Abstract: A system, method, and computer-readable medium are disclosed for performing a type-dependent event deduplication operation. The type-dependent event deduplication operation comprising: receiving a stream of events, the stream of events comprising a plurality of events, each event of the plurality of events having an associated event type; determining an event type of the plurality of events; parsing the plurality of events based upon the associated event type, the parsing providing a plurality of parsed events; and, performing a type-dependent event deduplication operation on the plurality of parsed events, the type-dependent event deduplication operation deduplicating events based upon the event type.

Abstract: A method, system and computer-usable medium for constructing a distribution of interrelated event features. The constructing a distribution of interrelated event features includes receiving a stream of events, the stream of events comprising a plurality of events; extracting features from the plurality of events; constructing a distribution of the features from the plurality of events; and, analyzing the distribution of the features from the plurality of events.

Abstract: A method, system and computer-usable medium for identifying probability distributions. The identifying probability distributions includes receiving a stream of events, the stream of events comprising a plurality of events; extracting features from the plurality of events, at least some extracted features corresponding to interrelated events; identifying items of interest based upon the interrelated events; and, generating a distribution value based upon the items of interest.

Abstract: A relational event history is determined based on a data set, the relational event history including a set of relational events that occurred in time among a set of actors. Data is populated in a probability model based on the relational event history, where the probability model is formulated as a series of conditional probabilities that correspond to a set of sequential decisions by an actor for each relational event, where the probability model includes one or more statistical parameters and corresponding statistics. A baseline communications behavior for the relational event history is determined based on the populated probability model, and departures within the relational event history from the baseline communications behavior are determined.

Abstract: A method, system and computer-usable medium for constructing a distribution of interrelated event features. The constructing a distribution of interrelated event features includes receiving a stream of events, the stream of events comprising a plurality of events; extracting features from the plurality of events; constructing a distribution of the features from the plurality of events; and, analyzing the distribution of the features from the plurality of events.

Abstract: A method, system and computer-usable medium for constructing a distribution of interrelated event features. The constructing a distribution of interrelated event features includes receiving a stream of events, the stream of events comprising a plurality of events; extracting features from the plurality of events; constructing a distribution of the features from the plurality of events; and, analyzing the distribution of the features from the plurality of events.

Abstract: A method, system and computer-usable medium for constructing a distribution of interrelated event features. The constructing a distribution of interrelated event features includes receiving a stream of events, the stream of events comprising a plurality of events; extracting features from the plurality of events; constructing a distribution of the features from the plurality of events; and, analyzing the distribution of the features from the plurality of events.

Abstract: A system, method, and computer-readable medium are disclosed for performing a lexicon construction operation. The lexicon construction operation includes: identifying a corpus, the corpus comprising a plurality of training events, each of the plurality of training events comprising a term; grouping terms from the plurality of training events into topic clusters; analyzing the plurality of topic clusters, the analyzing providing a plurality of classified clusters; and, deriving a plurality of learned lexicons from the plurality of classified clusters.

Abstract: A method, system and computer-usable medium for performing a streaming scoring operation, comprising: receiving a stream of events, the stream of events comprising a plurality of events; ingesting the plurality of events; extracting features from the plurality of events to provide extracted features; and, generating a streaming scoring value based upon the extracted features.

Abstract: A method, system and computer-usable medium for performing a feature generation operation. The performing a feature generation operation including: receiving a stream of events, the stream of events comprising a plurality of events; applying labels to applicable events from the plurality of events, the applying labels providing a labeled event; and, processing the labeled event to extract a feature from the labeled event, the processing providing a feature associated with an event.

Abstract: A system, method, and computer-readable medium are disclosed for performing an eventually consistent event resolution operation. The eventually consistent event resolution operation includes: parsing entity identifier information, the parsing generating a plurality of entity identifier elements from the entity identifier information; normalizing an entity identifier element of the plurality of entity identifier elements to provide a normalized entity identifier element; associating the normalized entity identifier element with the entity to resolve the identity of the entity; and, performing an eventually consistent event resolution operation, the eventually consistent event resolution operation updating distributed data associated with the entity, distributed data corresponding to entity identifiers impacted by subsequent changes to entity mappings being updated by the eventually consistent event resolution operation to reflect a more recent entity mapping.

