Abstract: Methods and systems for computing a risk metric on a network of processing nodes are disclosed. The method includes receiving a plurality of events at a plurality of processing nodes. The method further includes at a first processing node, processing on a first event and a known instance of a second event to determine whether the first event matches the known instance of the second event. The method further includes in response to determining that the first event does not match the known instance of the second event, terminating the processing without generating an output, and generating a first output event having a resulting probability computed based on a confidence value of the first event and a first probabilistic value of a first missing event, or in response to determining that the first event matches the known instance of the second event, generating the first output event having the resulting probability computed based on the confidence value of the first event.

Abstract: Systems and methods for processing events are disclosed. Event data comprising passive event data, active event data, or both is received. It is determined whether the received event data is available for a pattern of passive event data and active event data. In response to determining that the received event data is available for the pattern of passive event data and active event data, one or more constraints between the passive event data and the active event data are converted into one or more query terms. The query terms are used to construct at least one query. Remaining passive event data that is related to some, but not all, of the active event data is obtained using the constructed at least one query.

Abstract: Systems and methods for processing events are disclosed. Event data comprising passive event data, active event data, or both is received. It is determined whether the received event data is available for a pattern of passive event data and active event data. In response to determining that the received event data is available for the pattern of passive event data and active event data, one or more constraints between the passive event data and the active event data are converted into one or more query terms. The query terms are used to construct at least one query. Remaining passive event data that is related to some, but not all, of the active event data is obtained using the constructed at least one query.

Abstract: Methods and systems for computing a risk metric on a network of processing nodes are disclosed. The method includes receiving a plurality of events at a plurality of processing nodes. The method further includes at a first processing node, processing on a first event and a known instance of a second event to determine whether the first event matches the known instance of the second event. The method further includes in response to determining that the first event does not match the known instance of the second event, terminating the processing without generating an output, and generating a first output event having a resulting probability computed based on a confidence value of the first event and a first probabilistic value of a first missing event, or in response to determining that the first event matches the known instance of the second event, generating the first output event having the resulting probability computed based on the confidence value of the first event.

Abstract: Methods and systems for processing events are disclosed. According to one embodiment, input source data that includes event data of one or more events is received. One or more event definitions that match the event data are selected. For each matching event definition, the event definition is inputted into a template to generate a set of events. The template includes a number of assertions and has the event definition as one of the assertions, where each assertion includes a constraint. The constraints of the assertions are progressively processed to produce one or more solutions that are subsets of the set of events. For each constraint and each solution, a set of target events that is viable for the solution is identified, and a new solution is produced based on the solution and the identified set of target events, whereby a set of new solutions is produced.

Abstract: The present invention is a method or system of analyzing items to create a data structure using lexicon analysis and filtering process. The present invention drives the analysis without a user being required to provide search terms and Boolean queries. Further, the present invention merges the use of unstructured data and structured data using a lexicon as a focus. Structured data is mapped to lexicon terms through one analysis process, while unstructured data is mapped to lexicon terms through a separate analysis process. In some disclosed embodiments, the mapping process uses a tuple structure of the source data to match with lexicon terms. The result is an analysis that merges the two different sets of data, which enables a user to navigate through the items using lexicons. Analysis results are displayed simultaneously in a tabular view, geospatial view, and lexicon histogram.

Abstract: Methods and systems for processing events are disclosed. According to one embodiment, input source data that includes event data of one or more events is received. One or more event definitions that match the event data are selected. For each matching event definition, the event definition is inputted into a template to generate a set of events. The template includes a number of assertions and has the event definition as one of the assertions, where each assertion includes a constraint. The constraints of the assertions are progressively processed to produce one or more solutions that are subsets of the set of events. For each constraint and each solution, a set of target events that is viable for the solution is identified, and a new solution is produced based on the solution and the identified set of target events, whereby a set of new solutions is produced.

Abstract: The present invention is a method or system of analyzing items to create a data structure using lexicon analysis and filtering process. The present invention drives the analysis without a user being required to provide search terms and Boolean queries. Further, the present invention merges the use of unstructured data and structured data using a lexicon as a focus. Structured data is mapped to lexicon terms through one analysis process, while unstructured data is mapped to lexicon terms through a separate analysis process. In some disclosed embodiments, the mapping process uses a tuple structure of the source data to match with lexicon terms. The result is an analysis that merges the two different sets of data, which enables a user to navigate through the items using lexicons. Analysis results are displayed simultaneously in a tabular view, geospatial view, and lexicon histogram.

