Source: https://patents.google.com/patent/US20070222589A1/en
Timestamp: 2020-01-24 22:39:00
Document Index: 12888579

Matched Legal Cases: ['art 525', 'art 525', 'art 530', 'art 525', 'art 525', 'art 535', 'art 530', 'art 535', 'arts 560', 'art 560', 'art 560', 'art 560', 'art 560']

US20070222589A1 - Identifying security threats - Google Patents
Identifying security threats Download PDF
US20070222589A1
US20070222589A1 US10/185,871 US18587102A US2007222589A1 US 20070222589 A1 US20070222589 A1 US 20070222589A1 US 18587102 A US18587102 A US 18587102A US 2007222589 A1 US2007222589 A1 US 2007222589A1
US10/185,871
Anthony Butitta
2002-06-27 Priority to US10/185,871 priority Critical patent/US20070222589A1/en
2002-10-02 Assigned to SIEBEL SYSTEMS, INC. reassignment SIEBEL SYSTEMS, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: ABBO, EDWARD, GORMAN, RICHARD, BUTITTA, ANTHONY JAMES
2007-09-27 Publication of US20070222589A1 publication Critical patent/US20070222589A1/en
238000004458 analytical methods Methods 0 abstract claims description 61
230000000694 effects Effects 0 claims description 79
A method, system, and computer-readable medium is described for analyzing information to assist security personnel in identifying security threats. In some situations, various threat trend analyses are used to identify trends in various security-related information, and trend analysis information may then be presented to appropriate users (e.g., via displayed graphical charts). In a similar manner, in some situations various types of threat alerts are used to notify appropriate personnel when current conditions trigger the alert, such as in a real-time manner. In some situations, the trend analyses and alerts are selected for a user based on a current role of the user, and in some situations the information about a possible security threat is provided to various security personnel that are determined to be appropriate for the information, such as security personnel in affected geographical locations or that have capabilities related to preventing or addressing such threats.
This application is related to U.S. patent application Ser. No.______ (Attorney Docket # 38481.8027), filed concurrently and entitled “Method and System for Processing Intelligence Information”, and to U.S. patent application Ser. No.______ (Attorney Docket # 38481.8029), filed concurrently and entitled “Disseminating Information About Security Threats”, both of which are hereby incorporated by reference in their entirety.
The following disclosure relates generally to analyzing information related to security threats, and more particularly to identifying possible security threats in order to enable notification of appropriate personnel, such as to alert appropriate personnel so that they can prevent identified terrorism threats.
As the security of governments, organizations (e.g., businesses) and individuals is increasingly threatened by various groups and individuals (e.g., terrorist groups and their members), it is increasingly important to identify future security threats (e.g., planned attacks) before they occur so that they can be prevented. In many cases, security personnel (e.g., law enforcement officials) whose job it is to prevent or address such security threats do not have access to the necessary information to identify the security threats before they occur (e.g., information about attack preparation activities of terrorist groups). In other situations, security personnel may have access to the necessary information, but that information may be obscured in an over-abundance of other irrelevant information of various types and/or it may be in an unanalyzed form from which it is difficult to identify the security threats.
Accordingly, it would be beneficial to provide techniques to analyze various types of information related to possible security threats in an automated manner, such as to assist security personnel in identifying future security threats.
FIGS. 5A-5H illustrate examples of analyzing security-related information to identify possible security threats.
FIG. 6 is a block diagram illustrating an embodiment of a computing system suitable for performing the described techniques.
FIG. 7 is a flow diagram of an embodiment of the Threat Trend Analyzer routine.
FIG. 8 is a flow diagram of an embodiment of the Threat Alert Generator routine.
A software facility is described below that provides various techniques for analyzing information to assist security personnel in identifying security threats. Various types of information analyses can be performed in various embodiments, and in some embodiments the information analyses vary by user (e.g., based on a current role of the user). Similarly, the types of information that are analyzed can vary in various embodiments, such as information about recent activities of individuals or groups that are suspected of being involved in previous and/or future security threats, or information about diseases or other health risks (e.g., chemical or biological) that may be naturally spread or otherwise disseminated.
In particular, in some embodiments various types of threat trend analyses can be used to identify trends in one or more types of security-related information. A threat trend analysis may use one or more measurement criteria to calculate threat values for a type of security-related information over a period of time, such as for each of multiple time units within that period of time (e.g., each week in a month, or each day in a year). Trends over that period of time in the calculated threat values can then be identified using various automated and/or manual techniques. Information about the threat values and the corresponding trends may be presented to users that have requested the information or are otherwise associated with the information in various ways, such as via graphical charts presented on a computing device. Such information can also be provided to other appropriate users, such as security personnel (e.g., law enforcement, military, intelligence gathering, health, government, business, etc.) in affected geographical locations or that have capabilities related to preventing or addressing threats.
