Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: Disclosed, in one general aspect, is a computer-based method and apparatus for extracting predictive information from a collection of stored, machine-readable electronic documents. The method includes accessing at least a subset of the electronic documents each including different machine-readable predictive information about one or more future facts occurring after a publication time for that document. The method also includes extracting the predictive information about the one or more future facts from the accessed documents, and deriving one or more predicted query information items based on the predictive information extracted in the step of extracting.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: Disclosed, in one general aspect, is a computer-based method and apparatus for extracting predictive information from a collection of stored, machine-readable electronic documents. The method includes accessing at least a subset of the electronic documents each including different machine-readable predictive information about one or more future facts occurring after a publication time for that document. The method also includes extracting the predictive information about the one or more future facts from the accessed documents, and deriving one or more predicted query information items based on the predictive information extracted in the step of extracting.

Abstract: Disclosed, in one general aspect, is a computer-based method and apparatus for extracting predictive information from a collection of stored, machine-readable electronic documents. The method includes accessing at least a subset of the electronic documents each including different machine-readable predictive information about one or more future facts occurring after a publication time for that document. The method also includes extracting the predictive information about the one or more future facts from the accessed documents, acquiring verified information about one or more of the facts, and evaluating a measure of quality of the predictive information extracted from the documents based on the verified information about the facts.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, a wide area network fact information service system is disclosed. It includes a real time database that stores information about facts on the network by recording at least an identifier and an occurrence timepoint for each fact, with the occurrence timepoint identifying a time at which the fact occurred. It also includes fact-based expression logic operative to interact with expressions that define relationships between facts based on both their identifiers and their timepoints, and a timeline display interface operative to display a timeline that shows a temporal relationship between facts.

Abstract: In one general aspect, a wide area network fact information service system is disclosed. It includes a real time database that stores information about facts on the network by recording at least an identifier and an occurrence timepoint for each fact, with the occurrence timepoint identifying a time at which the fact occurred. It also includes fact-based expression logic operative to interact with expressions that define relationships between facts based on both their identifiers and their timepoints, a relationship database for storing representations of the relationships that satisfy the expressions, and a service interface operative to allow a service consumer to query the database of stored relationships.

Abstract: A system for analyzing data is disclosed. In one general aspect it includes a data analysis user interface responsive to user interaction to initiate actions on the data. An action logging interface is operative to create a logged sequence of actions as the user initiates them through the data analysis user interface. And a token-based authoring user interface responsive to user selection commands to select action-tokens corresponding to the actions logged by the action logging interface to create an authored set of actions that has an authored sequence that can be different from the logged sequence.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, a wide area network fact information service system is disclosed. It can include a fact information extraction interface to extract information about facts from different kinds of textual sources that include information about those facts. A database stores at least some of the extracted information about the facts from the different types of information by recording at least an identifier and an occurrence timepoint for each fact. The system can also include ranking logic to associate a ranking with at least some of the facts, and a service interface to enable a service consumer to access the stored facts based on at least their timepoints and their associated rankings.