METHODS, SYSTEMS, APPARATUS, AND STORAGE MEDIA FOR USE IN DETECTING ANOMALOUS BEHAVIOR AND/OR IN PREVENTING DATA LOSS

• US 20170213025A1
• Filed: 12/10/2015
• Published: 07/27/2017
• Est. Priority Date: 10/30/2015
• Status: Active Grant

• Current Assignee: General Electric Company
• Original Assignee: General Electric Company
• Inventors: Srivastav, Abhishek, Kasiviswnathan, Shiva Prasad, Evans, Scott Charles, Beauchamp, Philip Paul
• Granted Patent: US 10,192,050 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

In one aspect, a method includes: receiving information defining a plurality of different actions that may be performed by users; receiving information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time; determining a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions; receiving information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and determining a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.

Claims

1. A method comprising:

receiving, in a processor, information defining a plurality of different actions that may be performed by users;

receiving, in a processor, information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time;

determining, by a processor, a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions;

receiving, in a processor, information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and

determining, by a processor, a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.

2. The method of claim 1, further comprising:

determining, by a processor, a difference based at least in part on;

(i) the relative frequency at which each of the different actions was performed by a user over a period of time and (ii) the weighted combination representing the relative frequency at which each of the different actions was performed by the user over the period of time; and

comparing, by a processor, the difference to a criteria.

3. The method of claim 2, further comprising:

displaying, based at least in part on the comparison, a result indicating whether anomalous behavior is detected on the part of the user.

4. The method of claim 1, wherein the determining, by a processor, a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions, is performed without human supervision.

5. The method of claim 1, wherein the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time includes:

a plurality of user-time period combinations, each one of the user-time period combinations being associated with a respective combination of one of the plurality of users and one of the one or more periods of time;

the method further comprising;

determining, by a processor, for each user-time period combination, a representation of the relative frequency at which each of the different actions was performed by the associated one of the plurality of users over the associated one of the one or more periods of time, as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.

6. The method of claim 5, the method further comprising:

(a) defining, by a processor, a user-time period combination to be an outlier;

(b) determining, by a processor, a new plurality of different characteristic behaviors, based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time with the exception of each user-time period combination defined to be an outlier, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the different actions;

(c) determining, by a processor, if a termination criteria is satisfied; and

(d) if it is determined that the termination criteria is not satisfied, repeating (a)-(b).

7. The method of claim 5, the method further comprising:

defining, by a processor, a count indicating a number of different characteristic behaviors;

wherein the determining, by a processor, a plurality of different characteristic behaviors comprises;

determining, by a processor, a plurality of different characteristic behaviors that includes the indicated number of different characteristic behaviors,

the method further comprising;

(a) incrementing, by a processor, the count indicating a number of different characteristic behaviors;

(b) determining, by a processor, a new plurality of different characteristic behaviors that includes the indicated number of different characteristic behaviors, based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the different actions;

(c) determining, by a processor, if a termination criteria is satisfied; and

(d) if it is determined that the termination criteria is not satisfied, repeating (a)-(b).

8. The method of claim 1, wherein the plurality of different actions is a first plurality of different actions;

the method further comprising;

determining if a change criteria is satisfied; and

if it is determined that the change criteria is satisfied, determining a new plurality of different characteristic behaviors based at least in part on information indicating a relative frequency at which each of a second plurality of different actions was performed by each of a plurality of users over each of a second one or more periods of time, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the second plurality of different actions.

9. The method of claim 8, wherein the second plurality of different actions are the same as the first plurality of different actions.

10. A non-transitory computer readable storage medium having code stored thereon, the code being executable by a processor to result in a method comprising:

receiving information defining a plurality of different actions that may be performed by users;

receiving information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time;

determining a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions;

receiving information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and

determining a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.

11. The medium of claim 10, the method further comprising:

determining a difference based at least in part on;

(i) the relative frequency at which each of the different actions was performed by a user over a period of time and (ii) the weighted combination representing the relative frequency at which each of the different actions was performed by the user over the period of time; and

comparing, by a processor, the difference to a criteria.

12. The medium of claim 10, further comprising:

displaying, based at least in part on the comparison, a result indicating whether anomalous behavior is detected on the part of the user.

13. The medium of claim 10, wherein the determining a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions, is performed without human supervision.

