Pervasive, domain and situational-aware, adaptive, automated, and coordinated big data analysis, contextual learning and predictive control of business and operational risks and security

Abstract

Real time security, integrity, and reliability postures of operational (OT), information (IT), and security (ST) systems, as well as slower changing security and operational blueprint, policies, processes, and rules governing the enterprise security and business risk management process, dynamically evolve and adapt to domain, context, and situational awareness, as well as the controls implemented across the operational and information systems that are controlled. Embodiments of the invention are systematized and pervasively applied across interconnected, interdependent, and diverse operational, information, and security systems to mitigate system-wide business risk, to improve efficiency and effectiveness of business processes and to enhance security control which conventional perimeter, network, or host based control and protection schemes cannot successfully perform.

1 . A computer-implemented method, comprising:
 in an enterprise-wide computer network comprising a plurality of applications and processes distributed over a plurality of domains, representing elemental processes in each domain as a network supporting exchange of a transaction value that represent operational events or actions;   acquiring data representing monitoring of input and output values, messages, and events to and from said enterprise-wide network;   organizing said data into corresponding hierarchies of tabular and networked graph data sets;   aggregating and composing the data organized in said tabular and networked graph data sets into higher level functional, structural, and temporal metric sets;   organizing said higher level functional, structural, and temporal metric sets into corresponding structural, functional, and temporal hierarchies of tabular and networked graph metric sets;   identifying statistically significant patterns and learning correlations, associations, and dependencies in said organized tabular and networked graph metric sets;   extracting and combining statistical patterns, associations, correlations, and hierarchical network features as contextual information specifying a context of said tabular and networked graph metric sets;   combining said tabular and networked graph metric sets and said contextual information to generate contextual metrics comprising situational intelligence across said enterprise-wide network;   synthesizing said situational intelligence, said domain knowledge, said tabular and networked graph metric sets, and said contextual information into dynamic situational knowledge across said enterprise-wide network;   inferring normative and anomalous distribution features of said tabular and networked graph metric sets in enterprise systemic context across connected tabular and networked graph metric sets of each network and across multiple dimensions of transactions representing patterns of operational events and activities;   inferring a dynamic sequence of operational and information system states of the enterprise-wide network using said contextual information and analyzing sequences of said tabular and networked graph metric sets; and   based on said inferred dynamic sequence of operational and information system states, performing pervasive and persistent risk and operational efficiency analysis and adapting to evolving situational knowledge and intelligence across the enterprise-wide network.