Systems and methods for using cognitive fingerprints

Patent metadata

Field	Value
Publication number	US-9578053-B2
Application number	US-201514683735-A
Country	US
Kind code	B2
Filing date	Apr 10, 2015
Priority date	Apr 10, 2014
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

A system and method for creating a core cognitive fingerprint. A core cognitive fingerprint can be used to capture the evolution of a system state and potentially respond with a predetermined action if the fingerprint falls within a threshold. The method includes: identifying a set of time frames within which data is extracted; providing a plurality of pattern recognizers; processing the extracted data through the plurality of pattern recognizers to generate an initial set of elements; extracting identified relationships amongst the initial set of elements; modifying the initial set of elements to include the identified relationships to create an intermediate set of elements; comparing the intermediate set of elements against assigned values to weigh each element in the intermediate set of elements to create a final set of elements; and using the final set of elements as a cognitive fingerprint.

First claim

The invention claimed is:

1. A computer implemented method of constructing a cognitive fingerprint, comprising:
identifying a set of time frames, each time frame corresponding to a respective data source, within which data is extracted from the data source by a computer system;
providing a plurality of pattern recognizers each having an assigned heuristic;
processing, by the computer system, a combined stream of extracted data through the plurality of pattern recognizers to generate an initial set of elements, each element corresponding to the output of the heuristic assigned to each pattern recognizer;
extracting identified relationships amongst the initial set of elements;
modifying the initial set of elements to include the identified relationships to create an intermediate set of elements;
comparing, by the computer system, the intermediate set of elements against assigned weight values to emphasize or deemphasize each element in the intermediate set of elements to create a final set of elements, wherein the final set of elements forms a cognitive fingerprint representing a signature of the data extracted from the time frame;
comparing, by the computer system, the cognitive fingerprint to a previously recorded cognitive fingerprint by taking a sum of squared differences between each element in the final set of elements and each element of the previously recorded cognitive fingerprint to determine a scalar value;
comparing, by the computer system, the scalar value to a threshold of a target goal; and
one or more of shutting down the computer system or quarantining at least a portion of the extracted data in response to the scalar value being within the threshold of the target goal.

2. The computer implemented method of claim 1 , wherein the identified relationships include equality, correlation, mapping via function, and magnitude comparison.

3. The computer implemented method of claim 1 , wherein the assigned weight values are adjusted by system learning.

4. The computer implemented method of claim 1 , wherein each heuristic is specified to content type.

5. The computer implemented method of claim 1 , further comprising using the cognitive fingerprint to correlate messages by content, links, and payloads.

6. The computer implemented method of claim 1 , further comprising using the cognitive fingerprint as a temporal security signature of an individual based on their past usage of the system.

7. The computer implemented method of claim 1 , further comprising sending an email alert to the system administrator in response to the scalar value being within the threshold of the target goal.

8. A computer system comprising:
a hardware processors;
a memory communicatively coupled to the hardware processors and having stored thereon a program of instructions, the instructions configured to, when read and executed by the hardware processors:
identify a set of time frames, each time frame corresponding to a respective data source, within which data is extracted from the data source;
provide a plurality of pattern recognizers each having an assigned heuristic;
process a combined stream of extracted data through the plurality of pattern recognizers to generate an initial set of elements, each element corresponding to the output of the heuristic assigned to each pattern recognizer;
extract identified relationships amongst the initial set of elements;
modify the initial set of elements to include the identified relationships to create an intermediate set of elements;
compare the intermediate set of elements against assigned weight values to emphasize or deemphasize each element in the intermediate set of elements to create a final set of elements, wherein the final set of elements forms a cognitive fingerprint representing a signature of the data extracted from the time frame;
compare the cognitive fingerprint to a previously recorded cognitive fingerprint by taking a sum of squared differences between each element in the final set of elements and each element of the previously recorded cognitive fingerprint to determine a scalar value;
compare, by the computer system, the scalar value to a threshold of a target goal; and
one or more of shut down the computer system or quarantine at least a portion of the extracted data in response to the scalar value being within the threshold of the target goal.

9. The computer system of claim 8 , wherein the identified relationships include equality, correlation, mapping via function, and magnitude comparison.

10. The computer system of claim 8 , wherein the assigned weight values are adjusted by system learning.

11. The computer system of claim 8 , wherein each heuristic is specified to content type.

12. The computer system of claim 8 , further comprising using the cognitive fingerprint to correlate messages by content, links, and payloads.

13. The computer system of claim 8 , further comprising using the cognitive fingerprint as a temporal security signature of an individual based on their past usage of the system.

14. The computer system of claim 8 , the instructions configured to, when read and executed by the hardware processors, send an email alert to the system administrator in response to the scalar value being within the threshold of the target goal.

Assignees

• Sparkcognition Inc

Inventors

• Husain Syed Mohammad Amir
• Abel Martin Andreas

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title