Data trend analysis

摘要

According to an example, a method for data trend analysis may include retrieving data from data sources, associating the data with a time, and identifying co-occurrences of terms and concepts within the data. In response to determining that co-occurrences of term and concept pairs reach a predefined threshold, the method may include adding the term and concept pairs to an ontology. The method may include logging occurrences of terms in the ontology within the data with respect to associated data times, identifying a plurality of time periods, and for one of the plurality of time periods and for the logged terms, determining a first score indicative of a weighted term frequency metric for a logged term within the data during the one time period, and determining a second score indicative of a commonality of a presence of the logged term within the data among the plurality of time periods.

主权项

1. A method for cyber security threat related data trend analysis, the method comprising:
retrieving, over a computer network, cyber security threat related data from at least one data source; associating the cyber security threat related data with a time; identifying, by a hardware processor, co-occurrences of terms and concepts within the cyber security threat related data; in response to determining that co-occurrences of term and concept pairs reach a predefined threshold, adding the term and concept pairs to an ontology; logging occurrences of terms in the ontology within the cyber security threat related data with respect to associated data times; identifying a plurality of time periods; for one of the plurality of time periods and for the logged terms:
determining, by the hardware processor, a first score indicative of a weighted term frequency metric for a logged term within the cyber security threat related data during the one time period by
determining a logarithm of a count of occurrences of the logged term within the cyber security threat related data during the one time period, anddetermining, by the hardware processor, a second score indicative of a commonality of a presence of the logged term within the cyber security threat related data among the plurality of time periods; using the first and second scores to determine a cyber security threat trend; monitoring the at least one data source or another source related to the at least one data source based on the determined cyber security threat trend; and generating, based on the monitoring, a report indicative of the cyber security threat trend related to the cyber security threat related data.