System and Method for Generation of a Heuristic

Abstract

A system and method for generating a heuristic is provided. A heuristic is capable of identifying data patterns. The method includes: extracting a data set from multiple input sources; creating a set of unique elements used across the data set; organizing the data set into a geometric structure; grouping portions of the data in the geometric structure into a plurality sub geometric structures; determining base attributes for each sub geometric structure using the set of unique elements; identifying trends in the base attributes among the sub geometric structures; and outputting the heuristic as a combination of the base attributes and the trends.

Description

BACKGROUND OF THE INVENTION[0001]1. Field of the Invention[0002]The present invention relates to a system and method for generating a heuristic that is capable of identifying data patterns. More particularly, the present invention relates to a system and method for automatically creating a heuristic to be used in conjunction with a cognitive fingerprinting system and method.[0003]2. Description of the Related Art[0004]In the security field, most anti-virus (AV) products rely on pre-computed signatures to identify viruses and threats. However, there is not always enough time for a threat to be found and analyzed, a signature engineered, and an update delivered to users before they are targeted.[0005]Similarly, methods are needed to prevent data theft by unauthorized users. For example, if login credentials for an individual user fall into unauthorized hands, the party possessing these credentials may be able to log into a system or network for which these credentials provide access, ...

AI Technical Summary

Benefits of technology

The present invention provides a method and computer system for creating a heuristic that can identify data patterns. This heuristic works with a cognitive fingerprinting method to identify and respond to pre-defined goals by analyzing system data. The method involves extracting data from multiple sources, organizing the data into a geometric structure, grouping parts of the data into sub-structures, identifying trends in those sub-structures, and outputting the heuristic as a combination of unique elements and trends. This allows for the identification of data patterns and improved efficiency and accuracy in detecting abnormal events in computer systems.

Problems solved by technology

However, there is not always enough time for a threat to be found and analyzed, a signature engineered, and an update delivered to users before they are targeted.

Thus, there exists a need to detect the scenario where legitimate login credentials are being utilized by unauthorized persons, particularly when the theft of data is “subtle” and occurs over a period of time.

Multi-factor authentication schemes such as retina and fingerprint scans address the issue of validating identity, however they can be defeated or circumvented when an authorized user indulges in unauthorized removal or theft of information.

Additionally, it can be cost-prohibitive to put such defenses in a typical business network at all entry points, such as desktop computers, mobile endpoints and Thin clients.

Recently, there have been a number of high-profile incidents where an authorized user engages in behavior beyond the scope of their authorization and subsequently steals and releases confidential information.

While access control limitations such as attaching permissions to data exist, these protections do not protect widespread data theft when a user has legitimate access to the data.

But in practice, this generality can impose penalties in the form of slower learning processes and the necessity of creating “deep” structures in order to capture enough pattern information that would allow the system to deliver meaningful results and subsequent recognition.

In many instances, approaches like ILP lack flexibility because they require a lot of domain specific information, customization and may not scale to handle variations of problems from adjacent domains.

Images