System and Method for Detection of a Change in Behavior in the Use of a Website Through Vector Analysis

• US 20100235908A1
• Filed: 03/13/2009
• Published: 09/16/2010
• Est. Priority Date: 03/13/2009
• Status: Abandoned Application

• Current Assignee: Silver Tail Systems, Inc. (Dell Technologies Inc.)
• Original Assignee: Silver Tail Systems, Inc. (Dell Technologies Inc.)
• Inventors: Lloyd, Jim, Eynon, Mike, Mather, Laura, Westland, Erik
• Application Number:
  US12/404,152
• Publication Number:
  US 20100235908A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A system and method for identifying the change of user behavior on a website includes analyzing the actions of users on a website comprising a plurality of parameters or parameters that identify the actions performed on a website including parameters or fields related to previous actions by that user or other users of the website. The parameters or fields are represented in a vector format where each vector represents a different session of activity on the website, page of the website, user of the website, or other attribute of the use of a website. Analysis is performed to determine if new sessions are similar or dissimilar to previously known sessions.

Claims

1. A method for determining a likelihood of a previously unknown use of a website associated with using a computer system that processes data from a website session into a plurality of parameters configured to represent the website session information, and wherein the parameters are combined into a vector in a vector space, the method comprising:

mapping the vector into various vector spaces;

comparing the vector with other vectors based on the distance between the vector and the other vectors in the various vector spaces;

evaluating the vector using a comparison between the other vectors in the same or similar vector spaces;

generating a score indicative of the similarity between the vector and the other vectors in the same or similar vector spaces; and

returning the score to an investigation system for analysis.

2. The method of claim 1, wherein the investigation system for analysis is human analysis of the score.

3. A method for determining a likelihood of a previously unknown use of a website associated with a website session, comprising:

receiving a plurality of parameters associated with an action performed during a website session;

creating a session vector that has a dimension corresponding to each of the plurality of parameters associated with the action performed during the website session;

creating an exemplar session vector based on other session vectors within a vector space; and

comparing the session vector to the exemplar session vector in the various vector spaces.

4. The method of claim 3, wherein the exemplar session vector is based on all of the session vectors within a particular vector space.

5. The method of claim 3, further comprising generating a score indicative of a similarity between the session vector and the exemplar session vector in a same or a similar vector space by calculating a distance between the session vector and the exemplar session vector.

6. The method of claim 5, further comprising returning the score to an investigation system for analysis.

7. The method of claim 3, further comprising taking action upon detecting that the session vector has deviated from an expected threshold to indicate a new behavior.

8. The method of claim 3, further comprising using historical vectors to determine the exemplar session vector for the website session.

9. The method of claim 3, wherein each new action on the website generates a new session vector, which is mapped into at least one vector space.

10. The method of claim 3, further comprising combining a plurality of session vectors into a single vector space and analyzing the plurality of vectors as a group.

11. The method of claim 3, wherein the plurality of parameters corresponds to various attributes of the website session.

12. A method of mapping website session data into a vector space comprising:

parsing website session data into a plurality of parameters; and

mapping the plurality of parameters into n-dimensional vectors, wherein n is a number of parameters available about an action on a website, and wherein each vector is mapped into an n-dimensional space associated with the plurality of parameters related to the action on the website.

13. The method of claim 12, further comprising mapping non-numeric parameters to numeric values via a lookup table for use in creating the dimensions of the vector.

14. The method of claim 12, further comprising:

calculating a distance between a particular session vector within the n-dimensional vectors and an exemplar vector for a similar session; and

generating a score that determines a likelihood that a particular session is a previously unknown behavior based on the distance between the particular session vector and the exemplar vector for the similar session.

15. A behavior change detection system comprising;

a website data center, which receives a plurality of input parameters associated with website actions; and

a behavior change detection center configured to detect behavior changes by users of a website based on;

receiving a plurality of input parameters associated with website actions performed during a website session;

creating a session vector that has a dimension corresponding to each of the plurality of input parameters associated with the website actions performed during the website session;

creating an exemplar session vector based on other session vectors within a vector space; and

comparing the session vector to the exemplar session vector in the various vector spaces.

16. The system of claim 15, wherein the website data center provides notification in response to any detected behavior changes.

17. The system of claim 15, wherein the behavior change detection center determines whether or not a website action constitutes a behavior change on a website in substantially real-time.

18. The system of claim 15, further comprising a vector creation engine, which transforms the plurality of input parameters associated with website actions performed during the website session data into session vectors.

19. The system of claim 18, wherein the session vectors and the plurality of input parameters are fed into a score calculator, which compares the session vectors with the exemplar vectors, and upon the score calculator indicating that an action deviates from expected website behavior, an alert is generated that contains a corresponding score.

20. A computer readable medium containing a computer program for determining a likelihood of a previously unknown use of a website associated with a website session, wherein the computer program comprises executable instructions for:

receiving a plurality of parameters associated with an action performed during a website session;

creating a session vector that has a dimension corresponding to each of the plurality of parameters associated with the action performed during the website session;

creating an exemplar session vector based on other session vectors within a vector space; and

comparing the session vector to a exemplar session vector in the various vector spaces.