DISTRIBUTED DYNAMIC DETECTION OF SIGNATURES FROM ENTITY INDICATORS

摘要

Autonomous computational processes (“agents”) representing application-specific domain entities are provided with application-independent methods and data structures to monitor one or more streams of behavioral indicator data observed in their respective entities and detect and report the presence of application-defined patterns of satisfied constraints (signatures) in real time. The invention specifies two agent populations, one (“Host Agents”) representing each domain entity with a dedicated agent that maintains current signature detection probabilities (and their constraint components), the other (“Indicator Agents”) continuously monitoring the behavioral indicator data and updating constraint satisfaction and signature detection probabilities.

主权项

1. A method of continuously monitoring a stream of values of various application-specific behavioral indicators of domain entities and detecting the occurrence of application-defined patterns (signatures) in the entity behavior in a distributed and decentralized computational or physical environment, comprising the steps of:
associating application-specific domain entities as producers of values of behavioral indicators with autonomous software Host Agents, each Host Agent being operative to perform independent processes, the processes including a Knowledge Management process and an Arrangement Process; associating application-specific signatures to be detected with one or more constraints defined on the value of a specific indicator, where the probability of detection of the signature is a function of the probability of satisfaction of each indicator constraint in that signature; associating each indicator constraint of each signature with one or more autonomous software Indicator Agents, each Indicator Agent being operative to perform independent processes, the processes including a Movement Decision process and a Host Agent Interaction Process; and continuously and repeatedly executing the processes by the agents to maintain up-to-date probability estimates for the presence of specific signatures in the behavior of domain entities in accordance with the requirements of an application.