Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: Disclosed, in one general aspect, is a computer network security monitoring method that includes continuously gathering and storing machine-readable identity information records of different types for different individuals, and continuously deriving and storing general-purpose blended identity risk profiles for the individuals based on the continuously gathered machine-readable identity information records of the different types.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: A computer security monitoring system and method are disclosed that feature, in one general aspect, monitoring on an ongoing basis for evidence of the presence of infected systems in one or more networks that are each associated with a monitored organizational entity possessing digital assets, continuously updating risk profiles for the entities based on information about intrusion features from the monitoring, aggregating risk scores for the entities, and electronically reporting the aggregated risk score to an end user. In another general aspect, a method is disclosed that includes acquiring and storing data relating to interactions with malware controllers over a public network, acquiring and storing a map of relationships between networks connected to the public network, extracting risk data from the stored interaction data and the stored relationship map by cross-referencing the acquired interaction data against the map of relationships, and issuing security alerts based the extracted risk data.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: Computer security systems and methods are disclosed. In one general aspect, a computer security monitoring method is disclosed that includes continuously gathering machine-readable facts relating to a number of topics and continuously deriving and storing risk profiles for a plurality of monitored entities based on at least some of the facts. This method also includes providing an ontology that associates a different subset of the monitored entities to each of a plurality of organizational entities possessing digital assets, aggregating the risk scores for the scored entities for each of the organizational entities based on the associations in the ontology to derive an aggregated risk score, and electronically reporting the aggregated risk score to an end user.

Abstract: In one general aspect, a network security system is disclosed that includes a network interface operative to connect the system to a public wide area network and a first malicious activity detection subsystem operatively connected to the network interface and operative to extract from textual sources on the network different threat levels in a first threat category for each of at least some addresses on the wide area network. One or more further malicious activity detection subsystems are operatively connected to the network interface and operative to extract from textual sources on the network different threat levels in each of one or more further threat categories for each of at least some addresses on the wide area network.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, an interactive event-based information system is disclosed that includes an event-based data store for storing information about events selectively extracted from a plurality of machine-readable information sources. A live feed extraction interface is responsive to the event-based data store and has a feed publication output operative to publish a live feed of selected information about events. A live event feed user interface includes a live feed display interface operative to present a succession of visual information elements corresponding to events covered in the live event feed, and a drill-down interface responsive to user interaction to provide access to further information about the information elements from the data store.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: In one general aspect, a wide area network fact information service method is disclosed. This method includes storing a plurality of canonical fact entries, storing one or more fact descriptor entries for each of the canonical fact entries, and ranking the canonical fact entries relative to each other based on the descriptor entries.

Abstract: A primary graphical input device such as a scroll bar or slider is displayed in order to allow graphical input and adjustment of at least one parameter, such as the page number of a displayed document in a word-processing program or a range value in a data visualization routine. Whenever a user activates the graphical input device, the user may set and change the parameter not only purely graphically, as in conventional applications, for example by dragging some portion of the primary device by moving a mouse, but also by entering a specific value into the secondary graphical input device, for example, via a keyboard. The invention thus provides an intuitive way for a user to quickly and easily navigate graphical objects not only by using pointing devices, but also by entering alphabetic or numeric input, all while maintaining the inherent advantages of “point and click” graphical displays.

Abstract: Open, horizontal service platforms are described. Service providers can, via network operators, load software associated with a service onto a dedicated, service platform server. The service platform server is connected, via a LAN, to one or more remote devices (e.g., sensors, transducers, processors, etc.). The functionality associated with the service can be distributed among two or more of the entities involved in the architecture. The distributed software operates and/or monitors these remote devices to implement the subscribed service.

Abstract: Open, horizontal service platforms are described. Service providers can, via network operators, load software associated with a service onto a dedicated, service platform server. The service platform server is connected, via a LAN, to one or more remote devices (e.g., sensors, transducers, processors, etc.). The functionality associated with the service can be distributed among two or more of the entities involved in the architecture. The distributed software operates and/or monitors these remote devices to implement the subscribed service.

Abstract: A main processing system accesses a data base, which contains data records, each of which is divided into data fields. The system preferably automatically determine the type of data in each field, as well as its range of values. It then preferably determines one or more relational structures of the field data using a corresponding number of relevance measures. For each field, a preferably user-adjustable, software-generated query device is displayed, preferably in the order of the relevance measures of the respective fields. The plot of one or more fields' data relative to that of another field is initially generated using the fields in order of relevance. The relevance measure forming the basis of the field ordering, the order of fields, and the ranges of the plotted, displayed fields may be adjusted interactively by the user by moving and adjusting the various query devices.