Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: Disclosed, in one general aspect, is a computer-based method and apparatus for extracting predictive information from a collection of stored, machine-readable electronic documents. The method includes accessing at least a subset of the electronic documents each including different machine-readable predictive information about one or more future facts occurring after a publication time for that document. The method also includes extracting the predictive information about the one or more future facts from the accessed documents, and deriving one or more predicted query information items based on the predictive information extracted in the step of extracting.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: Disclosed, in one general aspect, is a computer-based method and apparatus for extracting predictive information from a collection of stored, machine-readable electronic documents. The method includes accessing at least a subset of the electronic documents each including different machine-readable predictive information about one or more future facts occurring after a publication time for that document. The method also includes extracting the predictive information about the one or more future facts from the accessed documents, and deriving one or more predicted query information items based on the predictive information extracted in the step of extracting.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: Disclosed, in one general aspect, is a computer-based method and apparatus for extracting predictive information from a collection of stored, machine-readable electronic documents. The method includes accessing at least a subset of the electronic documents each including different machine-readable predictive information about one or more future facts occurring after a publication time for that document. The method also includes extracting the predictive information about the one or more future facts from the accessed documents, and deriving one or more predicted query information items based on the predictive information extracted in the step of extracting.

Abstract: Disclosed, in one general aspect, is a computer-based method and apparatus for extracting predictive information from a collection of stored, machine-readable electronic documents. The method includes accessing at least a subset of the electronic documents each including different machine-readable predictive information about one or more future facts occurring after a publication time for that document. The method also includes extracting the predictive information about the one or more future facts from the accessed documents, acquiring verified information about one or more of the facts, and evaluating a measure of quality of the predictive information extracted from the documents based on the verified information about the facts.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, a wide area network fact information service system is disclosed. It includes a real time database that stores information about facts on the network by recording at least an identifier and an occurrence timepoint for each fact, with the occurrence timepoint identifying a time at which the fact occurred. It also includes fact-based expression logic operative to interact with expressions that define relationships between facts based on both their identifiers and their timepoints, and a timeline display interface operative to display a timeline that shows a temporal relationship between facts.