System and method for performing a predictive threat assessment based on risk factors

• US 7,480,715 B1
• Filed: 01/24/2003
• Issued: 01/20/2009
• Est. Priority Date: 01/25/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Vig Acquisitions Ltd LLC (Intellectual Ventures LLC)
• Inventors: Barker, Geoffrey T., Alexander, Bruce
• Primary Examiner(s): Flynn; Nathan J.
• Assistant Examiner(s): WASEL, MOHAMED A
• Application Number:
  US10/351,979
• Time in Patent Office: 2,188 Days
• Field of Search: 709223-224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system and method for evaluating data in a monitoring network are provided. A processing server obtains monitoring device data from a number of monitoring devices. The processing server processes and stores the monitoring device data according to one or more unique identifiers. Utilizing decision logic, the processing server evaluates the monitoring device data to generate one or more predictive assessments. Each predictive assessment can result in the initiation of actions or notification of authorized personnel based upon the likelihood of a target event occurring.

Claims

1. A system for processing monitoring device data, the system comprising:

at least one monitoring device configured to obtain monitoring device data corresponding to at least one identifiable target;

a first processing server configured to obtain the monitoring device data and process the monitoring device data according to at least one processing rule that establishes a relationship between risk factors used in making a threat assessment that quantifies the probability an event will occur;

a processing rules data store having processing rules corresponding to one or more targets in a monitored premises and risk factor data that is linked to occurrences of the event; and

wherein the first processing server is configured to utilize processing rules from the processing rules data store to perform a predictive analysis on the monitoring device data in which one or more risk factors represented in the monitoring device data are used to calculate a probability that the event will occur in generating the threat assessment and to generate a notification to authorized personnel of the potential threat if the probability that the event will occur is higher than a predetermined threshold.

2. The system as recited in claim 1, wherein the processing rules are programmatic rules defined prior to obtaining monitoring device data.

3. The system as recited in claim 1, wherein the processing rules are declarative rules that are received at the processing server from an authorized user during the processing of the monitoring device data.

4. The system as recited in claim 3, wherein the first processing server dynamically processes the declarative rules with the processing of the monitoring device data.

5. The system as recited in claim 1, wherein the monitoring device data corresponds to a set of identifiable targets and wherein the first processing server is further configured to process the monitoring device data for at least a subset of the set of identifiable targets.

6. The system as recited in claim 1, wherein the first processing server is further configured to perform a non-predictive analysis of the monitoring device data and generate a result from the non-predictive analysis.

7. The system as recited in claim 1, wherein the predictive analysis corresponds to a processing of two or more processing rules.

8. The system as recited in claim 1, wherein the first processing server generates a set of monitoring device data corresponding to a collection of monitoring device data for a defined period of time prior to performing the predictive data analysis.

9. The system as recited in claim 8, wherein the first processing server pre-processes the set of monitoring device data.

10. The system as recited in claim 9, wherein pre-processing the monitoring device data includes selecting a subset of monitoring device data for processing.

11. The system as recited in claim 1, wherein the first processing server is further configured to obtain monitoring device data from a remote computing device and not directly from the monitoring devices.

12. The system as recited in claim 11, wherein the monitoring device data is collected for a predetermined period of time before the predictive data analysis is performed.

13. The system as recited in claim 12, wherein the first processing server pre-processes the set of monitoring device data.

14. The system as recited in claim 13, wherein pre-processing the monitoring device data includes selecting a subset of monitoring device data for processing.

15. The system as recited in claim 1, wherein the first processing server is configured to send the monitoring device data over a network and receive a result of the predictive analysis according to a processing rule.

16. The system as recited in claim 15, further comprising a second processing rules data store corresponding to the second processing server and operable to provide processing rules to the second processing server.

17. The system as recited in claim 15, wherein the second processing server is operable to perform a predictive data analysis of the result of the predictive analysis from the first processing server.

18. The system as recited in claim 15, wherein the second processing server is operable to obtain a set of processing results from the first processing server and process the entire set of processing results.

