DETECTING ANOMALIES IN WORK PRACTICE DATA BY COMBINING MULTIPLE DOMAINS OF INFORMATION

• US 20140325643A1
• Filed: 04/26/2013
• Published: 10/30/2014
• Est. Priority Date: 04/26/2013
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Bart, Evgeniy, Liu, Juan J., Eldardiry, Hoda M. A., Price, Robert R.
• Granted Patent: US 9,264,442 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

One embodiment of the present invention provides a system for multi-domain clustering. During operation, the system collects domain data for at least two domains associated with users, wherein a domain is a source of data describing observable activities of a user. Next, the system estimates a probability distribution for a domain associated with the user. The system also estimates a probability distribution for a second domain associated with the user. Then, the system analyzes the domain data with a multi-domain probability model that includes variables for two or more domains to determine a probability distribution of each domain associated with the probability model and to assign users to clusters associated with user roles.

Claims

1. A computer-executable method for multi-domain clustering, comprising:

collecting domain data for at least two domains associated with users, wherein a domain is a source of data describing observable activities of a user;

estimating a probability distribution for a domain associated with the user;

estimating a probability distribution for a second domain associated with the user; and

analyzing the domain data with a multi-domain probability model that includes variables for two or more domains to determine a probability distribution of each domain associated with the probability model and to assign users to clusters associated with user roles.

2. The method of claim 1, wherein the domain data includes one or more of average number of e-mails, topical content of e-mail, average number of files, average number of HTTP access, addresses for HTTP access, and average number of logons.

3. The method of claim 1, further comprising:

computing an anomaly score for the user for each of the domains; and

computing an aggregate anomaly score for the user that includes weighted anomaly scores for each of the domains.

4. The method of claim 1, further comprising:

clustering domain data for a first domain;

associating a first cluster index for the first domain with a particular user;

clustering domain data for a second domain;

associating a second cluster index for the second domain with the particular user; and

generating a discrete distribution for the particular user that includes the first cluster index and the second cluster index.

5. The method of claim 4, further comprising comparing a user'"'"'s cluster indices with other users'"'"' cluster indices to determine whether the user'"'"'s activities are anomalous.

6. The method of claim 4, wherein associating the first cluster index for the first domain with the particular user comprises:

estimating a maximum a posteriori probability cluster index for the user; and

associating the user with the maximum a posteriori probability cluster index.

7. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for multi-domain clustering, the method comprising:

collecting domain data for at least two domains associated with users, wherein a domain is a source of data describing observable activities of a user;

estimating a probability distribution for a domain associated with the user;

estimating a probability distribution for a second domain associated with the user; and

analyzing the domain data with a multi-domain probability model that includes variables for two or more domains to determine a probability distribution of each domain associated with the probability model and to assign users to clusters associated with user roles.

8. The computer-readable storage medium of claim 7, wherein the domain data includes one or more of average number of e-mails, topical content of e-mail, average number of files, average number of HTTP access, addresses for HTTP access, and average number of logons.

9. The computer-readable storage medium of claim 7, wherein the computer-readable storage medium stores additional instructions that, when executed, cause the computer to perform additional steps comprising:

computing an anomaly score for the user for each of the domains; and

computing an aggregate anomaly score for the user that includes weighted anomaly scores for each of the domains.

10. The computer-readable storage medium of claim 7, wherein the computer-readable storage medium stores additional instructions that, when executed, cause the computer to perform additional steps comprising:

clustering domain data for a first domain;

associating a first cluster index for the first domain with a particular user;

clustering domain data for a second domain;

associating a second cluster index for the second domain with the particular user; and

generating a discrete distribution for the particular user that includes the first cluster index and the second cluster index.

11. The computer-readable storage medium of claim 7, further comprising comparing a user'"'"'s cluster indices with other users'"'"' cluster indices to determine whether the user'"'"'s activities are anomalous.

12. The computer-readable storage medium of claim 7, wherein associating the first cluster index for the first domain with the particular user comprises:

estimating a maximum a posteriori probability cluster index for the user; and

associating the user with the maximum a posteriori probability cluster index.

13. A computing system for multi-domain clustering, the system comprising:

one or more processors,

a computer-readable medium coupled to the one or more processors having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

collecting domain data for at least two domains associated with users, wherein a domain is a source of data describing observable activities of a user;

estimating a probability distribution for a domain associated with the user;

estimating a probability distribution for a second domain associated with the user; and

analyzing the domain data with a multi-domain probability model that includes variables for two or more domains to determine a probability distribution of each domain associated with the probability model and to assign users to clusters associated with user roles.

14. The computing system claim 13, wherein the domain data includes one or more of average number of e-mails, topical content of e-mail, average number of files, average number of HTTP access, addresses for HTTP access, and average number of logons.

15. The computing system of claim 13, wherein the computing system stores additional instructions that, when executed, cause the computer to perform additional steps comprising:

computing an anomaly score for the user for each of the domains; and

computing an aggregate anomaly score for the user that includes weighted anomaly scores for each of the domains.

16. The computing system of claim 13, wherein the computing system stores additional instructions that, when executed, cause the computer to perform additional steps comprising:

clustering domain data for a first domain;

associating a first cluster index for the first domain with a particular user;

clustering domain data for a second domain;

associating a second cluster index for the second domain with the particular user;

generating a discrete distribution for the particular user that includes the first cluster index and the second cluster index.

17. The computing system of claim 13, wherein the computing system stores additional instructions that, when executed, cause the computer to perform additional steps comprising:

comparing a user'"'"'s cluster indices with other users'"'"' cluster indices to determine whether the user'"'"'s activities are anomalous.

18. The computing system of claim 13, wherein associating the first cluster index for the first domain with the particular user comprises:

estimating a maximum a posteriori probability cluster index for the user; and

associating the user with the maximum a posteriori probability cluster index.