System, method, and computer program product for applying a rule to associated events
View Patent ↗A system, method, and computer program product are provided for applying a rule to associated events. In use, a plurality of events is associated based on at least one identifier. Additionally, at least one rule is applied to the associated events. Further, a reaction is performed based on the application of the at least one rule.
1. A computer program product, embodied on a non-transitory computer readable medium, for performing operations comprising:
determining whether a first event including a first communication of data satisfies a predefined rule;
scoring the first event to produce a first result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the first event;
identifying a second event based on an identifier of the first event and an identifier of the second event, wherein the second event includes a second communication of data separate from the first communication of data;
scoring the second event to produce a second result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the second event;
determining whether an aggregate score of the first and second results exceeds a threshold indicated in the predefined rule, in response to a determination that a time between an identification of the first event and the identifying the second event is within a temporal proximity; and
performing a reaction in response to a determination that the aggregate score of the first and second results exceeds the threshold indicated in the predefined rule.
2. The computer program product of claim 1 , wherein at least one of the first and second events includes posting data on a web page.
3. The computer program product of claim 1 , wherein the reaction includes blocking at least one of the first and second events.
4. The computer program product of claim 1 , wherein the reaction includes quarantining at least one of the first and second events.
5. The computer program product of claim 1 , wherein the identifier of the first event is a domain common with the identifier of the second event.
6. The computer program product of claim 1 , the operations further comprising:
scanning the first and second events utilizing a plurality of predefined rules for determining whether the first and second events satisfy any of the plurality of predefined rules.
7. The computer program product of claim 1 , wherein the threshold includes a predetermined number of instances of a type of content of the first and second events.
8. The computer program product of claim 1 , wherein the first and second events are originated by different devices.
9. The computer program product of claim 1 , wherein the identifier of the first event and the identifier of the second event each include an Internet protocol (IP) address.
10. The computer program product of claim 1 , wherein the first and second communications are e-mail communications.
11. The computer program product of claim 1 , wherein the identifier of the first event is an address of a source of the first event, and the identifier of the second event is an address of a source of the second event.
12. The computer program product of claim 1 , wherein the identifier of the first event is an address of a destination of the first event, and the identifier of the second event is an address of a destination of the second event.
13. The computer program product of claim 1 , wherein the identifier of the first event is an email address common with the identifier of the second event.
14. A security system, comprising:
a processor coupled to a memory, wherein
the processor is configured to
determine whether a first event including a first communication of data satisfies a predefined rule;
score the first event to produce a first result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the first event;
identify a second event based on an identifier of the first event and an identifier of the second event, wherein the second event includes a second communication of data separate from the first communication of data;
score the second event to produce a second result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the second event;
determine whether an aggregate score of the first and second results exceeds a threshold indicated in the predefined rule, in response to a determination that a time between an identification of the first event and an identification of the second event is within a temporal proximity; and
perform a reaction in response to a determination that the aggregate score of the first and second results exceeds the threshold indicated in the predefined rule.
15. The security system of claim 14 , wherein the identifier of the first event is an address of a source of the first event, and the identifier of the second event is an address of a source of the second event.
16. The security system of claim 14 , wherein the identifier of the first event is an address of a destination of the first event, and the identifier of the second event is an address of a destination of the second event.
17. The security system of claim 14 , wherein the identifier of the first event is an email address common with the identifier of the second event.
18. A method to be performed in conjunction with a processor and a memory, the method comprising:
determining whether a first event including a first communication of data satisfies a predefined rule;
scoring the first event to produce a first result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the first event;
identifying a second event based on an identifier of the first event and an identifier of the second event, wherein the second event includes a second communication of data separate from the first communication of data;
scoring the second event to produce a second result based on at least one of a social security number, an account number, a birthdate, a name, and an account name included in the second event;
determining whether an aggregate score of the first and second results exceeds a threshold indicated in the predefined rule, in response to a determination that a time between an identification of the first event and the identifying the second event is within a temporal proximity; and
performing a reaction in response to a determination that the aggregate score of the first and second results exceeds the threshold indicated in the predefined rule.
19. The method of claim 18 , wherein the identifier of the first event is an address of a source of the first event, and the identifier of the second event is an address of a source of the second event.
20. The method of claim 18 , wherein the identifier of the first event is an address of a destination of the first event, and the identifier of the second event is an address of a destination of the second event.