19. The system as recite in claim 15, further comprising a third processing server operable to obtain the result from the second processing server and process the result according to a processing rule.

20. The system as recited in claim 1, wherein the result of the predictive analysis corresponds to the generation of an indicator of a threat condition.

21. The system as recited in claim 1, wherein the result of the predictive analysis corresponds to the generation of an indicator of an action to be initiated.

22. The system as recited in claim 1, wherein the result of the predictive analysis corresponds to the initiation of an output device by the first processing server.

23. The system as recited in claim 1, wherein the first processing server obtains one or more declarative rules from an authorized user and modifies the predictive processing according to the declarative rules.

24. The system of claim 1, wherein the monitoring device data corresponds to commercial sales data.

25. The system of claim 24, wherein the predictive analysis corresponds to a prediction of consumer fraud.

26. The system of claim 24, wherein the predictive analysis corresponds to a prediction of consumer spending.

27. The system of claim 1, wherein the monitoring device data corresponds to data associated with a military object and wherein the predictive analysis corresponds to a threat to the military object.

28. A method for processing device data, comprising:

obtaining monitoring device data from at least one monitoring device corresponding to at least one identifiable target;

obtaining at least one processing rule corresponding to the identifiable target from a processing rules data store that establishes a relationship between risk factors used in making a threat assessment that quantifies the probability an event will occur;

processing the monitoring device data according to the at least one processing rule, wherein processing the monitoring device data includes calculating a probability that an event will occur in generating the threat assessment wherein risk factors identified in the monitoring device data that are linked to the occurrence of the event are used in calculating the probability that the event will occur; and

generating an output corresponding to the processing of the monitoring device data prior to occurrence of the event wherein generating the output includes notifying authorized personnel if the probability that the event will occur is higher than a predetermined threshold.

29. The method as recited in claim 28, wherein the processing rules are programmatic rules defined prior to obtaining monitoring device data.

30. The method as recited in claim 28, wherein the processing rules are declarative rules defined during the processing of the monitoring device data.

31. The method as recited in claim 30, wherein the declarative rules are dynamically processed with the processing of the monitoring device data.

32. The method as recited in claim 28, wherein the monitoring device data corresponds to a set of identifiable targets and wherein the processing the monitoring device data includes processing the monitoring device data for a subset of the set of identifiable targets.

33. The method as recited in claim 28, wherein processing the monitoring device data includes performing a non-predictive analysis of the monitoring device data.

34. The method as recited in claim 28, wherein processing the monitoring device data includes processing the monitoring device data according to two or more processing rules.

35. The method as recited in claim 28, further comprising pre-processing the monitoring device data.

36. The method as recited in claim 35, wherein pre-processing the monitoring device data includes collecting monitoring device data for a period of time and selecting a subset of the collected monitoring device data for processing.

37. The method as recited in claim 36, wherein selecting a subset of the collected monitoring device data includes filtering the monitoring device data.

38. The method as recited in claim 28, wherein generating an output corresponding to the processing of the monitoring device data includes transmitting a result of the processing over a network to a remote device.

39. The method as recited in claim 28, wherein generating an output corresponding to the processing of the monitoring device data includes generating an indication of a threat condition.

40. The method as recited in claim 28, wherein generating an output corresponding to the processing of the monitoring device data includes generating an indication of an action to be initiated by an external party.

41. The method as recited in claim 28, wherein generating an output corresponding to the processing of the monitoring device data includes initiating an output device to perform an action corresponding to a processing rule.

42. The method as recited in claim 28, further comprising obtaining a set of declarative processing rules from an authorized user, wherein processing the monitoring device data includes processing the monitoring device data according to the declarative processing rules.

43. The method as recited in claim 28, further comprising a computer-readable medium.

44. The method as recited in claim 28, wherein the monitoring device data corresponds to commercial sales data.

45. The method as recited in claim 44, wherein processing the monitoring device data according to at least one processing rule includes processing the data to obtain a prediction of consumer fraud.

46. The method as recited in claim 44, wherein processing the monitoring device data according to at least one processing rule includes generating a prediction of consumer spending.

