Method and system for implementing multi-level data fusion

• US 9,038,177 B1
• Filed: 07/27/2011
• Issued: 05/19/2015
• Est. Priority Date: 11/30/2010
• Status: Active Grant

• Current Assignee: Hunton & Williams LLP (Hunton Andrews Kurth LLP), JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Tierney, Sean M.
• Primary Examiner(s): Henning, Matthew
• Application Number:
  US13/191,924
• Time in Patent Office: 1,392 Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

An embodiment of the present invention involves a computer implemented method and system for implementing data fusion comprising aggregating data from a plurality of sources via one or more computer networks, wherein the data comprises at least unstructured data; extracting one or more features from the aggregated data; enriching the extracted data by compiling the data into one or more categories; generating one or more datasets based on the enriched data for identifying potentially fraudulent activity; and identifying one or more proposed actions to address the potentially fraudulent activity using a graphical interface.

Claims

1. A computer implemented method for implementing data fusion, the method comprising the steps of:

aggregating data from a plurality of sources via one or more computer networks, wherein the data comprises at least unstructured data wherein the unstructured data comprises video, images and voice data;

extracting one or more features from the aggregated data;

enriching the extracted data by compiling the data into one or more categories to identify one or more variances in volume, acceleration, deceleration and velocity of activity;

wherein the step of enriching the extracted data further comprises the step of aggregating the enriched extracted data by similar features and generating an actionable report in response;

generating one or more datasets based on the enriched data for identifying potentially fraudulent activity; and

automatically identifying one or more proposed actions, based at least in part on the actionable report, to address the potentially fraudulent activity using a graphical interface;

wherein the one or more proposed actions are identified from a group comprising at least an autonomic response, investigation and incident of interest.

2. The method of claim 1, wherein the plurality of sources comprises a combination of external sources including one or more of the following:

external network telemetry, malware data, external mail lists, blogs, news and RSS feeds.

3. The method of claim 1, wherein the plurality of sources comprises a combination of internal sources including one or more of the following:

network telemetry, vulnerability assessment, asset inventory, video and move-money data.

4. The method of claim 1, wherein the one or more features comprises one or more of information source, network, device, vulnerability, threats, exposure, actors, victims and targets.

5. The method of claim 1, wherein the one or more categories comprises threat data, attack data, network data, vulnerability data, asset data, victim data and targeting detail.

6. The method of claim 1, wherein the step of enriching further comprises identifying a burst activity.

7. The method of claim 1, wherein the step of enriching further comprises identifying a dip activity.

8. The method of claim 1, wherein the one or more proposed actions is displayed as a graphical representation.

9. The method of claim 1, wherein the one or more proposed actions comprises initiating an investigation.

10. A computer implemented system for implementing data fusion, the system comprising:

a processor; and

a memory comprising computer-readable instructions which when executed by the processor cause the processor to perform the steps comprising;

aggregating data from a plurality of sources via one or more computer networks, wherein the data comprises at least unstructured data wherein the unstructured data comprises video, images and voice data;

extracting one or more features from the aggregated data;

enriching the extracted data by compiling the data into one or more categories to identify one or more variances in volume, acceleration, deceleration and velocity of activity;

wherein the step of enriching the extracted data further comprises the step of aggregating the enriched extracted data by similar features and generating an actionable report in response;

generating one or more datasets based on the enriched data for identifying potentially fraudulent activity; and

automatically identifying one or more proposed actions, based at least in part on the actionable report, to address the potentially fraudulent activity using a graphical interface;

wherein the one or more proposed actions are identified from a group comprising at least an autonomic response, investigation and incident of interest.

11. The system of claim 10, wherein the plurality of sources comprises a combination of external sources including one or more of the following:

external network telemetry, malware data, external mail lists, blogs, news and RSS feeds.

12. The system of claim 10, wherein the plurality of sources comprises a combination of internal sources including one or more of the following:

network telemetry, vulnerability assessment, asset inventory, video and move-money data.

13. The system of claim 10, wherein the one or more features comprises one or more of information source, network, device, vulnerability, threats, exposure, actors, victims and targets.

14. The system of claim 10, wherein the one or more categories comprises threat data, attack data, network data, vulnerability data, asset data, victim data and targeting detail.

15. The system of claim 10, wherein the data enrichment module identifies a burst activity.

16. The system of claim 10, wherein the data enrichment module identifies a dip activity.

17. The system of claim 10, wherein the one or more proposed actions is displayed as a graphical representation.

18. The system of claim 10, wherein the one or more proposed actions comprises initiating an investigation.