Predictive threat assessment

• US 7,933,989 B1
• Filed: 01/08/2009
• Issued: 04/26/2011
• Est. Priority Date: 01/25/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Vig Acquisitions Ltd LLC (Intellectual Ventures LLC)
• Inventors: Barker, Geoffrey T., Alexander, Bruce
• Primary Examiner(s): Avellino; Joseph
• Assistant Examiner(s): WASEL, MOHAMED A
• Application Number:
  US12/350,855
• Time in Patent Office: 838 Days
• Field of Search: 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system for processing monitoring device data that includes a central processing server in communication with at least one monitoring device operable to receive the monitoring device data. The system further includes a processing rules data store having processing rules corresponding to the one or more identifiable targets and risk factor data that is linked to the occurrence of the event. The central processing server is configured to obtain a processing rule corresponding to the at least one target from the processing rules data store, perform a predictive analysis in which one or more risk factors in the monitoring device data are used to calculate a probability that the event will occur in generating a threat assessment, and generate a notification of the potential threat if the probability that the event will occur is higher than a predetermined threshold.

Claims

1. A system for processing monitoring device data, the system comprising:

a central processing server to communicate with at least one monitoring device operable to receive the monitoring device data corresponding to at least one identifiable target; and

a processing rules data store having processing rules corresponding to one or more identifiable targets and risk factor data that is linked to an occurrence of the an event; and

wherein the central processing server is configured to obtain a processing rule corresponding to the at least one identifiable target from the processing rules data store, perform a predictive analysis in which one or more risk factors in the monitoring device data are used to calculate a probability that the event will occur in generating a threat assessment, and generate a notification to authorized personnel of the potential threat if the probability that the event will occur is higher than a predetermined threshold.

2. The system as recited in claim 1, wherein to perform a predictive analysis in which one or more risk factors in the monitoring device data are used to calculate a probability that the event will occur, includes:

obtaining an additional risk factor associated with the at least one identifiable target from a data store associated with an external source; and

combining the additional risk factor obtained from the external source with the one or more risk factors in the monitoring device data in calculating the probability that the event will occur.

3. The system as recited in claim 1, wherein the monitoring device data is communicatively coupled to a premises server and wherein the central processing server is operable to receive the monitoring device data over a communication link with the premises server.

4. The system as recited in claim 3, wherein the premises server buffers the communication of monitoring device data for a defined period of time prior to the monitoring device data being communicated to the central processing server.

5. The system as recited in claim 1, wherein the central processing server is further configured to obtain a declarative rule defined by an authorized user during the processing of the monitoring device data and use the declarative rule in performing the predictive analysis.

6. The system as recited in claim 5, wherein the central processing server dynamically processes the declarative rules in performing the predictive analysis.

7. The system as recited in claim 1, wherein the processing rules are programmatic rules defined prior to obtaining monitoring device data.

8. The system as recited in claim 1, wherein the result of the predictive analysis corresponds to the generation of an indicator of an action to be initiated.

9. A central processing server for real-time processing of monitoring data to provide a threat assessment, configured to:

receive physical monitoring data that identifies the location of at least one identifiable target;

query and obtain intelligence monitoring data associated with the at least one identifiable target from a data store associated with an external source;

obtain at least one processing rule for processing the physical monitoring device data relative to the intelligence monitoring data; and

generate a threat assessment that quantifies a probability an event will occur, wherein the intelligence monitoring data obtained from the external source identifies risk factors that are used to quantify the probability that the event will occur.

10. The central processing server as recited in claim 9, further configured to generate a notification to authorized personnel of a potential threat if the probability that the event will occur is higher than a predetermined threshold.

11. The central processing server as recited in claim 10, wherein to generate a notification to authorized personnel of the potential threat includes generating an indication of an action to be initiated by an external party.

12. The central processing server as recited in claim 9, further configured to perform facial recognition to identify an identifiable person represented in the physical monitoring data.

13. The central processing server as recited in claim 9, wherein the data store associated with the external source is one from the group consisting of a law enforcement database, governmental database, international database, company databases, and third-party commercial database.

14. The central processing server as recited in claim 9, wherein the central processing server collects physical monitoring data that identifies the location of the at least one identifiable target for a defined period and selects a subset of the physical monitoring data for processing in generating the threat assessment.

15. The central processing server as recited in claim 9, wherein the physical monitoring data is biometric data and the central processing server is further configured to match the received biometric data from a data store to generate the threat assessment.

16. The central processing server as recited in claim 9, wherein to generate a threat assessment includes generating a threat category that provides a warning indicator regarding the probability an event will occur.