For example, a significantly increasing trend in activities of a particular terrorist group in a particular geographic location may indicate that an attack by that group will soon occur in the geographic location. The threat values that are calculated for such terrorist group activities may use a variety of types of measurement criteria, such as based on a total number of activities, by weighting some activities more highly than others, by correlating different types of activities that may be related in various ways (e.g., in time, in geographical location, by the individuals involved, etc.), etc. Similarly, increasing trends in the number of reported cases of a communicable disease that simultaneously occur in multiple disparate geographic locations may indicate an intentional dissemination of that disease.
In addition, in some embodiments various types of threat alerts can be used to notify appropriate personnel when current conditions trigger the alert. A threat alert may be triggered by the satisfaction of a variety of types of alert criteria, such as a threshold for a particular type of security-related information, a specified combination of multiple types of security-related information, etc. In some embodiments, a threat alert may be associated with a threat trend analysis in such a manner that one or more calculated threat values or corresponding trend information for that threat trend analysis may trigger the alert. Information about a triggered threat alert may be provided to one or more users in various ways, such as in a real-time or near-instantaneous manner (e.g., via a pop-up message on a computing device, an instant message, a phone call or SMS message, an email, via a paging device, etc.). Appropriate security personnel to receive such information can be selected in a manner similar to that for threat trend analysis information.
In one embodiment, a computing system with which the facility is integrated can be logically structured as a multi-layered architecture as shown in FIG. 1.
In particular, the logical multi-layered architecture as shown in FIG. 1 provides a platform for common services to support various applications. These services may include a user interface layer 110, an object manager layer 120, a data manager layer 130, and a data exchange layer 140.
For illustrative purposes, some embodiments of the software facility are described below in which specific types of security-related information is analyzed in specific types of ways, and in which the results of the analyses are provided to various specific types of users in various specific ways. However, those skilled in the art will appreciate that the techniques of the invention can be used in a wide variety of other situations, and that the invention is not limited to use with the illustrated types of analysis and notification techniques or with the illustrated types of security-related information or users.
FIGS. 5A-5H illustrate examples of using automated techniques to analyze security-related information and identify possible security threats. In particular, in the illustrated embodiment a current user of a computing device is serving in a role as a member of a counter-terrorism governmental organization, and the facility assists the user in identifying possible future terrorist threats relevant to that role.
FIG. 5A illustrates an example displayed window 500 that includes a user interface 505 with a variety of information relevant to the counter-terrorism user.
In the illustrated embodiment, the information is presented as one or more Web pages, such as with a Web browser executing on the user's computing device.
The user interface includes a variety of displayed informational tabs 510, with the “Home” tab 510 a currently selected. As is shown, various information 515 that is personalized to the user may be displayed, and a variety of security-related information related to the current role of the user is also displayed in the current embodiment (e.g., information relating to individual terrorism suspects, terrorism groups, and terrorism cases with which the user is associated). Other users may instead receive other information via a similar user interface (e.g., another counter-terrorism user might receive information about other suspects, groups and terrorism cases, while a health professional might receive information about diseases, symptoms, and medical cases).
Another of the displayed informational tabs is the “Analytics” tab 510 b, and FIG. 5B illustrates an example user interface that may be displayed to the user after the Analytics tab is selected. In particular, a variety of sub-tabs 520 are displayed, with a “Monthly Activities” sub-tab 520 a currently selected. A variety of types of analyses of threat-related information that are related to the selected sub-tab are also displayed in the illustrated embodiment, such as based on predefined analysis definitions and/or on interactive user requests. As is shown, in the illustrated embodiment the display includes a chart 525 a that shows the most active terrorist cells (e.g., for the most recent month) and a chart 525 c that shows the most active terrorist regional cells. The charts have interactive controls 525 b and 525 d respectively to allow the user to control the analysis being performed in various ways, such as by modifying the time period for which the analysis is performed. Additional security-related information may also be available and/or displayed, such as by default or based on user selection, and in the illustrated embodiment a portion of a table 525 e showing details about one or more types of activities is provided.
In the illustrated embodiment, the user can also interactively drill-down on illustrated information in order to refine the analyses being performed in various ways. For example, FIG. 5C illustrates a chart 530 that shows information specific to a particular terrorist group (in this example, Al Qaeda), and shows the most active regional cells for that group. Such an analysis may be selected by the user in various ways, such as by selecting the information representing that terrorist group in the chart 525 a in FIG. 5B and/or by modifying an interactive control (not shown) for the chart 525 c in FIG. 5B to limit the display to a particular group.
