SUMMARY OF THE INVENTION (From the patent document
Post# of 876
Posted On: 05/13/2015 11:22:30 PM
SUMMARY OF THE INVENTION (From the patent document)
The present invention improves upon heretofore known audit systems by providing a real-time, automated business process audit system, and more particularly a computerized business process audit system that detects anomalies and provides audit trails based on event data received from one or more sources.
The present invention in one embodiment can be characterized as a system for anomaly detection in structured sets of events. Such system employs a set of event listeners that collect raw event data, a correlator and a notification component. The notification component sends audit events comprised from raw events grouped and annotated with correlation attributes. These audit events are processed or logged on a downstream location.
The correlator loads the process definition from an external file. This file format can be any of the business process definition language formats available: XMI/BPMN/BPEL but not limited to those. The loaded process definition contains the cause-effect relationships between the events specified. Also it contains any guard conditions that are used to validate the events during the execution phase.
The event listeners can be real-time or historical and are configured using a mapping file. The real-time event listeners will trigger the correlation component immediately after an event was received. The historical event listeners simulate `virtual events` from historical storage (databases/logs/ . . . ) and will not trigger the correlation component.
In a variation of the system of the one embodiment, the system further employs a causal pattern detection layer that applies pattern expressions on the audit grouped raw events contained in the audit event. The result of the pattern expression evaluation is considered to be a filtered instance of a causal audit event. This filtered audit events are then pushed through a notification component to be sent for further processing on a downstream location.
In an additional variation of the system of the one embodiment, the system further employs a behavior analysis layer that monitors changes in the model associated to the audit event flow. This layer collects data to build a clustering model for the configured fields from the audit event. After enough data was collected and a model was built, without human intervention, this layer will signal when an input (audit) event can be considered as a large variation from the rules captured in the model. Periodically, when new data is available, this processing layer will update its model thus adapting to the changing environment.
The present invention improves upon heretofore known audit systems by providing a real-time, automated business process audit system, and more particularly a computerized business process audit system that detects anomalies and provides audit trails based on event data received from one or more sources.
The present invention in one embodiment can be characterized as a system for anomaly detection in structured sets of events. Such system employs a set of event listeners that collect raw event data, a correlator and a notification component. The notification component sends audit events comprised from raw events grouped and annotated with correlation attributes. These audit events are processed or logged on a downstream location.
The correlator loads the process definition from an external file. This file format can be any of the business process definition language formats available: XMI/BPMN/BPEL but not limited to those. The loaded process definition contains the cause-effect relationships between the events specified. Also it contains any guard conditions that are used to validate the events during the execution phase.
The event listeners can be real-time or historical and are configured using a mapping file. The real-time event listeners will trigger the correlation component immediately after an event was received. The historical event listeners simulate `virtual events` from historical storage (databases/logs/ . . . ) and will not trigger the correlation component.
In a variation of the system of the one embodiment, the system further employs a causal pattern detection layer that applies pattern expressions on the audit grouped raw events contained in the audit event. The result of the pattern expression evaluation is considered to be a filtered instance of a causal audit event. This filtered audit events are then pushed through a notification component to be sent for further processing on a downstream location.
In an additional variation of the system of the one embodiment, the system further employs a behavior analysis layer that monitors changes in the model associated to the audit event flow. This layer collects data to build a clustering model for the configured fields from the audit event. After enough data was collected and a model was built, without human intervention, this layer will signal when an input (audit) event can be considered as a large variation from the rules captured in the model. Periodically, when new data is available, this processing layer will update its model thus adapting to the changing environment.
(0)
(0)