Analyzing user-activity data using a heuristic-based approach

• US 20050256956A1
• Filed: 10/13/2004
• Published: 11/17/2005
• Est. Priority Date: 05/14/2004
• Status: Abandoned Application

• Current Assignee: Battelle Memorial Institute
• Original Assignee: Battelle Memorial Institute
• Inventors: Adams, Daniel R., Littlefield, Richard J., Gibson, Alex G., Cheney, Barbara J., Curtis, Laura M., Haack, Jereme N., Littlefield, Janis S., Cowley, Paula J., McCall, Jonathon D.
• Application Number:
  US10/965,473
• Publication Number:
  US 20050256956A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

Methods, apparatus, and systems for analyzing user-activity data are disclosed. In one disclosed embodiment, for example, two or more data streams of low-level, user-activity data are detected at a computer workstation via two or more respective sensors. The two or more respective sensors may comprise a first sensor configured to detect network-access requests and a second sensor configured to detect at least one of the following events: file-activity events, window-title-change events, or user-interface events. Targeted user activity is identified from at least one of the data streams. The targeted user activity can comprise, for example, a user initiating a network access; performing a search on a search engine; creating, opening, or modifying a file; or initiating a network access that causes a window title to change. Computer-readable media containing computer-executable instructions for causing a computer system to perform any of the described methods or for storing lists created or modified by any of the disclosed methods are also disclosed.

Claims

1. A method, comprising:

receiving user-activity data, the user-activity data comprising one or more network-access requests;

comparing a selected network-access request from the user-activity data to one or more known non-user-initiated network-access requests; and

designating the selected network-access request as being a user-initiated network-access request based at least in part on the comparison.

2. The method of claim 1, wherein the comparing comprises determining that the selected network-access request does not match any of the known non-user-initiated network-access requests.

3. The method of claim 1, wherein the user-activity data further comprises one or more user-interface events, the method further comprising determining that the selected network-access request is responsive to an immediately prior user-interface event.

4. The method of claim 3, wherein the one or more user-interface events correspond to keystrokes or mouse clicks performed at the workstation

5. The method of claim 1, further comprising outputting a list of targeted user activities, the list of targeted user activities comprising at least the designated user-initiated network-access request.

6. The method of claim 1, wherein the known non-user-initiated network-access requests are stored in one or more lists of known non-user-initiated network-access requests.

7. The method of claim 6, wherein the one or more lists of known non-user-initiated network-access requests comprise a list of URL addresses known to be secondary URL addresses.

8. The method of claim 6, wherein the one or more lists of known non-user-initiated network-access requests comprise a list of URL addresses known to be of a non-primary type.

9. The method of claim 6, wherein the selected network-access request is a first network-access request, the method further comprising:

identifying a second selected network-access request as being a non-user-initiated network-access request from the user-activity data; and

updating one of the lists of known non-user-initiated network-access requests to include the non-user-initiated network-access request identified.

10. The method of claim 9, wherein the user-activity data further comprises one or more user-interface events, the method further comprising determining that the second selected network-access request does not immediately follow a user-interface event.

11. The method of claim 1, wherein the network-access requests correspond to uniform-resource-locator (URL) addresses accessed by the computer workstation.

12. One or more computer-readable media comprising computer-executable instructions for causing a computer to perform the method of claim 1.

13. One or more computer-readable media comprising a list of user-initiated network-access requests created at least partially by the method of claim 1.

14. A method, comprising:

receiving data indicating activity at a computer workstation, wherein the data comprises entries indicative of network-access requests from the computer workstation, wherein the network-access requests comprise both user-initiated network-access requests and non-user-initiated network-access requests; and

via the data indicating activity at the computer workstation, designating one or more of the network-access requests as user-initiated network-access requests.

15. The method of claim 14, wherein the data further comprises entries indicative of user-interface events, the method further comprising identifying at least one of the user-interface events as a user-interface event initiating at least one of the network-access requests.

16. The method of claim 14;

wherein the act of designating one or more of the network-access requests as user-initiated network-access requests comprises searching one or more lists of non-user-initiated network-access requests.

17. The method of claim 14, further comprising, via the data indicating activity at the computer workstation, identifying one or more of the network-access requests as non-user-initiated network-access requests.

18. The method of claim 17, further comprising updating a list of non-user-initiated network-access requests with one or more of the network-access requests identified as non-user-initiated network-access requests.

19. The method of claim 14, further comprising, via the data indicating activity at the computer workstation, identifying one or more search queries from the network-access requests.

20. One or more computer-readable media comprising computer-executable instructions for causing a computer to perform the method of claim 14.

21. One or more computer-readable media comprising a list of user-initiated network-access requests created at least partially by the method of claim 14.

22. A method, comprising:

receiving user-activity data, the user-activity data comprising one or more network-access requests;

comparing a selected network-access request from the user-activity data to known search-engine-query addresses;

identifying the selected network-access request as being a search-engine query by matching the selected network-access request to one of the known search-engine-query addresses; and

identifying a user query to the search engine from the selected network-access request.