FIG. 5D illustrates yet another level of analysis refinement, and in particular displays a pie chart 535 that provides details about types of activities that are performed by a particular regional cell of a particular terrorist group for the period of time being analyzed. In the illustrated embodiment, the types of activities includes communication activities, financial activities, immigration activities, meeting activities, movement activities, and miscellaneous other activities. Such a chart could be selected by a user in various ways, such as by selecting information representing that regional cell in the chart 530 in FIG. 5C and/or by selecting appropriate information (not shown) in table 525 e in FIG. 5B.
FIG. 5E illustrates yet another level of analysis refinement, and in particular illustrates a table 540 with information about communication activities of the specified regional cell of the specified terrorist group for the selected period of time. As with other illustrated types of analysis information, the illustrated table may be selected by the user in various ways, such as by selecting information that represents communication-type activities in pie chart 535 illustrated in FIG. 5D.
While not illustrated, the user in the illustrated embodiment can continue to refine and/or modify the analyses that are presented in various ways, such as to view information for other periods of time and to view other types of information.
In addition, in some embodiments indications of current values and/or changes in values for various types of security-related information over specified periods of time (e.g., to show current values and trends) may also be displayed.
For example, an investigative user such as the current counter-terrorism user may in some embodiments be able to view analyses that include the following: Example Format Name Description For Display Activities by Time Cumulative group & suspect Column chart Period (Week, Month, activities for time period Quarter, Year) (default is most recent 4 weeks) Activities by Type Number of activities of the Pie chart and by Time Period specified activity types for time period (default is most recent month) Activities by Group Number of activities for top Clustered bar and by Time Period groups for time period chart (default is 10 groups & most recent month) Activities by Suspect Number of activities for top Clustered bar and by Time Period suspects for time period chart (default is 10 suspects & most recent month) Top Groups by Open Top groups by number of cases Table Cases and by Time opened in time period Period (default is 10 groups & most recent three months) Top Cases by Activity Top active cases by number of Table and by Time Period new activities in time period (default is 10 cases & most recent month) Active Cases by Age Number of active cases by Column chart number of days since created - less than 7, 7-14, 15-30, 31-60, 61+ Active Cases Number of active cases by Column chart by Threat Level threat level - High, Medium, Low Closed Cases Number of cases closed in Column chart by Age and by Time time period (default is Period previous month) by difference in days between creation and close date - less than 7, 7-14, 15-30, 31-60, 61+ Case Volume & Avg Number of cases opened by Column chart Load by Agent, by time unit (default is a with line Time Unit and by month) within the time period overlay for Time Period (default is prior 6 months) average load on left axis, average number of cases per agent on right axis for time period
As is shown, each of the listed example types of analyses includes at least one measurement criteria for a type of security-related information being measured, and includes a time period for which the security-related information will be analyzed. The last example analysis type also includes a time unit within the time period (e.g., a month within 6-month time period), and the security-related information for each of the time units within the time period will be combined and measured individually, such as to show a trend within the time period. In some embodiments, such time units may also be specified for any analysis with a time period.
As an example of types of analyses for a user acting in a different role, a health care professional may be able to view analyses that include the following: Example Format Name Description For Display Most Active Diseases Top diseases by number of Table by Time Period Service Requests (SRs) opened in time period (default is 10 cases & most recent month) SRs by Account Number of SRs by state, city & Map Location and by hospital in time period (default Time Period is most recent month) SRs by Region and by Number of SRs for time period Table Time Period (default is most recent month) by 4 major regions of US - Northeast, Midwest, South, West Open SRs by Age Number of open SRs by number Stacked of days since created - less column than 7, 7-14, 15-30, 31-60, chart broken 61+ out by disease Top Cases by Activity Top active cases by number of Table and by Time Period new activities in time period (default is 10 cases & most recent month) Active Cases by Age Number of active cases by Column chart number of days since created - less than 7, 7-14, 15-30, 31-60, 61+ Closed Cases by Age Number of cases closed in time Column chart and by Time Period period (default is previous month) by difference in days between creation and close date - less than 7, 7-14, 15-30, 31-60, 61+ Case Volume & Avg. Number of cases opened by time Column chart Load by Agent, unit (default is a month) within with line by Time Unit and the time period (default is overlay for by Time Period prior 6 months) on left axis, average load average number of cases per agent on right axis for time period
As with the analyses for the investigative agent role, in some embodiments any of the illustrated analyses with a time period may also allow a time unit within the time period to be specified and used.
FIG. 5F illustrates an alternative format for displaying changes in threat information over a period of time, such as to indicate trends. In particular, in the illustrated embodiment, the user interface includes a map 545 on which is displayed a variety of information about locations of terrorism suspects. While not illustrated here, the user may be able to view how locations of one or more of the suspects changes over, a selected period of time, such as by watching a corresponding icon for that suspect interactively move on the map and/or by viewing a series of two or more maps with changing locations. Other types of threat information with a geographic component can similarly be displayed in this manner. In addition, changes over time to this type of information as well as other threat information without a geographic component can be illustrated in other manners, such as by displaying a timeline with information shown for different points or periods of time.
