Cognitive information security using a behavioral recognition system

Abstract

Embodiments presented herein describe techniques for generating a linguistic model of input data obtained from a data source (e.g., a video camera). According to one embodiment of the present disclosure, a sequence of symbols is generated based on an ordered stream of normalized vectors generated from the input data. A dictionary of words is generated from combinations of the ordered sequence of symbols based on a frequency at which combinations of symbols appear in the ordered sequence of symbols. A plurality of phrases is generated based an ordered sequence of words from the dictionary observed in the ordered sequence of symbols based on a frequency by which combinations of words in ordered sequence of words appear relative to one another.

1 - 21 . (canceled) 
     
     
         22 . A method, comprising:
 generating, via a processor, a stable model of words based on a statistical distribution of combinations of symbols, the symbols being associated with normalized data;   calculating, via the processor, a score for at least one word from the stable model of words based on a frequency of occurrence of the at least one word; and   sending a behavioral alert based on the score.   
     
     
         23 . The method of  claim 22 , wherein the combinations of symbols are associated with a video feed. 
     
     
         24 . The method of  claim 22 , further comprising dynamically updating the stable model of words based on a received stream of additional normalized data. 
     
     
         25 . The method of  claim 22 , further comprising dynamically updating the stable model of words based on an ordered stream of additional normalized data. 
     
     
         26 . The method of  claim 22 , further comprising receiving an ordered stream of data, wherein the symbols are associated with clusters generated from the received ordered stream of data. 
     
     
         27 . The method of  claim 22 , wherein each word from the stable model of words represents an activity. 
     
     
         28 . The method of  claim 22 , further comprising generating a neuro-linguistic model based on the stable model of words. 
     
     
         29 . A computer-readable storage medium storing processor-executable instructions that, when executed, cause the processor to:
 generate a stable model of words based on a statistical distribution of combinations of symbols, the symbols being associated with normalized data;   calculate a score for at least one word from the stable model of words based on a frequency of occurrence of the at least one word; and   send a behavioral alert based on the score.   
     
     
         30 . The computer-readable storage medium of  claim 29 , wherein the combinations of symbols are associated with a video feed. 
     
     
         31 . The computer-readable storage medium of  claim 29 , further storing instructions to cause the processor to dynamically update the stable model of words based on a received stream of additional normalized data. 
     
     
         32 . The computer-readable storage medium of  claim 29 , further storing instructions to cause the processor to dynamically update the stable model of words based on an ordered stream of additional normalized data. 
     
     
         33 . The computer-readable storage medium of  claim 29 , further storing instructions to cause the processor to receive an ordered stream of data, wherein the symbols are associated with clusters generated from the received ordered stream of data. 
     
     
         34 . The computer-readable storage medium of  claim 29 , wherein each word from the stable model of words represents an activity. 
     
     
         35 . The computer-readable storage medium of  claim 29 , further storing instructions to cause the processor to generate a neuro-linguistic model based on the stable model of words. 
     
     
         36 . A system, comprising:
 a processor; and   a memory storing instructions to cause the processor to:   
       generate, via a processor, a stable model of words based on a statistical distribution of combinations of symbols, the symbols being associated with normalized data;
 calculate, via the processor, a score for at least one word from the stable model of words based on a frequency of occurrence of the at least one word; and 
 send a behavioral alert based on the score. 
 
     
     
         37 . The system of  claim 36 , wherein the combinations of symbols are associated with a video feed. 
     
     
         38 . The system of  claim 36 , further storing instructions to cause the processor to dynamically update the stable model of words based on a received stream of additional normalized data. 
     
     
         39 . The system of  claim 36 , further storing instructions to cause the processor to dynamically update the stable model of words based on an ordered stream of additional normalized data. 
     
     
         40 . The system of  claim 36 , further storing instructions to cause the processor to receive an ordered stream of data, wherein the symbols are associated with clusters generated from the received ordered stream of data. 
     
     
         41 . The system of  claim 36 , wherein each word from the stable model of words represents an activity.