Abstract: A distributed data security event detection and response (DDSEDR) system includes a data security management (DSM) system and a client-side data security event confirmation and response (CDSECR) system that manage data security events, such as ransomware attacks. In at least one embodiment, the DDSEDR system provides data security event detection, confirmation, mitigation, alerting, and recovery from malicious processes and other data security events. In at least one embodiment, the DSM system monitors one or more client file event records for information that indicates a potential data security event. If the DSM system detects a potential data security threat, the DSM, sends information to the CDSECR system that causes CDSECR system to inspect one or more files associated with the potential data security event to determine whether an actual data security event occurred and initiate a responsive action when the CDSECR system detects an actual data security event.

Abstract: A method includes receiving a plurality of events that each include a plurality of associated attributes, analyzing the plurality of associated attributes in order to identify at least two or more related events, determining a time associated with each of the at least two or more related events from the plurality of associated attributes, ordering the at least two or more related events in chronological order based on the determined time associated with each of the at least two or more related events, and manipulating at least one of the at least two or more related events based on the ordering.

Abstract: A method includes receiving a plurality of events that each include a plurality of associated attributes, analyzing the plurality of associated attributes in order to identify at least two or more related events, determining a time associated with each of the at least two or more related events from the plurality of associated attributes, ordering the at least two or more related events in chronological order based on the determined time associated with each of the at least two or more related events, and manipulating at least one of the at least two or more related events based on the ordering.

Abstract: According to one embodiment of the disclosure, a computerized method for modeling business processes includes receiving, at a computer, interaction data for interaction sessions. The interaction data includes session states indicative of session screens. The interaction data further includes transitions between the session states. The computerized method also includes identifying, at the computer, business processes based on the interaction data. The computerized method further includes identifying, at the computer, instances of the business processes in the interaction data. The computerized method further includes storing the instances as event records. The event records include a parameter indicative of a corresponding business process. The computerized method further includes generating a model based on the event records.