Subjective and statistical event tracking incident management system

• US 7,716,739 B1
• Filed: 07/20/2005
• Issued: 05/11/2010
• Est. Priority Date: 07/20/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: McCorkendale, Bruce
• Primary Examiner(s): Shiferaw; Eleni A
• Application Number:
  US11/186,133
• Time in Patent Office: 1,756 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25, 726/26, 340/5.8
• US Class Current: 726/23
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A method includes logging past event sequences in a knowledge base, receiving a real-time event sequence, comparing the real-time event sequence to the past event sequences to determine a predicted event sequence for the real-time event sequence, and providing the predicted event sequence, a suggested course of action with predicted outcome, and a recommendation of a user who previously encountered the event sequence. In the above manner, use of subjectively characterized and/or raw historic data to match real-time event sequences provides users with both subjective advice from those who had previously faced similar conditions as well as raw statistical predictions as to what is expected to come next. This allows the users to take a course of action that results in the most desirable outcome.

Claims

1. A method comprising:

receiving a real-time event sequence;

comparing, by a processor, said real-time event sequence to at least one past event sequence in a knowledge base stored in a memory, said real-time event sequence being a portion of said past event sequence;

providing a predicted event sequence comprising events of said past event sequence following said portion, said predicted event sequence is a new event sequence predicted to occur after said real-time event sequence;

wherein said knowledge base further comprises a past course of action taken in response to said past event sequence, said method further comprising providing said past course of action as a suggested course of action to take in response to said real-time event sequence; and

wherein said knowledge base further comprises a past outcome that resulted from taking said past course of action, said method further comprising providing said past outcome as a predicted outcome to taking said suggested course of action.

2. The method of claim 1 wherein said past event sequence is an event sequence which has been observed in the past.

3. The method of claim 2 further comprising:

collecting said past event sequence; and

logging said past event sequence in said knowledge base.

4. The method of claim 2 further comprising:

collecting said past course of action taken in response to said past event sequence;

collecting said past outcome of said past course of action; and

associating said past course of action and said past outcome to said past event sequence in said knowledge base.

5. The method of claim 4 further comprising characterizing said past outcome.

6. The method of claim 1 wherein said portion of said past event sequence comprises a beginning portion of said past event sequence.

7. The method of claim 6 wherein said beginning portion comprises initial events of said past event sequence.

8. The method of claim 7 wherein said predicted event sequence comprises final events of said past event sequence, said final events following said initial events.

9. The method of claim 1 wherein said portion of said past event sequence comprises a later portion of said past event sequence.

10. The method of claim 9 wherein said later portion comprises later events following initial events of said past event sequence.

11. The method of claim 9 wherein said predicted event sequence comprises final events of said past event sequence, said final events following said later events.

12. The method of claim 1 further comprising determining whether said predicted outcome is acceptable.

13. The method of claim 12 wherein upon a determination that said predicted outcome is unacceptable, said method further comprising receiving a proposed course of action.

14. The method of claim 13 wherein said knowledge base further comprises another past course of action matching said proposed course of action, wherein said knowledge base further comprises another past outcome associated with said another past course of action, said method further comprising providing said another past outcome as a predicted outcome to said proposed course of action.

15. The method of claim 1 wherein said knowledge base further comprises a recommendation associated with said past event sequence, said method further comprising providing said recommendation.

16. A method comprising:

logging past event sequences in a knowledge base stored in a memory;

logging past courses of action taken in response to said past event sequences and associated outcomes in said knowledge base;

characterizing at least one of said associated outcomes as a positive outcome;

receiving a real-time event sequence;

comparing, by a processor, said real-time event sequence to said past event sequences to determine a predicted event sequence for said real-time event sequence;

providing said predicted event sequence, said predicted event sequence is a new event sequence predicted to occur after said real-time event sequence;

providing one of said courses of action associated with said positive outcome as a suggested course of action to take in response to said real-time event sequence; and

providing said positive outcome as a predicted outcome to taking said suggested course of action.

17. A computer system comprising:

a memory having stored therein an event tracking application; and

a processor coupled to said memory, wherein execution of said event tracking application generates a method comprising;

comparing a real-time event sequence to at least one past event sequence in a knowledge base, said real-time event sequence being a portion of said past event sequence;

determining a predicted event sequence comprising events of said past event sequence following said portion, said predicted event sequence is a new event sequence predicted to occur after said real-time event sequence;

wherein said knowledge base further comprises a past course of action taken in response to said past event sequence, said method further comprising providing said past course of action as a suggested course of action to take in response to said real-time event sequence; and

wherein said knowledge base further comprises a past outcome that resulted from taking said past course of action, said method further comprising providing said past outcome as a predicted outcome to taking said suggested course of action.