COGNITIVE MODELING APPARATUS FOR DEFUZZIFICATION OF MULTIPLE QUALITATIVE SIGNALS INTO HUMAN-CENTRIC THREAT NOTIFICATIONS
The present design is directed to a system for defuzzification of multiple qualitative signals into human-centric threat notifications using cognitive computing techniques, including a series of periodic execution components configured to operate over full or partial sets of received data, and a plurality of event reception components configured to operate on each event in a stream relevant to a terrain and selectively provide information to the series of periodic execution components. The system detects and signals anomalies upon detecting behavior inconsistent with normal behavior.
1 . A system for defuzzification of multiple qualitative signals into human-centric threat notifications using cognitive computing techniques, comprising:
a series of periodic execution components configured to operate over full or partial sets of received data; and
a plurality of event reception components configured to operate on each event in a stream relevant to a terrain and selectively provide information to the series of periodic execution components;
wherein the system detects and signals anomalies upon detecting behavior inconsistent with normal behavior.
2 . The system of claim 1 , wherein an anomaly has properties including severity and degree of inconsistency from normal behavior represented by mathematical distance, wherein severity is a class of anomaly assigned by an analytical component that detected and measured the anomaly.
3 . The system of claim 1 , wherein the system detects and signals hazards, wherein a hazard is an unperfected threat associated with an actor without regard to any related assets or the behavior of other actors.
4 . The system of claim 3 , wherein a hazard represents risk to an enterprise based on cumulative multi-dimensional behaviors comprising anomalous states generated from thresholds, orders of operation, peer-to-peer similarity, and actor behavior change over time.
5 . The system of claim 4 , wherein a hazard has two properties comprising severity of medium, elevated or high, derived from inherent terrain risks.
6 . The system of claim 3 , wherein the system detects and signals threats, wherein a threat is a perfected threat that ties together actors with behaviors of other actors and assets used by all actors in a hazard collection.
7 . The system of claim 5 , wherein:
threats develop a sequence of operations over a dynamic time-frame; and
threats are connected in a heterogeneous graph comprising nodes and edges, wherein nodes can be actors or assets and edges define the dynamic time-frame as well as the strength of their connection as a function of risk.
8 . A system, comprising:
a series of periodic execution components configured to operate over full or partial sets of received data;
a plurality of event reception components configured to operate on each event in a stream relevant to a terrain and selectively provide information to the series of periodic execution components; and
a signal manager configured to manage signals for one of the series of periodic execution components and the plurality of event reception components;
wherein the system performs defuzzification of multiple qualitative signals into human-centric threat notifications using cognitive computing techniques by detecting and signaling anomalies upon detecting behavior inconsistent with normal behavior.
9 . The system of claim 8 , wherein an anomaly has properties including severity and degree of inconsistency from normal behavior represented by mathematical distance, wherein severity is a class of anomaly assigned by an analytical component that detected and measured the anomaly.
10 . The system of claim 8 , wherein the system detects and signals hazards, wherein a hazard is an unperfected threat associated with an actor without regard to any related assets or the behavior of other actors.
11 . The system of claim 10 , wherein a hazard represents risk to an enterprise based on cumulative multi-dimensional behaviors comprising anomalous states generated from thresholds, orders of operation, peer-to-peer similarity, and actor behavior change over time.
12 . The system of claim 11 , wherein a hazard has two properties comprising severity of medium, elevated or high, derived from inherent terrain risks.
13 . The system of claim 10 , wherein the system detects and signals threats, wherein a threat is a perfected threat that ties together actors with behaviors of other actors and assets used by all actors in a hazard collection.
14 . The system of claim 12 , wherein:
threats develop a sequence of operations over a dynamic time-frame; and
threats are connected in a heterogeneous graph comprising nodes and edges, wherein nodes can be actors or assets and edges define the dynamic time-frame as well as the strength of their connection as a function of risk.
15 . A system, comprising:
a series of periodic execution components configured to operate over full or partial sets of received data;
a plurality of event reception components configured to operate on each event in a stream relevant to a terrain and selectively provide information to the series of periodic execution components; and
a threat detector configured to detect threats based on information provided by the series of periodic execution components and the plurality of event reception components;
wherein the system performs defuzzification of multiple qualitative signals into human-centric threat notifications using cognitive computing techniques by detecting and signaling anomalies upon detecting behavior inconsistent with normal behavior.
16 . The system of claim 15 , wherein an anomaly has properties including severity and degree of inconsistency from normal behavior represented by mathematical distance, wherein severity is a class of anomaly assigned by an analytical component that detected and measured the anomaly.
17 . The system of claim 15 , wherein the system detects and signals hazards, wherein a hazard is an unperfected threat associated with an actor without regard to any related assets or the behavior of other actors.
18 . The system of claim 17 , wherein a hazard represents risk to an enterprise based on cumulative multi-dimensional behaviors comprising anomalous states generated from thresholds, orders of operation, peer-to-peer similarity, and actor behavior change over time.
19 . The system of claim 18 , wherein a hazard has two properties comprising severity of medium, elevated or high, derived from inherent terrain risks.
20 . The system of claim 17 , wherein the threat detector operates with the series of periodic execution components and the plurality of event reception components to detect and signal threats, wherein a threat is a perfected threat that ties together actors with behaviors of other actors and assets used by all actors in a hazard collection.