Determining the degree of relevance of duplicate alerts in an entity resolution system

• US 8,250,637 B2
• Filed: 04/29/2008
• Issued: 08/21/2012
• Est. Priority Date: 04/29/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Allen, Thomas B., Caceres, Barry M.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): CHANG, KENNETH W
• Application Number:
  US12/111,626
• Publication Number:
  US 20090271862A1
• Time in Patent Office: 1,575 Days
• Field of Search: 726/6
• US Class Current: 726/6
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

An entity resolution system and alert analysis system configured to process inbound identity records and to generate alerts based on relevant identities, entities, conditions, activities, or events is disclosed. One process of resolving identity records and detecting relationships between entities may be performed using a pre-determined or configurable entity resolution rules. Further, the entity resolution system may include an alert analysis system configured to allow analysts to review and analyze alerts, entities, and identities, as well as provide comments or assign a disposition to alerts generated by the entity resolution system. Furthermore, the entity resolution system may be configured to handle duplicate alerts, i.e., one or more identical or near-identical alerts generated using the same entities and/or identities as well as assign a relevance score to the particular entities and identities included in the alert.

Claims

1. A computer-implemented method for processing identity records received by an entity resolution system:

receiving a first identity record;

associating the first identity record with a first entity by one of resolving the first identity record to an existing entity in the entity resolution system and creating a new entity in the entity resolution system;

evaluating at least the first entity against one or more conditions specified in a relevance detection rule;

upon determining that the one or more conditions specified by the relevance detection rule are satisfied;

generating a first alert, and

assigning an original alert relevance score to the first alert, determined, at least in part, on a rule relevance score associated with the relevance detection rule; and

upon determining that the first alert is a duplicate of a second, previously generated, alert, wherein the second alert was generated based on at least a second identity record associated with the first entity;

retrieving at least an alert relevance score associated with the second alert, and

assigning a current alert relevance score to the first alert, determined, at least in part, on the alert relevance score associated with the second alert and the original alert relevance score assigned to the first alert;

wherein each of the alert relevance scores provides a quantitative measure of relevance for an occurrence of an event that satisfies the one or more conditions of the relevance detection rule.

2. The method of claim 1, wherein the alert relevance score associated with the second alert is an original alert relevance score assigned to the second alert.

3. The method of claim 1, wherein the alert relevance score associated with the second alert is a current alert relevance score assigned to the second alert.

4. The method of claim 1, wherein the alert relevance score provides a quantitative measure regarding a perceived degree of relevance of the alert.

5. The method of claim 1, wherein the current alert relevance score assigned to the first alert is determined as a weighted average of the original alert relevance score and the alert relevance score associated with the second alert.

6. The method of claim 1, wherein determining that the first alert is a duplicate of the second alert, comprises determining that the second alert was generated using the relevance detection rule for a second identity record associated with the first entity.

7. The method of claim 1, wherein determining that the first alert is a duplicate of the second alert, comprises determining that the second alert was generated using the relevance detection rule and same identities referenced by the first entity.

8. A non-transitory computer-readable storage medium containing a program, which, when executed by a processor performs an operation for processing identity records received by an entity resolution system, the operation comprising:

receiving a first identity record;

associating the first identity record with a first entity by one of resolving the first identity record to an existing entity in the entity resolution system and creating a new entity in the entity resolution system;

evaluating at least the first entity against one or more conditions specified in a relevance detection rule;

upon determining that the one or more conditions specified by the relevance detection rule are satisfied;

generating a first alert, and

assigning an original alert relevance score to the first alert, determined, at least in part, on a rule relevance score associated with the relevance detection rule; and

upon determining that the first alert is a duplicate of a second, previously generated, alert, wherein the second alert was generated based on at least a second identity record associated with the first entity;

retrieving at least an alert relevance score associated with the second alert, and

assigning a current alert relevance score to the first alert, determined, at least in part, on the alert relevance score associated with the second alert and the original alert relevance score assigned to the first alert;

wherein each of the alert relevance scores provides a quantitative measure of relevance for an occurrence of an event that satisfies the one or more conditions of the relevance detection rule.

9. The non-transitory computer-readable storage medium of claim 8, wherein the alert relevance score associated with the second alert is an original alert relevance score assigned to the second alert.

10. The non-transitory computer-readable storage medium of claim 8, wherein the alert relevance score associated with the second alert is a current alert relevance score assigned to the second alert.

11. The non-transitory computer-readable storage medium of claim 8, wherein the alert relevance score provides a quantitative measure regarding a perceived degree of relevance of the alert.

12. The non-transitory computer-readable storage medium of claim 8, wherein the current alert relevance score assigned to the first alert is determined as a weighted average of the original alert relevance score and the alert relevance score associated with the second alert.

13. The non-transitory computer-readable storage medium of claim 8, wherein determining that the first alert is a duplicate of the second alert, comprises determining that the second alert was generated using the relevance detection rule for a second identity record associated with the first entity.

14. The non-transitory computer-readable storage medium of claim 8, wherein determining that the first alert is a duplicate of the second alert, comprises determining that the second alert was generated using the relevance detection rule and same identities referenced by the first entity.

15. A system, comprising:

a processor; and

a memory containing a program, which, when executed by the processor is configured to process identity records received by an entity resolution system by performing a method comprising;

receiving a first identity record;

associating the first identity record with a first entity by one of resolving the first identity record to an existing entity in the entity resolution system and creating a new entity in the entity resolution system;

evaluating at least the first entity against one or more conditions specified in a relevance detection rule;

upon determining that the one or more conditions specified by the relevance detection rule are satisfied;

generating a first alert, and

assigning an original alert relevance score to the first alert, determined, at least in part, on a rule relevance score associated with the relevance detection rule; and

upon determining that the first alert is a duplicate of a second, previously generated, alert;

retrieving at least an alert relevance score associated with the second alert, wherein the second alert was generated based on at least a second identity record associated with the first entity, and

assigning a current alert relevance score to the first alert, determined, at least in part, on the alert relevance score associated with the second alert and the original alert relevance score assigned to the first alert;

wherein each of the alert relevance scores provides a quantitative measure of relevance for an occurrence of an event that satisfies the one or more conditions of the relevance detection rule.

16. The system of claim 15, wherein the alert relevance score associated with the second alert is an original alert relevance score assigned to the second alert.

17. The system of claim 15, wherein the alert relevance score associated with the second alert is a current alert relevance score assigned to the second alert.

18. The system of claim 15, wherein the alert relevance score provides a quantitative measure regarding a perceived degree of relevance of the alert.

19. The system of claim 15, wherein the current alert relevance score assigned to the first alert is determined as a weighted average of the original alert relevance score and the alert relevance score associated with the second alert.

20. The system of claim 15, wherein determining that the first alert is a duplicate of the second alert, comprises determining that the second alert was generated using the relevance detection rule for a second identity record associated with the first entity.

21. The system of claim 15, wherein determining that the first alert is a duplicate of the second alert, comprises determining that the second alert was generated using the relevance detection rule and same identities referenced by the first entity.