FIG. 5G illustrates a variety of types of information analyses that can assist a user in identifying security threats. In particular, the “Threat Analysis” sub-tab 520 b has been selected in the illustrated embodiment, and a variety of threat alert information 550, threat level information 555 and threat analysis information 560 is displayed. The threat alert information indicates summaries of various threat alerts that have been triggered and that may be relevant for the user, and the threat level information shows current threat levels for various watch list suspects. Various charts 560 a-560 d are also illustrated to indicate various types of threat information over specified periods of time that include the current month for pie chart 560 b, the current week for bar chart 560 a, and the current year for bar chart 560 d. By viewing changing numbers of terrorist activities during each month (partially shown) for a specified period of time (e.g., a year), bar chart 560 c can indicate a trend in the number of terrorist activities. In addition, the user can interactively select other types of analyses and/or modify existing analyses (e.g., by refining the analyses) to view information about changes in other types of terrorist-related information over time, such as to identify trends.
FIG. 5H illustrates a pop-up window 565 related to alert 550 a, such as based on selection of that alert by the user or instead automatically based on a determination that the user is an appropriate recipient of the alert information. In the illustrated embodiment, the pop-up window includes a variety of details about the triggered alert, which in this example is based on multiple watch list suspects being in transit to a single city. In addition, a variety of interactive options 570 are presented to the user related to the alert, such as to re-execute the definition for the alert against current conditions, to review details about the alert definition, to clear this occurrence of the alert (e.g., to remove it from the displayed user interface of this user and/or of all users), and to close the pop-up window without clearing the alert. While not illustrated here, the system may have performed a variety of additional activities in response to the alert occurrence, such as notifying other users and/or interacting with other systems (e.g., computer systems of law enforcement officials in the city to which the watch list suspects are traveling or of the one or more transit companies on which the watch list suspects are traveling). Information about threat alerts may also be viewed by users in other ways in the illustrated embodiment, such as by selecting the “Outbound Alerts” tab 510 c illustrated in FIG. 5A.
While not illustrated here, a variety of other data analysis techniques could similarly be used. For example, in some embodiments the performance of a first data analysis could trigger other the performance of other data analyses, such as regularly monitoring threat information to detect when a trend reaches a threshold, which triggers one or more additional analyses (e.g., that are not performed regularly). Such data analysis triggering can continue for multiple levels, such as if one of the additional analyses that is triggered identifies a possible threat in such a manner as to trigger other analyses to be performed.
FIG. 6 is a block diagram illustrating an embodiment of a server computing device suitable for analyzing security-related information using the described techniques. In addition, client computing devices 650 are illustrated from which users can request specified types of analyses and/or receive information about performed analyses.
The computing system 600 includes a CPU 605, various I/O devices 610, storage 620, and memory 630. The I/O devices include a display 611, a network connection 612, a computer-readable media drive 613, and various other I/O devices 615. The computing device and the functionality it provides can be accessed by users in a variety of ways. For example, some users may have physical access to the computing system 600, and if so may use the I/O devices 610 to interact with the computing system. Alternatively, other users may use the remote client computing devices 650 to remotely access the computing system 600 (e.g., via the World Wide Web, such as over an intranet and/or the Internet).
An embodiment of a Threat Identifier system facility 640 is executing in memory 630, and it includes a Threat Trend Analyzer component 642 and a Threat Alert Generator component 644. The Threat Trend Analyzer component identifies trends in various security-related (or “threat-related”) information and the Threat Alert Generator component provides alerts when triggered by current conditions, as discussed in greater detail below.
In particular, the Threat Trend Analyzer component uses various trend analysis definitions from database 625 on storage to analyze various threat-related information in database 621 on storage in order to detect trends in the threat-related information, such as in response to requests from a user and/or to provide appropriate information to a user (e.g., based on a current role of the user). In some embodiments, the Threat Trend Analyzer component will also use various user information 623 from storage when performing an analysis for a user and/or providing analysis information to a user, such as to verify authority of the user to receive the information and/or to specialize the analysis performance or information providing in accordance with a role of the user and/or preferences of the user. The threat-related information used by the component can be retrieved from various sources, such as network-accessible data sources 690 and/or accessible computing systems 670 having data 677 on storage 675, whether instead of or in addition to having that information stored locally in database 621. In the illustrated embodiment, the accessible computing systems also include a CPU 673, various I/0 devices 674, and a memory 671.