14. The medium of claim 10, wherein the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time includes:

a plurality of user-time period combinations, each one of the user-time period combinations being associated with a respective combination of one of the plurality of users and one of the one or more periods of time;

the method further comprising;

determining for each user-time period combination, a representation of the relative frequency at which each of the different actions was performed by the associated one of the plurality of users over the associated one of the one or more periods of time, as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.

15. The medium of claim 14, the method further comprising:

(a) defining a user-time period combination to be an outlier;

(b) determining a new plurality of different characteristic behaviors, based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time with the exception of each user-time period combination defined to be an outlier, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the different actions;

(c) determining if a termination criteria is satisfied; and

(d) if it is determined that the termination criteria is not satisfied, repeating (a)-(b).

16. The medium of claim 14, the method further comprising:

defining a count indicating a number of different characteristic behaviors;

wherein the determining, by a processor, a plurality of different characteristic behaviors comprises;

determining a plurality of different characteristic behaviors that includes the indicated number of different characteristic behaviors,

the method further comprising;

(a) incrementing the count indicating a number of different characteristic behaviors;

(b) determining a new plurality of different characteristic behaviors that includes the indicated number of different characteristic behaviors, based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the different actions;

(c) determining if a termination criteria is satisfied; and

(d) if it is determined that the termination criteria is not satisfied, repeating (a)-(b).

17. The medium of claim 10, wherein the plurality of different actions is a first plurality of different actions;

the method further comprising;

determining if a change criteria is satisfied; and

if it is determined that the change criteria is satisfied, determining a new plurality of different characteristic behaviors based at least in part on information indicating a relative frequency at which each of a second plurality of different actions was performed by each of a plurality of users over each of a second one or more periods of time, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the second plurality of different actions.

18. A system comprising:

a processor; and

a memory, coupled to the processor and storing code executable by the processor;

the processor configured to;

receive information defining a plurality of different actions that may be performed by users;

receive information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time;

determine a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions;

receive information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and

determine a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.

19. The system of claim 18, the processor further configured to:

determine a difference based at least in part on;

(i) the relative frequency at which each of the different actions was performed by a user over a period of time and (ii) the weighted combination representing the relative frequency at which each of the different actions was performed by the user over the period of time; and

compare the difference to a criteria.

20. The system of claim 18, the processor further configured to:

display, based at least in part on the comparison, a result indicating whether anomalous behavior is detected on the part of the user.

21. The system of claim 18, wherein the determine a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions, is performed without human supervision.

22. The system of claim 18, wherein the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time includes:

a plurality of user-time period combinations, each one of the user-time period combinations being associated with a respective combination of one of the plurality of users and one of the one or more periods of time;

the processor further configured to;

determine for each user-time period combination, a representation of the relative frequency at which each of the different actions was performed by the associated one of the plurality of users over the associated one of the one or more periods of time, as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.

23. The system of claim 22, the processor further configured to:

(a) define a user-time period combination to be an outlier;

(b) determine a new plurality of different characteristic behaviors, based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time with the exception of each user-time period combination defined to be an outlier, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the different actions;

(c) determine if a termination criteria is satisfied; and

(d) if it is determined that the termination criteria is not satisfied, repeat (a)-(b).

24. The system of claim 22, the processor further configured to:

define a count indicating a number of different characteristic behaviors;

wherein the determine a plurality of different characteristic behaviors comprises;

determine a plurality of different characteristic behaviors that includes the indicated number of different characteristic behaviors,

the processor further configured to;

(a) increment, by a processor, the count indicating a number of different characteristic behaviors;

(b) determine, by a processor, a new plurality of different characteristic behaviors that includes the indicated number of different characteristic behaviors, based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the different actions;

(c) determine if a termination criteria is satisfied; and

(d) if it is determined that the termination criteria is not satisfied, repeat (a)-(b).

25. The system of claim 18, wherein the plurality of different actions is a first plurality of different actions;

the processor further configured to;

determine if a change criteria is satisfied; and

if it is determined that the change criteria is satisfied, determine a new plurality of different characteristic behaviors based at least in part on information indicating a relative frequency at which each of a second plurality of different actions was performed by each of a plurality of users over each of a second one or more periods of time, wherein each one of the different characteristic behaviors in the new plurality of different characteristic behaviors defines a relative frequency of performance of each of the second plurality of different actions.