the first values and the second sum of the second values.

14. The method of claim 1,

wherein said ranking the plurality of network patterns based on the plurality of predictive ratings includes:

sorting the plurality of predictive ratings from a high predictive rating of the plurality of predictive ratings to a low predictive rating of the plurality of predictive ratings; and

ordering the plurality of patterns based on the plurality of predictive ratings sorted from the high predictive rating of the plurality of predictive ratings to the low predictive rating of the plurality of predictive ratings; and

wherein the at least the first ranked network pattern corresponds to the high predictive rating.

15. The method of claim 1, wherein the plurality of network patterns includes a plurality of computer network events.

16. The method of claim 1, wherein the plurality of network patterns includes a plurality of graph matched patterns.

17. The method of claim 1, further comprising:

displaying the at least the first ranked network pattern.

18. The method of claim 1, wherein the plurality of network patterns includes a plurality of cyber threat patterns.

19. A computer program product, comprising:

a computer readable memory medium; and

program code on the computer readable memory medium that when executed by a data processing system, cause the data processing system to perform;

receiving network event data;

determining a network pattern from the network event data;

determining a plurality of network patterns based on a plurality of components of the network pattern, wherein each of the plurality of network patterns includes the plurality of components of the network pattern;

accessing a data structure that includes a plurality of vectors corresponding to a plurality of users, wherein each vector of the plurality of vectors includes a plurality of ratings corresponding to the plurality of network patterns;

calculating, based on the plurality of ratings, a plurality of predictive ratings corresponding to the plurality of network patterns;

ranking the plurality of network patterns based on the plurality of predictive ratings; and

after said ranking, recommending at least a first ranked network pattern of the plurality of network patterns.

20. The computer program product of claim 19,

wherein the plurality of vectors is a plurality of arrays of elements corresponding to the plurality of users;

and

wherein each array of elements of the plurality of arrays of elements includes the plurality of ratings corresponding to the plurality of network patterns.

21. The computer program product of claim 19, wherein the plurality of ratings corresponding to the plurality of network patterns includes a plurality of component ratings corresponding to at least one of the plurality of components of the network pattern.

22. The computer program product of claim 19, wherein one or more of the plurality of components of the network pattern include respective one or more of a source Internet protocol (IP) address, a destination IP address, a source media access control (MAC) address, a destination MAC address, a source port number, a destination port number, a protocol, an ingress interface identification, a type of service identification, a packet length, and a sequence number.

23. The computer program product of claim 19,

wherein at least two of the plurality of users are included in a community of users;

wherein said calculating, based on the plurality of ratings, the plurality of predictive ratings corresponding to the plurality of network patterns is further based on a vector of the plurality of vectors corresponding to a user of the plurality of users; and

wherein the user is included in the community of users.

24. The computer program product of claim 23, wherein the community of users includes a plurality of network analysts.

25. The computer program product of claim 19, wherein said accessing the data structure includes indexing into the data structure utilizing at least one index to access at least one rating of the plurality of ratings.

26. The computer program product of claim 25, wherein the least one index include a memory offset, a row of a table of a database, or a column of the table of the database.

27. The computer program product of claim 19, wherein the program code on the computer readable memory medium that when executed by the data processing system, cause the data processing system to further perform:

initiating graph pattern matching within an input graph that represents a social network, the graph pattern matching utilizing pre-defined social network analysis metrics to provide a context for finding a true match, wherein the graph pattern matching locates one or more matched graphs within the input graph including similar inter-connections among nodes as a target graph pattern; and

analyzing each matched graph of the one or more matched graphs using social network analysis metrics-based context from at least one of local node attributes within the matched graph and non-local node attributes, external to the matched graph, to determine when the matched graph is a true match;

wherein the network pattern is included in the one or more matched graphs and is a true match.

28. The computer program product of claim 19,

wherein said calculating, based on the plurality of ratings, the plurality of predictive ratings corresponding to the plurality of network patterns includes calculating a plurality of correlation coefficients;

and

wherein calculating each predictive rating of the plurality of predictive ratings includes summing a plurality of products, wherein each product of the plurality of products is produced from a plurality of factors, wherein a first factor of the plurality of factors is a correlation coefficient of the plurality of correlation coefficients.

29. The computer program product of claim 28, wherein a second factor of the plurality of factors is a rating of the plurality of ratings less an average rating for a user of the plurality of users.