In addition, the Threat Alert Generator component uses various alert criteria from database 627 on storage to determine when current conditions (e.g., of threat-related information in database 621) trigger the alert, such as in response to requests from a user and/or to provide appropriate information to a user (e.g., based on a current role of the user). In some embodiments, the Threat Alert Generator component will also use user information 623 when determining whether an alert is triggered for a user and/or when providing alert information to a user, such as to verify authority of the user to receive the information and/or to specialize the alert triggering determination or alert information providing in accordance with a role of the user and/or preferences of the user.
After a trend analysis is performed or an alert is triggered, an appropriate user (e.g., a user that defined or previously selected the trend analysis or alert, or instead a user having an appropriate current role) can be notified in various ways.
For example, in some embodiments the components 642 and 644 may directly notify the appropriate users, such as by sending messages to the users or by providing information to be presented to the users. In other embodiments, reports may be generated that include information about the trend analyses and/or triggered alerts, such as directly by the components 642 and 644 or instead in conjunction with an optional report generator component 632 executing in memory, and those reports can then be provided to the appropriate users.
In addition, in some embodiments users may request and/or retrieve information about trend analyses and/or triggered alerts, such as via a Threat Identifier Accessor component 652 (e.g., software specialized for the Threat Identifier system, or instead non-specific software such as a Web browser) executing in memory 651 of a client computing devices. The client computing devices also include a CPU 653, various I/O devices 654, and a storage 655 that may include various user information 657 (e.g., user preference information, information about a current role of the user, various authorization or access information to indicate types of information for which the user is appropriate, etc.) for one or more users of that computing device.
In addition, the components 642 and 644 may also interact with one or more other executing components based on trend analysis information or the triggering of an alert, such as an optional threat deterrer component 634 executing in memory 630, whether instead of or in addition to notifying appropriate users. Such interactions with other executing components may provide a variety of functionality and other benefits, such as to allow identified future threats to be quickly addressed in a proper manner.
Those skilled in the art will appreciate that in other embodiments the described functionality may be provided in other manners, such as by a single computing device of a user that performs analyses of information and notifies the user as appropriate. More generally, computing systems 600 and 650 are merely illustrative and are not intended to limit the scope of the present invention, and may be connected to other devices that are not illustrated (e.g., through one or more networks such as the Internet or via the World Wide Web). In addition, a “client” or “server” may comprise any combination of hardware or software that can interact as described, including computers, network devices, internet appliances, PDAs, wireless phones, pagers, electronic organizers, television-based systems and various other consumer products that include inter-communication capabilities. Moreover, the functionality provided by the illustrated components may in some embodiments be combined in fewer components or distributed in additional components. Similarly, in some embodiments the functionality of some of the illustrated components may not be provided and/or other additional functionality (e.g., other types of analyses) may be available.
FIG. 7 is a flow diagram of an embodiment of a Threat Trend Analyzer routine 700. The routine analyzes various types of threat information in order to identify trends of concern, such as based on an analysis definition supplied by a user.
The routine begins at step 705 where an indication as received to specify a new threat trend analysis definition or instead to perform a trend analysis. An indication to perform a trend analysis may have a variety of forms, such as an indication to perform a periodic analysis as specified (e.g., once a day), an explicit user instruction, a receipt of appropriate threat information (e.g., a sufficient amount to reach an analysis threshold or of a type that triggers an analysis), etc. The routine then continues the step 710 to determine whether the received indication was to specify a new threat trend analysis definition, and if so continues to step 715 where a definition is received of a type of threat information and of various parameters for the analysis. The parameters for an analysis can be of various types, such as a time period for the analysis (e.g., the previous week or month), a report format for presenting analysis information, a threshold for a total amount or an amount of change that is considered significant, etc. While not illustrated here, in other embodiments a variety of other types of threat information analyses could also be defined, such as correlations between different types of threat information or between threat information and non-threat information, automated techniques to analyze various threat information to identify patterns and/or unusual information that varies from normal (e.g., based on data mining techniques), etc. After step 715, the routine continues to step 720 to store the supplied threat trend analysis definition.
If it was instead determined in step 710 that the received indication was to perform a threat trend analysis, the routine continues to step 725 to select the next indicated type of trend analysis, beginning with the first. In some embodiments, the specific types of trend analyses to be performed may be specified in step 705, while in other embodiments the analyses to be performed may be determined in other ways (e.g., based on a role of a user of the routine, on a predetermined schedule, on a type of threat information that has become available, etc.). The routine then continues to step 730 to retrieve a stored definition for the selected trend analysis, and then continues to step 735 to retrieve appropriate threat-related information indicated by the definition. In other embodiments, definitions may instead not be specified and stored in advance, such as when a user interactively specifies a trend analysis to be performed. The routine then continues to step 740 to analyze the retrieved threat information as indicated by the definition.
