Apparatus and method for linguistic scoring
View Patent ↗In embodiments of the invention, a system receives selections from a user based on a list of pre-defined monitoring categories and/or optionally receives custom category definitions from the user. The option for custom category definitions may be advantageous due to the flexibility provided to a system administrator or other user. In embodiments of the invention, the pre-defined and/or custom monitoring categories may be or include complex hierarchical behavior. Such an approach provides monitoring algorithms that can achieve improved accuracy compared to known methods. In embodiments of the invention, the order of computations used in resolving a monitoring category may be re-ordered, statically and/or dynamically, to improve the efficiency of monitoring operations.
1. A method for linguistic analysis comprising:
receiving a user selection of at least one category from a list of categories, the categories including complex aggregate behavior associated with a plurality of triggers in a hierarchical relationship;
collecting data from at least one of a data stream, a file system, and a database;
scoring the data for the selected at least one category based on the complex aggregate behaviour; and
modifying the hierarchical relationship of triggers in response to at least one of the plurality of triggers causing an early exit.
2. The method of claim 1 , further comprising:
receiving a custom category definition from the user; and
scoring the data based on the custom category definition.
3. The method of claim 2 , wherein the custom category is dependent upon the user-selected category.
4. The method of claim 1 , wherein scoring the data includes generating a score associated with the user-selected category, and further comprising:
determining whether the user-selected category is a hit based on the score; and
performing at least one action when it is determined that the user-selected category is a hit.
5. The method of claim 4 , wherein determining whether the user-selected category is a hit is based on at least one of threshold scoring and Boolean logic scoring.
6. The method of claim 4 , wherein the action comprises at least one of blocking access, alerting an administrator, and logging data.
7. The method of claim 1 , wherein scoring the data comprises a plurality of computations; and the method further comprises dynamically re-ordering the computations.
8. The method of claim 1 , wherein the complex aggregate behavior associates a score with each of the plurality of triggers.
9. The method of claim 8 , wherein the complex aggregate behavior applies at least one of an addition operator, a subtraction operator, a multiplication operator and a division operator to the score associated with at least one of the plurality of triggers.
10. The method of claim 8 , wherein the complex aggregate behavior applies a negation operator to the score associated with at least one of the plurality of triggers.
11. The method of claim 1 , wherein the complex aggregate behavior associates a pattern tuple with at least one of the plurality of triggers.
12. The method of claim 11 , further comprising simplifying the complex aggregate behavior by combining two or more triggers having the same associated pattern tuple.
13. The method of claim 1 , wherein the complex aggregate behavior associates a list of pre-requisite triggers, a score for each of the pre-requisite triggers, and a negation status with at least one of the plurality of triggers.
14. The method of claim 13 , further comprising simplifying the complex aggregate behavior by combining two or more triggers having the same associated list of pre-requisite triggers, the score for each of the pre-requisite triggers, and the negation status.
15. The method of claim 1 , wherein the complex aggregate behavior associates at least one of a plurality of actions with at least one of the plurality of triggers.
16. The method of claim 15 , further comprising simplifying the complex aggregate behavior by not resolving any of the plurality of triggers that are not associated with at least one of the plurality of actions.
17. A tangible machine-readable medium storing instructions which, when executed, cause a machine to at least:
receive a user selection of at least one category from a list of categories, the categories including complex aggregate behavior associated with a plurality of triggers in a hierarchical relationship;
collect data from at least one of a data stream, a file system, and a database;
score the data for the selected at least one category based on the complex aggregate behaviour; and
modify the hierarchical relationship of triggers in response to at least one of the plurality of triggers causing an early exit.
18. The tangible machine-readable medium of claim 17 , further storing instructions which, when executed, cause the machine to:
receiving a custom category definition from the user; and
scoring the data based on the custom category definition.
19. The tangible machine-readable medium of claim 18 , wherein the custom category is dependent upon the user-selected category.
20. The tangible machine-readable medium of claim 17 , wherein scoring the data includes generating a score associated with the user-selected category, and further storing instructions which, when executed, cause the machine to:
determining whether the user-selected category is a hit based on the score; and
performing at least one action when it is determined that the user-selected category is a hit.