Analyzing Activity Data of an Information Management System

• US 20080066149A1
• Filed: 10/30/2007
• Published: 03/13/2008
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Blue Jungle
• Original Assignee: Blue Jungle
• Inventors: Lim, Keng
• Granted Patent: US 9,407,662 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2216/03 Data mining
• CPC Class Codes: G06F 2221/032 Protect output to user by software means
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/60 : Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: Y10S 707/922 : Communications

Abstract

In an information management system, activity data is collected and analyzed for patterns. The information management system may be policy based. Activity data may be organized as entries including information on user, application, machine, action, object or document, time, and location. When checking for patterns in the activity or historical data, techniques may include inferencing, frequency checking, location and distance checking, and relationship checking, and any combination of these. Analyzing the activity data may include comparing like types or categories of information for two or more entries.

Claims

1. A method of operating an information management system comprising:

providing a plurality of rules to manage information of the information management system, wherein a first rule comprises a condition between a first entity and a second entity;

providing activity data associated with the first and second entities;

inspecting at least the first rule to extract the condition between the first and second entities;

analyzing the activity data to derive a relationship between the first and second entities; and

detecting a potential satisfaction of the condition because of the relationship.

2. The method of claim 1 wherein the condition comprises that the first entity is not permitted to send a document to the second entity.

3. The method of claim 2 wherein the relationship comprises the first entity sending a document to a third entity, and the third entity sending the document to the second entity.

4. The method of claim 1 wherein the activity data comprises at least one of e-mail transactions, instant messaging transactions, voice over Internet protocol transactions, or session initiation protocol transactions.

5. The method of claim 1 wherein the first entity is a first document and the second entity is a second document.

6. The method of claim 1 wherein the first entity is a first user and the second entity is a second user.

7. The method of claim 1 wherein the first entity is a first device and the second entity is a second device.

8. The method of claim 1 wherein the first entity is a first application program and the second entity is a second application program.

9. The method of claim 1 wherein the inspecting at least the first rule to extract the condition between the first and second entities comprises inspecting a plurality of rules.

10. A method of operating an information management system comprising:

providing a first rule comprising a condition between a first entity and a second entity;

providing activity data associated with the first and second entities;

inspecting at least the first rule to extract the condition between the first and second entities;

analyzing the activity data to derive a relationship between the first and second entities; and

detecting a potential satisfaction of the condition because of the relationship.

11. A method of operating an information management system comprising:

providing a plurality of rules to manage information of the information management system, wherein a first rule comprises a condition between a first action and a second action;

providing activity data associated with the first and second actions;

inspecting at least the first rule to extract the condition between the first and second actions;

analyzing the activity data to derive a relationship between the first and second actions; and

detecting a potential satisfaction of the condition because of the relationship.