In step 745, the routine next determines whether to generate a report about the trend analysis that was performed, such as based on the threat trend analysis definition and/or in a manner specific to a user. If so, the routine continues to step 750 to generate a report that reflects the analysis, and if not the routine continues to step 755 to store the analysis information temporarily while the other analyses are performed (and optionally on a longer-term basis, such as for later use). After steps 750 or 755, the routine continues to step 760 to determine whether there are more analyses to perform, and if so returns to step 725. If not, the routine continues to step 765 to determine whether to present the analysis information to the user, and if so continues to step 770 to present the generated reports and/or the temporarily stored analysis information to the user, such as in a manner based on user preferences and/or the analysis definitions. After step 770 or 720, or if it was instead determined in step 765 not to present information to the user, the routine continues to step 795 to determine whether to continue. If so, the routine returns to step 705, and if not the routine continues to step 799 and ends.
FIG. 8 is a flow diagram of an embodiment of a Threat Alert Generator routine 800. The routine identifies occurrences of interest related to threat information that trigger defined alerts, and provides alert information to users and/or other components as appropriate.
The routine begins at step 805 where an indication is received to define an alert type or of a change to threat information. The routine continues to step 810 to determine whether an alert is to be defined, and if so continues to step 815 to receive in the illustrated embodiment a definition of a type of threat information, of a criteria that when satisfied by threat information will trigger an alert (e.g., a threshold for a specified aspect of the information), and of a type of alert response. The routine then continues to step 820 to store the definition.
If it was instead determined in step 810 that a change to threat information has occurred, the routine continues to step 825 to retrieve alert definitions that are associated with the type of changed threat information. In other embodiments, alerts can be selected to be evaluated against current conditions (or other conditions, such as past conditions or predicted future conditions) in a variety of ways, such as based on an indication to perform a periodic evaluation as specified (e.g., once a day), an explicit user instruction, a receipt of appropriate threat information, etc. In step 830, the routine then selects the next retrieved alert definition, beginning with the first. In step 835, it is then determined whether that alert is triggered by the change to threat information, and if so continues to step 840 to generate an alert and to step 845 to perform the alert response for that alert definition (e.g., generating a pop-up window on the screens of one or more users, generating an instant communication to one or more users such as a phone call, page, instant message or SMS text, etc.).
After step 845, or if it was instead determined in step 835 that the selected alert was not triggered, the routine continues to step 850 to determine whether there are more alert definitions, and if so returns to step 830. If not, the routine continues to step 855 to determine whether to present alert information to a user (e.g., a summary of one or more current alerts), and if so continues to step 860 to present information about the generated alerts to the user. After steps 860 or 820, or if it was instead determined in step 855 not to present information, the routine continues to step 895 to determine whether to continue. If so, the routine returns to step 805, and if not the routine continues to step 899 and ends.
2. A method in a computing system for identifying future terrorism threats based on analysis of terrorist activity information, the method comprising:
for each of multiple users,
determining a current role of the user related to fighting terrorism;
selecting one or more terrorism threat trend analysis (TTTA) definitions and one or more terrorism threat alert definitions for the user based at least in part on the determined current role, each TTTA definition specifying a measurement criteria for one of multiple types of terrorist activities and specifying a length of time, and each terrorism threat alert definition specifying a threshold related to one of the multiple types of terrorist activities; and
repeatedly assisting the user in identifying future terrorism threats in an automated manner by, for each of the selected TTTA definitions,
retrieving information about terrorist activities that occurred during a previous period of time of the length specified by the TTTA definition and that are of the type for the specified measurement criteria of the TTTA definition;
analyzing the retrieved terrorist activity information based on the measurement criteria specified by the TTTA definition in order to calculate activity threat values during the previous period of time and to detect a trend in the calculated activity threat values over the previous period of time;
generating a report that includes the calculated activity threat values in such a manner as to indicate the detected trend;
presenting the generated report to the user to enable the user to identify the detected trend in the determined activity threat values;
when the retrieved information is of the type for which one or more of the selected terrorism threat alert definitions has a specified threshold,
determining for each of those selected terrorism threat alert definitions whether one or more of the calculated activity threat values exceed the threshold specified by the terrorism threat alert definition; and
when a threshold specified by a terrorism threat alert definition is exceeded, immediately notifying the user of that terrorism threat alert; and
after the detecting of a trend and/or the determining that a threshold of a terrorism threat alert definition is exceeded, determining appropriate security personnel to be notified of the detected trend and/or of the exceeded terrorism threat alert threshold and notifying those security personnel of the detected trend and/or of the exceeded terrorism threat alert threshold,
so that users can identify future terrorism threats based on detected trends in terrorist activities and on thresholds for threat alerts that are exceeded;
wherein the terrorism threat alert definitions are each associated with one of the TTTA definitions in such a manner that the specified threshold for a terrorism threat alert definition corresponds to an amount of change in a detected trend of multiple calculated activity threat values from an analysis of terrorist activity information for the associated TTTA definition.
