Communication pattern recognition

• US 10,395,016 B2
• Filed: 01/24/2017
• Issued: 08/27/2019
• Est. Priority Date: 01/24/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Baldwin, Timothy J., Johnson, Andrew, Johnson, Peter J., Sasson, Ben, Xu, Fenglian
• Primary Examiner(s): Pyzocha, Michael
• Application Number:
  US15/413,594
• Publication Number:
  US 20180211019A1
• Time in Patent Office: 945 Days
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

For communication pattern recognition, an apparatus is disclosed. The apparatus includes a baseline analysis module that samples predefined sources associated with a user and generates a baseline fingerprint for the user. The apparatus includes an active analysis module that re-samples the predefined sources associated with the user after a predefined time interval and generates an active fingerprint for the user. The apparatus includes a verification module that compares the active fingerprint to the baseline fingerprint and determines whether the active fingerprint closely matches the baseline fingerprint. If the active fingerprint closely matches the baseline fingerprint, then the verification module replaces the baseline fingerprint with the active fingerprint. If the active fingerprint does not match the baseline fingerprint, then the verification module performs a predefined action to rectify differences between the baseline fingerprint and the active fingerprint.

Claims

1. An apparatus, comprising:

one or more processors;

a network interface whereby the one or more processors communicate with a network; and

a memory storing code that is executable by the one or more processors to;

generate a baseline network communications fingerprint for a first user, based on network communication pattern data for communications between the user one or more second users and sampled at a first point in time from one or more databases that archive network communication pattern data from a set of predefined sources;

generate an active network communications fingerprint for the first user based on a re-sampling of the predefined sources after a predefined time interval; and

perform a predefined action to update a network permission in response to differences detected between the baseline network communication fingerprint and the active network communication fingerprint for the first user, wherein the predefined action includes communicating a message to a network administrator to apply network permissions to the first user based on similarity between the first user'"'"'s baseline network communication fingerprint and the baseline network communication fingerprint of the one or more second users.

2. The apparatus of claim 1, wherein the one or more processors generate the baseline network communication fingerprint upon system initialization based on a sum of archived network communication data associated with the first user up until the point of generation.

3. The apparatus of claim 1, wherein the network communications pattern data relates to one or more of message timestamps, message contents, message recipients, and message frequency.

4. The apparatus of claim 1, wherein the predefined sources comprise predefined communication sources including one or more of an organization email system, an instant messaging history, and online voice communications.

5. The apparatus of claim 1, wherein the re-sampling of the predefined sources associated with the first user include information from recent messages in a predefined time interval.

6. The apparatus of claim 1, wherein the one or more processors generate the active network communications fingerprint while maintaining the baseline network communications fingerprint.

7. The apparatus of claim 1, wherein the predefined time interval comprises a number of seconds, minutes, days, weeks, or months.

8. The apparatus of claim 1, wherein the one or more processors adjust the predefined time interval based on a communication volume between the first user and the one or more second users.

9. The apparatus of claim 1, wherein the one or more processors verification module replaces the baseline fingerprint by updating the baseline fingerprint with the active fingerprint to thereby generate an up-to-date baseline fingerprint.

10. The apparatus of claim 1, wherein the predefined action to update the network permission includes communicating a request to the first user to re-validate permissions associated with the baseline network communication fingerprint for the first user.

11. The apparatus of claim 1, wherein the predefined action to update the network permission includes communicating a request to a network administrator to temporarily revoke permissions associated with the baseline network communication fingerprint for the first user.

12. A method, comprising:

generating a baseline network communications fingerprint for a first user based on network communication pattern data for communications between the user one or more second users and sampled at a first point in time from one or more databases that archive network communications pattern data from a set of predefined communication sources;

generating an active network communications fingerprint for the first user based on a re-sampling of the predefined communication sources after a predetermined time interval; and

performing a predefined action to update a network permission in response to differences detected between the baseline network communications fingerprint and the active network communication fingerprint for the first user, wherein the predefined action includes communicating to at least one of a network administrator and the first user, one or more network permissions for the one or more second users who have a similar baseline fingerprint to the baseline fingerprint for the first user.

13. The method of claim 12, wherein the predefined communication sources comprise one or more of an organization email system, an instant messaging history, and online voice communications.

14. The method of claim 12, wherein the predefined time interval comprises a number of seconds, minutes, days, weeks, or months.

15. The method of claim 14, further comprising adjusting the predefined time interval based on a communication volume between the first user and the one or more second users.

16. The method of claim 12, wherein the predefined action includes communicating a request to the user to re-validate permissions associated with the baseline network communications fingerprint for the first user.

17. The method of claim 12, wherein the predefined action includes communicating a request to a network administrator to temporarily revoke permissions associated with the baseline fingerprint for the first user.

18. A computer program product for performing a network permission action, the computer program product comprising a computer-readable medium having program instructions embodied therewith, the program instructions executable by a processor to:

generate, by processor, a baseline fingerprint for the first user based on network communication pattern data for communications between the first user and one or more second users and sampled at a first point in time from one or more databases that archive network communication pattern data from a set of predefined communication sources;

generate, by processor, an active fingerprint for the first user based on re-sampling the predefined communication sources;

perform, by processor, a predefined action related to a network permission in response to differences detected between the baseline network communications fingerprint and the active network communications fingerprint for the first user, wherein the predefined action includes communicating to at least one of a network administrator and the first user, one or more network permissions for the one or more second users who have a similar baseline fingerprint to the baseline fingerprint for the first user.