Abstract: A planning and search system are described wherein a graph search and segment matching are used to handle very large searches at a higher speed.

Abstract: A planning and search system are described wherein a graph search and segment matching are used to handle very large searches at a higher speed.

Abstract: A planning and search system are described wherein a graph search and segment matching are used to handle very large searches at a higher speed.

Abstract: A method, system, and computer program product for detecting and mapping activity occurring at and between devices on a computer network for utilization within an intrusion detection mechanism. An enhanced graph matching intrusion detection system (eGMIDS) utility executing on a control server provides data collection functions and data fusion techniques. The eGMIDS comprises multiple sensors and associated unique adaptors that are located at different remote devices of the network and utilized to detect specific types of activity occurring at the respective devices relevant to eGMIDS processing. The sensors convert the data into eGMIDS format and encapsulate the data in a special transmission packet that is transmitted to the control server.

Abstract: In one or more embodiments, one or more methods and/or systems described can perform receiving a pattern; determining that components of the received pattern match corresponding components of patterns that have not been rated by a user but have been rated by other users in the user's community; calculating multiple predictive ratings corresponding to the patterns; ranking the patterns based on the predictive ratings; and recommending one or more of the top-ranked patterns to the user. In one or more embodiments, calculating multiple predictive ratings corresponding to the patterns can include calculating multiple correlation coefficients. In one example, calculating multiple correlation coefficients can be based on the other users' ratings of the patterns. In another example, calculating multiple correlation coefficients can be based on the other users' ratings of one or more components of the patterns.

Abstract: Enabling dynamic, computer-driven, context-based detection of social network patterns within an input graph representing a social network. A Social Network Aware Pattern Detection (SNAP) system and method utilizes a highly-scalable, computationally efficient integration of social network analysis (SNA) and graph pattern matching. Social network interaction data is provided as an input graph having nodes and edges. The graph illustrates the connections and/or interactions between people, objects, events, and activities, and matches the interactions to a context. A sample graph pattern of interest is identified and/or defined by the user of the application. With this sample graph pattern and the input graph, a computational analysis is completed to (1) determine when a match of the sample graph pattern is found, and more importantly, (2) assign a weight (or score) to the particular match, according to a pre-defined criteria or context.

Abstract: A method, system, and computer program product for enabling dynamic detection of anomalies occurring within an input graph representing a social network. More specifically, the invention provides an automated computer simulation technique that implements the combination of Social Network Analysis (SNA) and statistical pattern classification for detecting abnormal social patterns or events through the expanded use of SNA Metrics. The simulation technique further updates the result sets generated, based on observed occurrences, to dynamically determine what constitutes abnormal behavior, within the overall context of observed patterns of behavior.

Abstract: A method, system, and computer program product for utilizing a mapping of activity occurring at and between devices on a computer network to detect and prevent network intrusions. An enhanced graph matching intrusion detection system (eGMIDS) is provided that provides data collection functions, data fusion techniques, graph matching algorithms, and secondary and other search mechanisms. Threats are modeled as a set of entities and interrelations between the entities and sample threat patterns are stored within a database. The eGMIDS utility initiates a graph matching algorithm by which the threat patterns are compared within the generated activity graph via subgraph isomorphism. A multi-layered approach including a targeted secondary layer search following a match during a primary layer search is provided. Searches are tempered by attributes and constraints and the eGMIDS reduces the number of threat patterns searched by utilizing ontological generalization.

Abstract: NETWAR provides a utility that enables detection of both tactical and strategic threats against an individual entity and interrelated/affiliated networks of entities. A distributed network of sensors and evaluators are utilized to detect tactical attacks against one or more entities. Events on the general network are represented as an input graph, which is searched for matches of example pattern graphs that represent tactical attacks. The search is performed using a scalable graph matching engine and an ontology that is periodically updated by a subject matter expert or analyst. NETWAR provides the functionality to determine/understand the strategic significance of the detected tactical attacks by correlating detected tactical attacks on the individual entities to identify the true motive of these attacks as a strategic attack. NETWAR also provides predictive capability to predict future entities and sub-entities that may be targeted based on evaluation of the attack data.

Abstract: A method, system and computer program product implementing a computational algorithm that enables analysts to discover/find groups within a database of seemingly random electronic data in a relatively short period of time. A computer system is provided that includes a processor and program code executing on the processor for completing the following functions: (a) receiving a plurality of random electronic data corresponding to one or more activity within a monitored system; (b) discovering a group of associated data points from within the plurality of electronic data.