5. The method of claim 2 including, after the presenting of a generated report to a user, receiving instructions from the user to modify the analyzing of the retrieved terrorist activity information used to generate that report and presenting a revised report to the user that is generated based on a modified analysis of the retrieved terrorist activity information as indicated.
6. The method of claim 2 including selecting additional types of terrorist activity information analyses for at least one of the users and presenting reports to those users that are generated based on use of the selected additional types of analyses.
7. The method of claim 2 wherein, for each of at least one of the users, the selecting of the TTTA definitions and the terrorism threat alert definitions for the user is further based on information specific to that user.
8. The method of claim 2 wherein, for each of at least one of the users, the presenting of generated reports to the user and/or the notifying of the user of terrorism threat alerts is performed in a manner specific to that user.
9. The method of claim 2 wherein each of at least one of the TTTA definitions further specifies one or more terrorist groups and/or one or more terrorist suspects, and wherein the terrorist activity information that is retrieved for those TTTA definitions is further for activities performed by the specified terrorist groups or specified terrorist suspects.
10. The method of claim 2 wherein the current role of each of at least one of the users is an investigative counter-terrorism agent who is to prevent future terrorist threats and wherein the current role of each of at least one user other than the investigative counter-terrorism agent users is a health professional who is to address health problems caused by terrorist activities.
11. The method of claim 2 wherein the users are part of an organization that provides an information portal from which each of the users can repeatedly receive a page of information with information specific to that user for presentation on a computing device, wherein the analyzing of retrieved terrorist information for a user is performed as part of each generation of the page of information specific to that user, and wherein the reports generated from the analyzing are included as part of each generated page of information so that the generated reports can be presented to the user as part of the presenting of that page of information.
12. A computer-implemented method for identifying possible terrorism threats, the method comprising:
receiving information about terrorist activities that have occurred;
receiving an indication of a current user who has a specified current role related to fighting terrorism, the current role being one of multiple distinct roles that are each associated with threat analyses having associated criteria for analyzing terrorist activity information;
identifying based at least in part on the specified current role of the current user one or more threat analyses;
for each of the identified threat analyses, automatically analyzing the received terrorist activity information based on associated criteria for that threat analysis in order to determine whether the terrorist activities indicate a possible terrorism threat, the analyzing using the associated criteria for the threat analysis to measure one or more aspects of the terrorist activity information for each of multiple units of time and determining a trend in one or more of the measured aspects over a period of time that includes multiple of the time units; and
when the analyzing of the received terrorist activity information indicates a possible terrorism threat,
providing to the current user information related to the possible terrorism threat;
automatically determining an appropriate user to notify of the possible terrorism threat based at least in part on a type of the possible terrorism threat and on a current role of that user; and
notifying the determined user of the possible terrorism threat.
13. The method of claim 12 wherein the automatic analysis of the received terrorist activity information is performed in response to the receiving of the terrorist activity information.
14. The method of claim 12 wherein the identifying of the threat analyses is based on an indication of the identified threat analyses received from the current user, and wherein the automatic analysis of the received terrorist activity information is performed in response to the received indications.
15. The method of claim 14 wherein the appropriate user is determined to be the user from which the indication of the threat analyses is received.
16. The method of claim 12 wherein the automatic analysis of the received terrorist activity information is performed in response to an indication to provide information about terrorist activities to the determined appropriate user.
17. The method of claim 16 wherein the notifying of the determined user includes presenting information to that user about the analyzing of the received terrorist activity information.
18. The method of claim 17 wherein the presenting of the information to the user is performed as part of each load of an information page generated for that user.
21. The method of claim 12 wherein a possible terrorism threat is indicated by the analyzing when a determined trend satisfies a condition, and wherein the notifying of the determined user of the possible terrorist threat includes providing information about the determined trend.
22. The method of claim 12 wherein the analyzing further includes determining whether one or more of the measured aspects satisfies conditions for triggering an alert.
23. The method of claim 12 wherein a possible terrorism threat is indicated by the analyzing when an alert is triggered, and wherein the notifying of the determined user of the possible terrorist threat includes providing information about the alert.
24. The method of claim 12 wherein the notifying is performed in a real-time manner.
25. The method of claim 12 wherein the analyzing further includes comparing the received terrorist activity information to another type of information.
26. The method of claim 12 wherein the identifying of the threat analyses is based on a data mining analysis of information related to terrorist activities.
28. The method of claim 12 wherein the identifying of the threat analyses and the automatic analyzing of the received terrorist activity information are performed for each of multiple users such that distinct threat analyses are identified and used for the users.
29. The method of claim 12 wherein the determining of an appropriate user based on a type of a possible terrorism threat includes selecting a user whose current role includes addressing terrorism threats of that type.
