Method and system for processing intelligence information

• US 8,423,374 B2
• Filed: 10/21/2002
• Issued: 04/16/2013
• Est. Priority Date: 06/27/2002
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Siebel Systems Inc. (Oracle Corporation)
• Inventors: Bishop, Frank Warren Jr., Nash, Christopher Scott, Viswanathan, Rahul, Abichandani, Arun, Yelkur, Rajani, Chan, Jackson, Pinkerton, Robert Brent, Malden, Matthew Scott, Wong, Hang Yee, Israel, Daniel Edward, Patel, Prashant B.
• Primary Examiner(s): OUELLETTE, JONATHAN P
• Application Number:
  US10/277,549
• Publication Number:
  US 20070198275A1
• Time in Patent Office: 3,830 Days
• Field of Search: 705/1
• US Class Current: 705/1.1
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A method and system for routing intelligence information related to security. The security system provides rules that identify conditions and routing instructions that are to be applied to intelligence information. A security organization may create and modify rules to ensure the appropriate routing of intelligence information in a timely manner. The security system may receive intelligence information from various sources. Regardless of the form or source of intelligence information, the security system analyzes the intelligence information to determine whether any conditions of the rules are satisfied. When a condition of a rule is satisfied, the security system sends a notification of the intelligence information in accordance with the routing instructions for that rule. In this way, intelligence information can be automatically and quickly routed to the appropriate security personnel for further processing.

Claims

1. A method in a computer system for identifying duplicate records relating to a suspect in an investigation, the method comprising:

generating a de-duplication key for each record derived from content of various fields of the record;

determining whether any de-duplication key for a record matches a de-duplication key for another record; and

when it is determined that de-duplication keys match, indicating that the records with the matching keys may be duplicates, wherein

de-duplication keys match when a metric indicates that the de-duplication keys are close enough that they may represent duplicate records, and

the metric calculates a distance between the de-duplication keys.

2. The method of claim 1 wherein de-duplication keys match when they are the same.

3. The method of claim 1 wherein the de-duplication keys include information derived from names of suspects.

4. The method of claim 1 wherein the de-duplication keys include information derived from physical characteristics of suspects.

5. The method of claim 1 wherein the de-duplication keys include information derived from addresses of suspects.

6. The method of claim 1 wherein the de-duplication keys include information derived from aliases of suspects.

7. A method for identifying records that relate to the same entity, the method comprising:

generating a key for a record of a security system and a key for a record of another security system, wherein

the keys are derived from name and alias content of the records;

comparing the generated key of the record of the security system to the generated key of the record of the other security system; and

when the comparison indicates that the compared keys may represent the same entity,

presenting an indication to a user that the record of the security system and the record of the other security system may represent the same entity, and

receiving from the user an indication as to whether the records represent the same entity, wherein

the keys are de-duplication keys, and

the comparing includes applying a metric to the generated de-duplication keys.

8. The method of claim 7 wherein the entity is an individual.

9. The method of claim 7 wherein the entity is a group of individuals.

10. The method of claim 7 wherein the de-duplication keys are derived from characteristics of the entity.

11. The method of claim 7 wherein the names of the records represent different spellings of the same name.

12. The method of claim 7, further comprising:

receiving alias information for an entity.

13. A computer-readable medium containing instructions for identifying records of a security system that relate to the same suspect, by a method comprising:

generating a de-duplication key for a record of the security system and a de-duplication key for another record of the security system, wherein

the de-duplication keys are derived from alias information of the records;

comparing the generated de-duplication key of the record to the generated de-duplication key of the other record; and

when the comparison indicates that the records may represent the same suspect, presenting an indication to a user that the records may represent the same suspect,

receiving from the user an indication as to whether the records represent the same suspect, and

when the user indicates that the records represent the same suspect, combining the records, wherein

the comparing includes applying a metric to the generated de-duplication keys.

14. The computer-readable medium of claim 13 wherein the suspect is an individual.

15. The computer-readable medium of claim 13 wherein the suspect is a group of individuals.

16. The computer-readable medium of claim 13 wherein the de-duplication keys are derived from characteristics of the suspect.

17. The computer-readable medium of claim 13 wherein the names of the records represent different spellings of the same name.

18. The computer-readable medium of claim 13, further comprising:

receiving alias information for a suspect.