Runtime thresholds for behavior detection

1 . A computer based method for detecting a behavior, the method comprising:

receiving data from at least one source;

determining an application environment corresponding to the data;

retrieving a scenario, wherein the scenario comprises one or more parameterized patterns indicative of one or more behaviors;

retrieving one or more parameter sets applicable to the one or more parameterized patterns, wherein each parameter set comprises one or more parameters;

selecting one of the one or more parameter sets based on the application environment;

forming a dataset, wherein the dataset includes a portion of the received data, one or more events and one or more entities; and

detecting one or more matches between the dataset and the one or more parameterized patterns with the selected parameter set.

2 . The method of claim 1 wherein detecting one or more matches comprises:

performing sequence matching to identify sequences in the one or more events; and

relating those sequences to the one or more entities in the dataset.

3 . The method of claim 1 wherein detecting one or more matches comprises one or more of the following:

performing link analysis to establish connections between a plurality of entities and events in the dataset;

performing rule-based analysis to identify one or more entities and one or more events in the dataset based on rules specifying parameters and thresholds; and

performing outlier detection analysis to identify at least one event and at least one entity outside of a defined range.

4 . The method of claim 1 , further comprising:

generating one or more alerts based on the existence of one or more matches.

5 . The method of claim 1 , further comprising:

generating one or more reports based on the existence of one or more matches.

6 . A computer readable medium embodying program instructions for detecting a behavior, the computer readable medium comprising instructions for:

receiving data from at least one source;

determining an application environment corresponding to the data;

retrieving a scenario, wherein the scenario comprises one or more parameterized patterns indicative of one or more behaviors;

retrieving one or more parameter sets applicable to the one or more parameterized patterns, wherein each parameter set comprises one or more parameters;

selecting one of the one or more parameter sets based on the application environment;

forming a dataset, wherein the dataset includes a portion of the received data, one or more events and one or more entities; and

detecting one or more matches between the dataset and the one or more parameterized patterns with the selected parameter set.

7 . The computer readable medium of claim 6 wherein the detecting one or more matches comprises instructions for one or more of the following:

performing sequence matching to identify sequences in the one or more events in the dataset and relating those sequences to the one or more entities in the dataset;

performing link analysis to establish connections between a plurality of entities and events in the dataset;

performing rule-based analysis to identify one or more entities and one or more events in the dataset based on rules specifying parameters and thresholds; and

performing outlier detection analysis to identify at least one event and at least one entity outside of a defined range.

8 . The computer readable medium of claim 6 , further comprising instructions for:

generating one or more alerts based on the existence of one or more matches.

9 . The computer readable medium of claim 6 , further comprising instructions for:

generating one or more reports based on the existence of one or more matches.

10 . The computer readable medium of claim 6 wherein the medium comprises one or more of magnetic data storage disks, magnetic tape, alterable electronic read-only memory, non-alterable electronic read-only memory, electronic random-access memory, flash memory, optical storage devices, wired communication links, wired transmission media, wired propagated signal media, wireless communication links, wireless transmission media, and wireless propagated signal media.

11 . A system for detecting a behavior, the system comprising:

a processor having circuitry to execute instructions;

a communications interface, in communication with the processor, for receiving data from at least one source;

a memory, in communication with the processor, for storing instructions for:

determining an application environment corresponding to the data;

retrieving a scenario, wherein the scenario comprises one or more parameterized patterns indicative of one or more behaviors;

retrieving one or more parameter sets applicable to the one or more parameterized patterns, wherein each parameter set comprises one or more parameters;

selecting one of the one or more parameter sets based on the application environment;

forming a dataset, wherein the dataset includes a portion of the received data, one or more events and one or more entities; and

detecting one or more matches between the dataset and the one or more parameterized patterns with the selected parameter set.

12 . A method for configuring parameter sets for detection scenarios, the method comprising:

retrieving a base parameter set comprising one or more parameters for use in a detection scenario and a default value for each parameter;

generating one or more derived parameter sets, wherein each derived parameter set includes at least one parameter from the base parameter set;

setting at least one parameter in each derived parameter set to a value different than the default value for the corresponding parameter in the base parameter set; and

specifying, for each derived parameter set, an application environment to which the derived parameter set applies.

13 . The method of claim 12 wherein at least one parameter applies to a pattern defined in the detection scenario.

14 . The method of claim 12 wherein at least one parameter applies to a dataset defined in the detection scenario.