30. The method of claim 12 wherein the terrorist activity information that is received is for activities performed by one or more specified terrorist groups.
31. The method of claim 12 wherein the terrorist activity information that is received is for activities performed by one or more specified terrorist suspects.
32. A computer-readable medium whose contents cause a computing device to assist in identifying security threats, by performing a method comprising:
identifying one or more threat analyses for analyzing information about occurrences related to one or more security threats, the identified threat analyses selected based at least in part on a current role of a current user;
for each of the identified threat analyses, attempting to identify a security threat by analyzing the security threat occurrence information, the analyzing including measuring one or more aspects of the security threat occurrence information for each of multiple units of time and determining a trend in one or more of the measured aspects over a period of time that includes multiple of the time units; and
when the analyzing of the received security threat occurrence information identifies a security threat, notifying a user of the identified security threat who is selected as appropriate based at least in part on the identified security threat.
33. The computer-readable medium of claim 32 wherein the security threat occurrence information includes information about terrorist activities that have occurred.
34. The computer-readable medium of claim 32 wherein the method includes determining the appropriate user for an identified security threat based on a type of the identified security threat.
36. The computer-readable medium of claim 32 wherein the computer-readable medium is a data transmission medium transmitting a generated data signal containing the contents.
38. A computing device for assisting in identifying possible security threats, comprising:
a threat analyzer component that is capable of identifying a threat analysis that has an associated criteria for analyzing security threat occurrence information and of analyzing the security threat occurrence information based on the associated criteria in order to identify a possible security threat, the analyzing using the associated criteria for the threat analysis to determine a trend over a period of time in one or more aspects of the security threat occurrence information; and
a threat notifier component that is capable of notifying a user of an identified possible security threat, the user selected as appropriate for the identified possible security threat based at least in part on a current role of the user.
39. The computing device of claim 38 wherein the threat analyzer component and the threat notifier component are executing in memory of the computing device.
40. A computer system for assisting in identifying possible security threats, comprising:
means for identifying a threat analysis that has an associated criteria for analyzing security threat occurrence information and for analyzing the security threat occurrence information based on the associated criteria in order to identify a possible security threat, the analyzing using the associated criteria for the threat analysis to determine a trend over a period of time in one or more aspects of the security threat occurrence information; and
means for notifying a user of an identified possible security threat after the user is identified as appropriate for the identified possible security threat based at least in part on a current role of the user.
41. A computer-implemented method for identifying potential terrorist acts, the method comprising:
identifying one or more threat analyses that each have an associated criterion for analyzing the received terrorist activity information;
for each of the identified threat analyses, automatically analyzing the received terrorist activity information based on the associated criterion for that threat analysis in order to determine whether the terrorist activities indicate a potential terrorist act, the analyzing including determining a trend over a period of time in one or more aspects of the received terrorist activity information; and
when the analyzing of the received terrorist activity information indicates a potential terrorist act,
identifying one or more individuals who will perform the potential terrorist act;
selecting one or more agents appropriate to directly prevent the potential terrorist act, the selecting based on a type of the potential terrorist act and on current roles of the agents that are related to preventing terrorist acts of that type; and
notifying the selected agents of the potential terrorist act and the identified individuals in order to directly prevent the potential terrorist act.
US10/185,871 2002-06-27 2002-06-27 Identifying security threats Abandoned US20070222589A1 (en)
US10/185,871 US20070222589A1 (en) 2002-06-27 2002-06-27 Identifying security threats
US20070222589A1 true US20070222589A1 (en) 2007-09-27
ID=38532783
US10/185,871 Abandoned US20070222589A1 (en) 2002-06-27 2002-06-27 Identifying security threats
US (1) US20070222589A1 (en)
US20080086775A1 (en) * 2006-10-04 2008-04-10 Rolf Repasi Detecting an audio/visual threat
US20140266715A1 (en) * 2013-03-15 2014-09-18 Honeywell International Inc. Access Control Systems with Variable Threat Level
US10367839B2 (en) * 2017-04-28 2019-07-30 Cisco Technology, Inc. Graphical user interface programmed to display complex indicators based on structured threat expressions
2002-06-27 US US10/185,871 patent/US20070222589A1/en not_active Abandoned
US10459910B2 (en) 2011-02-15 2019-10-29 At&T Intellectual Property I, L.P. Methods, systems, and products for maintaining data consistency in a stream warehouse
JP2005521974A (en) 2005-07-21 Method, computer memory, and computer system for presenting a request for approval in a computer system
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GORMAN, RICHARD;ABBO, EDWARD;BUTITTA, ANTHONY JAMES;REEL/FRAME:013358/0405;SIGNING DATES FROM 20020808 TO 20020930