Hierarchical organization of data associated with events

• US 8,782,780 B2
• Filed: 09/15/2005
• Issued: 07/15/2014
• Est. Priority Date: 09/28/2004
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated (Kyndryl Holdings, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Friedlander, Robert R., Kraemer, James R.
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): NGUYEN, TRONG H
• Application Number:
  US11/227,393
• Publication Number:
  US 20060070127A1
• Time in Patent Office: 3,225 Days
• Field of Search: 707/769, 707/778, 707/783, 707/829
• US Class Current: 726/22
• CPC Class Codes: G06F 16/2457 with adaptation to user needs
• CPC Class Codes: G06F 16/282 Hierarchical databases, e.g. IMS, LDAP data stores or Lotus Notes
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 50/26 Government or public services business processes related to the transportation industry G06Q50/40
• CPC Class Codes: G16H 10/20 for electronic clinical trials or questionnaires
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16H 70/00 ICT specially adapted for the handling or processing of medical references

Abstract

Methods, data structures, systems and computer program products are provided for organizing security data. A triggering security event is hierarchically related to at least one additional security event based on a possible relationship between the triggering security event and the at least one additional security event in a computer database environment.

Claims

1. A method of organizing security data, comprising:

hierarchically relating a triggering security event at a first level of hierarchy with one or more additional security events at a second level of the hierarchy that is lower than the first level of the hierarchy based on a possible relationship between the triggering security event and the one or more additional security events in a computer database environment maintained in a computer readable storage medium and associated with a data processing system;

receiving, via the data processing system, a request from a user specifying the triggering security event at the computer database environment;

identifying, via the data processing system, a search region based on a location associated with the specified triggering security event and a search time period based on a date and time of the specified triggering security event, wherein the search time period and a size of the search region are customized by the user; and

providing, from the computer database environment, the one or more additional security events possibly associated with the specified triggering security event based on the identified search region and search time period responsive to the request, wherein the providing the one or more additional security events is based on a group of the user and role or title of the user.

2. The method of claim 1, further comprising:

determining a likelihood that the specified triggering security event and the one or more additional security events, present in the computer database environment, are related exceeds a predetermined threshold; and

generating an alert indicating that the predetermined threshold has been exceeded when the predetermined threshold has been exceeded.

3. The method of claim 2, wherein the one or more additional security events comprise multiple security events each occurring at different times within a specified time period and/or a specified location.

4. The method of claim 2, further comprising identifying the triggering security event based on one or more first identified patterns defining security events.

5. The method of claim 4, further comprising fine tuning the one or more first identified patterns and/or adding one or more second identified patterns to the computer database environment based on the triggering security event and/or the one or more additional security events.

6. The method of claim 5, further comprising automatically fine tuning the one or more first identified patterns and/or adding the one or more second identified patterns based on normal patterns, the normal patterns including season of the year, holidays, climatic norms and abnormalities and/or events of national and international significance.

7. The method of claim 4, wherein the one or more first identified patterns are identified based on purchases made, actions taken, data flows and/or money flows.

8. A data processing system for organizing security data comprising:

a computer database environment maintained in a computer readable storage medium and configured to store a triggering security event object at a first level of hierarchy and one or more additional security event objects at a second level of the hierarchy that is lower than the first level of the hierarchy, wherein the one or more additional security event objects are identified based on a possible relationship between the triggering security event object and the one or more additional security event objects; and

a processor circuit configured to hierarchically relate the triggering security event object to the one or more additional security event objects in the computer database environment, receive a request from a user specifying the triggering security event object at the computer database environment, identify a search region based on a location associated with the specified triggering security event object and a search time period based on a date and time of the specified triggering security event object, wherein the search time period and a size of the search region are customized by the user, and provide the one or more additional security event objects possibly associated with the specified triggering security event object based on the identified search region and search time period responsive to the request, wherein the providing the one or more additional security event objects is based on a group of the user and role or title of the user.

9. The system of claim 8, wherein the processor circuit is further configured to determine a likelihood that the specified triggering security event object and the one or more additional security event objects are related exceeds a predetermined threshold and generate an alert indicating that the predetermined threshold has been exceeded when the predetermined threshold has been exceeded.

10. The system of claim 8, wherein the one or more additional security event objects comprise data associated with multiple security events each occurring at different times within a specified time period and/or a specified location.

11. The system of claim 8, wherein the processor circuit is further configured to identify the triggering security event object based on one or more first identified patterns defining security events.

12. The system of claim 11, wherein the processor circuit is further configured to fine tune the one or more first identified patterns and/or add one or more second identified patterns to the database environment based on the triggering security event object and/or the one or more additional security event objects.

13. The system of claim 11, wherein the one or more first identified patterns are identified based on purchases made, actions taken, data flows and/or money flows.

14. The system of claim 8, wherein a possible relationship between the triggering security event object and the one or more additional security event objects comprises a relationship between people associated with the triggering security event object and the one or more additional security event objects.