Patent ID: 7941851
Filing Date: 2011-05-10
Classification: G06F,H04L

Abstract:
1. A computer architecture system that enables monitoring of accumulated time-oriented data from a computer network and the use of Knowledge-Based Temporal Abstraction (KBTA) to derive temporal abstractions (TA) from the data accumulated from modules of said computer architecture system and knowledge provided by human experts related to the operation of elements of said computer network in order to identify electronic threat patterns and create alerts for both known and unknown eThreats; said computer architecture system comprising at least one of each of the following modules: a. a Knowledge Acquisition Module (KAM), which is a client application configured for maintaining and exploring the KBTA security ontology and for defining monitored patterns; b. a Knowledge Base (KB) Module, configured to hold the security ontology repository in which all concepts and the relations between them and all of the monitored patterns are defined; c. a Knowledge Base Access Module (KBAM), configured to be the only access point to the KB from which the KB can be updated and read; d. a Temporal Abstraction Module (TAM), which comprises the computational mechanisms that are configured to integrate the raw security data records with said knowledge provided by human experts and to compute said temporal abstractions; e. a Data, Abstractions and Raised Alerts Storage Module configured to store all raw data records, derived temporal abstractions, and raised alerts; f. a Persistence Services Module, configured to keep all computed abstractions and temporal patterns persistent until updated or removed by applying the abstraction process on newly arrived security data; g. a Query Module, configured to use the data and abstractions stored in said Data, Abstractions and Raised Alerts Storage Module to answer queries; h. a Continuous Monitoring Engine (CME) Module, configured to monitor the output from the computational mechanisms of the Temporal Abstraction Module (TAM) and to produce an alert when an eThreat pattern is detected; i. a Temporal Abstraction Controller (TAC) Module, configured to handle queries requests and to synchronize the integration of data and knowledge; j. a Visual Exploration Module (VEM), which is a graphical user application configured to allow exploration of both raw and abstracted data; k. an Alert Invocation Module (AIM), which is a graphical user application configured to activate and to de-activate alerts; and l. a Visual Monitoring Module (VMM), which is a graphical user interface configured to provide notification of alerts; wherein, predetermined communication links are provided to interconnect said modules allowing them to share information and work together to identify electronic threat patterns and create alerts for both known and unknown eThreats.