Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: A network security system includes a network interface configured to connect to a public wide area network and a first malicious activity detection subsystem configured to extract from textual sources on the network different threat levels in a first threat category for addresses on the wide area network. One or more further malicious activity detection subsystems are configured to extract from textual sources on the network different threat levels in one or more further threat categories. A weighting subsystem is configured to provide weighted threat levels for addresses on the wide area network for the first and further malicious activity detection subsystems. A scoring subsystem is responsive to the weighting subsystem to derive an aggregated, weighted threat score for each of the network addresses. An address proximity engine can determine a measure of logical proximity of network addresses independently of any measure of physical proximity between them.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: Disclosed, in one general aspect, is a computer-based method and apparatus for extracting predictive information from a collection of stored, machine-readable electronic documents. The method includes accessing at least a subset of the electronic documents each including different machine-readable predictive information about one or more future facts occurring after a publication time for that document. The method also includes extracting the predictive information about the one or more future facts from the accessed documents, and deriving one or more predicted query information items based on the predictive information extracted in the step of extracting.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.