30. The computer program product of claim 19,

wherein said calculating, based on the plurality of ratings, the plurality of predictive ratings corresponding to the plurality of network patterns includes calculating a plurality of correlation coefficients;

and

wherein said calculating the plurality of correlation coefficients includes;

calculating a first sum of first values, wherein each of the first values includes a first rating of the plurality of ratings corresponding to a user of the plurality of users and a first network pattern of the plurality of network patterns; and

calculating a second sum of second values, wherein each of the second values includes a second rating of the plurality of ratings corresponding to another user of the plurality of users and the first network pattern of the plurality of network patterns.

31. The computer program product of claim 30, wherein said calculating, based on the vector of the plurality of vectors corresponding to the user of the plurality of users and the plurality of vectors, the plurality of correlation coefficients includes:

calculating a quotient, wherein the quotient includes a dividend that is based on the first sum of the first values and the second sum of the second values.

32. The computer program product of claim 19,

wherein said ranking the plurality of network patterns based on the plurality of predictive ratings includes:

sorting the plurality of predictive ratings from a high predictive rating of the plurality of predictive ratings to a low predictive rating of the plurality of predictive ratings; and

ordering the plurality of patterns based on the plurality of predictive ratings sorted from the high predictive rating of the plurality of predictive ratings to the low predictive rating of the plurality of predictive ratings; and

wherein the at least the first ranked network pattern corresponds to the high predictive rating.

33. The computer program product of claim 19, wherein the plurality of network patterns includes a plurality of computer network events.

34. The computer program product of claim 19, wherein the plurality of network patterns includes a plurality of graph matched patterns.

35. The computer program product of claim 19, wherein the program code on the computer readable memory medium that when executed by the data processing system, cause the data processing system to further perform:

displaying the at least the first ranked network pattern.

36. The computer program product of claim 19, wherein the plurality of network patterns includes a plurality of cyber threat patterns.

37. A system, comprising:

a memory including program instructions; and

a processor coupled to the memory;

wherein the processor fetches the program instructions from the memory; and

wherein, based on the program instructions fetched from the memory, the processor;

receives network event data;

determines a network pattern from the network event data;

determines a plurality of network patterns based on a plurality of components of the network pattern, wherein each of the plurality of network patterns includes the plurality of components of the network pattern;

accesses a data structure that includes a plurality of vectors corresponding to a plurality of users, wherein each vector of the plurality of vectors includes a plurality of ratings corresponding to the plurality of network patterns;

calculates, based on the plurality of ratings, a plurality of predictive ratings corresponding to the plurality of network patterns;

ranks the plurality of network patterns based on the plurality of predictive ratings; and

after ranking the plurality of network patterns based on the plurality of predictive ratings, recommends at least a first ranked network pattern of the plurality of network patterns.

38. The system of claim 37, wherein when the processor accesses the data structure, the processor indexes into the data structure utilizing at least one index to access at least one rating of the plurality of ratings.

39. The system of claim 37, wherein, based on the program instructions fetched from the memory, the processor:

initiates graph pattern matching within an input graph that represents a social network, the graph pattern matching utilizing pre-defined social network analysis metrics to provide a context for finding a true match, wherein the graph pattern matching locates one or more matched graphs within the input graph including similar inter-connections among nodes as a target graph pattern; and

analyzes each matched graph of the one or more matched graphs using social network analysis metrics-based context from at least one of local node attributes within the matched graph and non-local node attributes, external to the matched graph, to determine when the matched graph is a true match;

wherein the network pattern is included in the one or more matched graphs and is a true match.

40. The system of claim 37, further comprising:

a display coupled to the processor;

wherein, based on the program instructions fetched from the memory, the processor, via the display, displays the at least the first ranked network pattern.

41. The system of claim 37,

wherein the processor includes at least one of an arithmetic logic unit and a floating-point unit;

wherein when the processor calculates, based on the plurality of ratings, the plurality of predictive ratings corresponding to the plurality of network patterns, the processor configures the at least one of the arithmetic logic unit and the floating-point unit and the east one of the arithmetic logic unit and the floating-point unit calculates, based on the plurality of ratings, the plurality of predictive ratings corresponding to the plurality of network patterns.

42. The system of claim 37, further comprising:

a router coupled to the processor;

wherein when the processor receives the network event data, the processor receives the network event data from the router.