Abstract: A method, system and computer-usable medium are disclosed for identifying security risks to a computer system based on a distribution of categorical features of events. Certain embodiments are directed to a computer-implemented method comprising: receiving a stream of events, the stream of events including a plurality of events; extracting a categorical feature from the plurality of events, where the categorical feature includes a set of categorical feature members, where the set of categorical feature members are generated on the fly from string values included in the extracted categorical feature; constructing a distribution for the categorical feature based on categorical feature members extracted from the plurality of events; and, analyzing the distribution of the categorical feature to identify one or more security risk factors.

Abstract: A system, method, and computer-readable medium for resolving an identity of an entity, comprising parsing entity identifier information associated with the entity to provide an entity identifier element, the entity identifier information comprising temporal information; classifying the entity identifier element to provide a classified entity identifier element; normalizing the classified entity identifier element to provide a classified and normalized entity identifier element; and, associating the classified and normalized entity identifier element and the temporal information with the entity to resolve the identity of the entity at a particular point in time.

Abstract: A system, method, and computer-readable medium are disclosed for constructing a distribution of interrelated event features. In various embodiments constructing the distribution includes: receiving a stream of events, the stream of events comprising a plurality of events; generating a query relating to the plurality of events, the query comprising condition information, the condition information defining a subset of query relevant events; processing the query relating to the plurality of events, extracting features from the plurality of events based upon the query; constructing a distribution of the features from the plurality of events based upon the query; and, analyzing the distribution of the features from the plurality of events based upon the query.

Abstract: A system, method, and computer-readable medium are disclosed for performing a lexicon construction operation. The lexicon construction operation includes: identifying a corpus, the corpus comprising a plurality of training events, each of the plurality of training events comprising a term; grouping terms from the plurality of training events into topic clusters; analyzing the plurality of topic clusters, the analyzing providing a plurality of classified clusters; and, deriving a plurality of learned lexicons from the plurality of classified clusters.

Abstract: A system, method, and computer-readable medium are disclosed for performing a type-dependent event deduplication operation. The type-dependent event deduplication operation comprising: receiving a stream of events, the stream of events comprising a plurality of events, each event of the plurality of events having an associated event type; determining an event type of the plurality of events; parsing the plurality of events based upon the associated event type, the parsing providing a plurality of parsed events; and, performing a type-dependent event deduplication operation on the plurality of parsed events, the type-dependent event deduplication operation deduplicating events based upon the event type.

Abstract: A system, method, and computer-readable medium are disclosed for performing an eventually consistent event resolution operation. The eventually consistent event resolution operation includes: parsing entity identifier information, the parsing generating a plurality of entity identifier elements from the entity identifier information; normalizing an entity identifier element of the plurality of entity identifier elements to provide a normalized entity identifier element; associating the normalized entity identifier element with the entity to resolve the identity of the entity; and, performing an eventually consistent event resolution operation, the eventually consistent event resolution operation updating distributed data associated with the entity, distributed data corresponding to entity identifiers impacted by subsequent changes to entity mappings being updated by the eventually consistent event resolution operation to reflect a more recent entity mapping.

Abstract: A system, method, and computer-readable medium are disclosed for performing a distribution of interrelated event features operation. The distribution of interrelated event features includes: receiving a stream of events, the stream of events comprising a plurality of events; extracting features from the plurality of events; constructing a distribution of the features from the plurality of events; analyzing the distribution of the features from the plurality of events; and, dynamically reweighting the distribution of the features to scale a number of events contained within the distribution.

Abstract: A method, system and computer-usable medium for performing a streaming scoring operation, comprising: receiving a stream of events, the stream of events comprising a plurality of events; ingesting the plurality of events; extracting features from the plurality of events to provide extracted features; and, generating a streaming scoring value based upon the extracted features.

Abstract: A method, system and computer-usable medium for performing a streaming scoring operation, comprising: receiving a stream of events, the stream of events comprising a plurality of events; ingesting the plurality of events; extracting features from the plurality of events to provide extracted features; and, generating a streaming scoring value based upon the extracted features.