47. The method as recited in claim 28, wherein the monitoring device data corresponds to data associated with the military object and when processing monitoring device data according to at least one processing rule includes a generated predictive analysis corresponding to a threat to the military object.

48. The method as recited in claim 28, further comprising a computer system having a processor, a memory, and an operating environment.

49. A system for processing monitoring device data, the system comprising:

at least one information collection computing device configured to obtain monitoring device data from a number of monitoring devices, the monitoring device data corresponding to at least one identifiable target;

a central processing server in communication with the at least one information collection computing device and operable to receive the monitoring device data corresponding to at least one identifiable target; and

a processing rules data store having processing rules corresponding to one or more identifiable targets and risk factor data that is linked to the occurrence of the event;

wherein the central processing server is configured to obtain a processing rule corresponding to the at least one target, perform a predictive analysis in which one or more risk factors in the monitoring device data are used to calculate a probability that the event will occur in generating a threat assessment, and generate a notification to authorized personnel of the potential threat if the probability that the event will occur is higher than a predetermined threshold.

50. The system as recited in claim 49, wherein the processing rules are programmatic rules defined prior to obtaining monitoring device data.

51. The system as recited in claim 49, wherein the processing rules are declarative rules defined by an authorized user during the processing of the monitoring device data.

52. The system as recited in claim 51, wherein the central processing server dynamically processes the declarative rules with the processing of the monitoring device data.

53. The system as recited in claim 49, wherein the monitoring device data corresponds to a set of identifiable targets and wherein the central processing server processes the monitoring device data for at least a subset of the set of identifiable targets.

54. The system as recited in claim 49, wherein the central processing server further performs a non-predictive analysis of the monitoring device data and generates a result from the non-predictive analysis.

55. The system as recited in claim 49, wherein the predictive analysis corresponds to a processing of two or more processing rules.

56. The system as recited in claim 49, wherein the information collection information devices generates a set of monitoring device data corresponding to a collection of monitoring device data for a defined period of time prior to transmitting the set of monitoring device data to the central processing server.

57. The system as recited in claim 56, wherein the information collection server pre-processes the set of monitoring device data.

58. The system as recited in claim 57, wherein pre-processing the monitoring device data includes selecting a subset of monitoring device data for processing.

59. The system as recited in claim 49, wherein the central processing server pre-processes the monitoring device data prior to processing the monitoring device data according to a processing rule.

60. The system as recited in claim 59, wherein pre-processing the monitoring device data includes selecting a subset of monitoring device data for processing.

61. The system as recited in claim 49, further comprising a second processing server operable to obtain the result of the predictive analysis from the central processing server and process the result according to a processing rule.

62. The system as recited in claim 61, further comprising a second processing rules data store corresponding to the second processing server and operable to provide processing rules to the second processing server.

63. The system as recited in claim 61, wherein the second processing server is operable to perform a predictive data analysis of the result of the predictive analysis from the central processing server.

64. The system as recited in claim 61, wherein the second processing server is operable to obtain a set of processing results from the central processing server and process the entire set of processing results.

65. The system as recite in claim 61, further comprising a third processing server operable to obtain the result from the second processing server and process the result according to a processing rule.

66. The system as recited in claim 49, wherein the result of the predictive analysis corresponds to the generation of an indicator of a threat condition.

67. The system as recited in claim 49, wherein the result of the predictive analysis corresponds to the generation of an indicator of an action to be initiated.

68. The system as recited in claim 49, wherein the result of the predictive analysis corresponds to the initiation of an output device by the first processing system.

69. The system as recited in claim 49, wherein the first processing system obtains one or more declarative rules from an authorized user and modifies the predictive processing according to the declarative rules.

70. The system of claim 49, wherein the monitoring device data corresponds to commercial sales data.

71. The system of claim 70, wherein the predictive analysis corresponds to a prediction of consumer fraud.

72. The system of claim 70, wherein the predictive analysis corresponds to a prediction of consumer spending.

73. The system of claim 49, wherein the monitoring device data corresponds to data associated with a military object and wherein the predictive analysis corresponds to a threat to the military object.