Abstract: The present invention is a method or system of generating statistical distributions using lexicon analysis and filtering process. The present invention drives the analysis without a user being required to provide search terms and Boolean queries. Further, the present invention merges the use of unstructured data and structured data using a lexicon as a focus. Structured data is mapped to lexicon terms through one analysis process, while unstructured data is mapped to lexicon terms through a separate analysis process. The result is an analysis that merges the two different sets of data, which enables a user to navigate through the items using lexicons. Analysis results are displayed simultaneously in a tabular view, geospatial view, and lexicon histogram.

Abstract: The present invention is a method or system of analyzing items using lexicon analysis and filtering process. The present invention drives the analysis without a user being required to provide search terms and Boolean queries. Further, the present invention merges the use of unstructured data and structured data using a lexicon as a focus. Structured data is mapped to lexicon terms through one analysis process, while unstructured data is mapped to lexicon terms through a separate analysis process. The result is an analysis that merges the two different sets of data, which enables a user to navigate through the items using lexicons. Analysis results are displayed simultaneously in a tabular view, geospatial view, and lexicon histogram.

Abstract: The present invention is a method or system of analyzing items using lexicon analysis and filtering process. The present invention drives the analysis without a user being required to provide search terms and Boolean queries. Further, the present invention merges the use of unstructured data and structured data using a lexicon as a focus. Structured data is mapped to lexicon terms through one analysis process, while unstructured data is mapped to lexicon terms through a separate analysis process. The result is an analysis that merges the two different sets of data, which enables a user to navigate through the items using lexicons. Analysis results are displayed simultaneously in a tabular view, geospatial view, and lexicon histogram.

Abstract: According to one embodiment, an electronic device may be configured to perform temporal correlation operations to determine if a plurality of observables correspond to an event of interest. The electronic device comprises a memory and a processor. The memory is adapted to store information representing a process template for the event, where the process template including a plurality of observation states. The processor is coupled to the memory. The processor is adapted to receive a plurality of observables, even in non-chronological order, and to conduct a recursive comparison of time values associated with each of the plurality of observables to timing ranges associated with each observation state to determine if the plurality of observables are associated with the event.

Abstract: According to one embodiment of the invention, software operating as a state machine may be implemented within a digital device to support out-of-ordering processing of events by the state machine. Upon execution of the software by a processor, the following operations are performed. First, a determination is made if an incoming event is a transition, and if so, if the transition is not a transition associated with the current state of the state machine, but rather, is out-of-order from a predetermined order of transitions supported by the state machine. Upon determining that the transition is out-of-order, a determination is made whether the transition is to a reachable state such as a state prior to the current state of the state machine or to a future state from the current state. If so, the transition is allowed to be undertaken.

Abstract: According to one embodiment, an electronic device may be configured to perform temporal correlation operations to determine if a plurality of observables correspond to an event of interest. The electronic device comprises a memory and a processor. The memory is adapted to store information representing a process template for the event, where the process template including a plurality of observation states. The processor is coupled to the memory. The processor is adapted to receive a plurality of observables, even in non-chronological order, and to conduct a recursive comparison of time values associated with each of the plurality of observables to timing ranges associated with each observation state to determine if the plurality of observables are associated with the event.

Abstract: According to one embodiment, an electronic device may be configured to perform temporal correlation operations to determine if a plurality of observables correspond to a selected event of interest. The electronic device comprises a memory and a processor. The memory is adapted to store information representing a process template for a selected event, where the process template including a plurality of observation states. The processor is coupled to the memory. The processor is adapted to receive a plurality of observables and to automatically conduct a recursive comparison of time values associated with each of the plurality of observables to timing ranges associated with each observation state to produce a listing that is subsequently used to determine if the plurality of observables are associated with the selected event.

Abstract: According to one embodiment, an electronic device may be configured to perform temporal correlation operations to determine if a plurality of observables correspond to a selected event of interest. The electronic device comprises a memory and a processor. The memory is adapted to store information representing a process template for a selected event, where the process template including a plurality of observation states. The processor is coupled to the memory. The processor is adapted to receive a plurality of observables and to automatically conduct a recursive comparison of time values associated with each of the plurality of observables to timing ranges associated with each observation state to produce a listing that is subsequently used to determine if the plurality of observables are associated with the selected event.

Abstract: According to one embodiment of the invention, software operating as a state machine may be implemented within a digital device to support out-of-ordering processing of events by the state machine. Upon execution of the software by a processor, the following operations are performed. First, a determination is made if an incoming event is a transition, and if so, if the transition is not a transition associated with the current state of the state machine, but rather, is out-of-order from a predetermined order of transitions supported by the state machine. Upon determining that the transition is out-of-order, a determination is made whether the transition is to a reachable state such as a state prior to the current state of the state machine or to a future state from the current state. If so, the transition is allowed to be undertaken.