23. The method of claim 22, further comprising outputting a list of targeted user activities, the list of targeted user activities comprising at least the search-engine query identified.

24. The method of claim 22, wherein the user-interface events correspond to keystrokes or mouse clicks performed at the workstation.

25. The method of claim 22, wherein the network-access requests correspond to uniform resource locator (URL) addresses accessed by the workstation.

26. The method of claim 22, wherein the known search-engine-query addresses comprise URL addresses for known Internet search engines.

27. One or more computer-readable media comprising computer-executable instructions for causing a computer to perform the method of claim 22.

28. One or more computer-readable media comprising a list of search-engine queries created at least partially by the method of claim 22.

29. A method, comprising:

receiving user-activity data, the user-activity data comprising one or more file-activity events, each file-activity event being indicative of a respective file that was accessed by a computer workstation and a process that accessed the respective file on the computer workstation;

clustering two or more of the file-activity events together, the two or more file-activity events involving a common file accessed by a common process, the two or more file-activity events occurring within respective time intervals from one another; and

classifying the clustered file-activity events as being representative of a targeted file action.

30. The method of claim 29, wherein the classifying comprises:

comparing a time associated with the clustered file-activity events to a creation time of the common file; and

designating the clustered file-activity events as representing a creation of the common file based at least in part on the comparison.

31. The method of claim 30, wherein the comparing and the designating are performed for the clustered file-activity events only after the clustering is determined to be complete for the clustered file-activity events.

32. The method of claim 29, wherein the classifying comprises:

comparing a time associated with the clustered file-activity events to a modification time of the common file; and

designating the cluster file-activity events as representing either a modification of the common file or an opening of the common file based at least in part on the comparison.

33. The method of claim 29, wherein the classifying comprises:

comparing a time associated with the clustered file-activity events to a creation time and a modification time of the common file; and

designating the clustered file-activity events as representing a creation, a modification, or an opening of the common file based at least in part on the comparison.

34. The method of claim 29, further comprising deleting a selected file-activity event from the user-activity data if the selected file-activity event indicates access to a file on a list of excluded files.

35. The method of claim 34, wherein the list of excluded files comprises temporary files.

36. The method of claim 29, further comprising outputting a list of targeted user activities, the list of targeted user activities comprising at least the targeted file action represented by the clustered file-activity events.

37. The method of claim 29, wherein the clustering and classifying are performed substantially as the user-activity data is received.

38. One or more computer-readable media comprising computer-executable instructions for causing a computer to perform the method of claim 29.

39. One or more computer-readable media comprising a list of targeted file actions created at least partially by the method of claim 29.

40. A method, comprising:

monitoring network-access requests from a computer workstation and network responses to the network-access requests;

identifying a network response that directs the computer workstation to perform a window title change, the identified network response being received in response to a corresponding network-access request;

determining that a window on the computer workstation changed as a result of the identified network response; and

associating the window with the corresponding network-access request.

41. The method of claim 40, wherein the determining comprises evaluating whether the window on the computer workstation changed titles within a predetermined period of time of the identified network response and whether a new title of the window matches a title directed by the identified network response.

42. The method of claim 40, further comprising associating user commentary concerning the window with the corresponding network-access request.

43. The method of claim 40, wherein the corresponding network-access request comprises a URL address.

44. The method of claim 40, wherein the identified network response comprises an HTML directive to change window titles.

45. The method of claim 40, wherein the identifying, determining, and associating are performed substantially concurrent with the monitoring.

46. One or more computer-readable media comprising computer-executable instructions for causing a computer to perform the method of claim 40.

47. A method for analyzing user-activity data, comprising:

detecting two or more data streams of low-level, user-activity data at a computer workstation via two or more respective sensors, the two or more respective sensors comprising at least a first sensor configured to detect network-access requests and a second sensor configured to detect at least one of file-activity events, window-title-change events, or user-interface events at the computer workstation;

identifying targeted user activity from at least one of the data streams;

storing

the targeted user activity; and

disregarding a remainder of the at least one of the data streams from which the targeted user activity is identified.

48. The method of claim 47, wherein the targeted user activity is identified using a combination of at least two of the data streams.

49. The method of claim 47, wherein the second sensor is configured to detect at least the user-interface events, and wherein the targeted user activity indicates a user initiating a network access.

50. The method of claim 49, wherein the targeted user activity further indicates a user query made to a network search engine during the network access initiated by the user.

51. The method of claim 47, wherein the second sensor is configured to detect at least the file-activity events, and wherein the targeted user activity indicates a user creating, opening, or modifying a file.

52. The method of claim 47, wherein the second sensor is configured to detect at least the window-title-change events, and wherein the targeted user activity indicates a user initiating a network access that changes a window title on the user'"'"'s computer workstation.

53. The method of claim 47, wherein the identifying the targeted user activity is performed substantially as a corresponding data stream is received.

54. The method of claim 47, wherein the targeted user activity is displayed via a graphical user interface.

55. One or more computer-readable media comprising computer-executable instructions for causing a computer to perform the method of claim 47.

56. One or more computer-readable media comprising a list of targeted file activity created by the method of claim 47.