METHODS, SYSTEMS, APPARATUS, AND STORAGE MEDIA FOR USE IN DETECTING ANOMALOUS BEHAVIOR AND/OR IN PREVENTING DATA LOSS
First Claim
1. A method comprising:
- receiving, in a processor, information defining a plurality of different actions that may be performed by users;
receiving, in a processor, information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time;
determining, by a processor, a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions;
receiving, in a processor, information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and
determining, by a processor, a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.
1 Assignment
0 Petitions
Accused Products
Abstract
In one aspect, a method includes: receiving information defining a plurality of different actions that may be performed by users; receiving information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time; determining a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions; receiving information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and determining a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions.
-
Citations
25 Claims
-
1. A method comprising:
-
receiving, in a processor, information defining a plurality of different actions that may be performed by users; receiving, in a processor, information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time; determining, by a processor, a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions; receiving, in a processor, information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and determining, by a processor, a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A non-transitory computer readable storage medium having code stored thereon, the code being executable by a processor to result in a method comprising:
-
receiving information defining a plurality of different actions that may be performed by users; receiving information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time; determining a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions; receiving information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and determining a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17)
-
-
18. A system comprising:
-
a processor; and a memory, coupled to the processor and storing code executable by the processor; the processor configured to; receive information defining a plurality of different actions that may be performed by users; receive information indicating a relative frequency at which each of the different actions was performed by each of a plurality of users over each of one or more periods of time; determine a plurality of different characteristic behaviors based at least in part on the information indicating the relative frequency at which each of the different actions was performed by each of the plurality of users over each of one or more periods of time, wherein each one of the different characteristic behaviors defines a relative frequency of performance of each of the different actions; receive information indicating a relative frequency at which each of the different actions was performed by a user over a period of time; and determine a representation of the relative frequency at which each of the different actions was performed by the user over the period of time as a weighted combination of the different characteristic behaviors each of which defines a relative frequency of performance of each of the different actions. - View Dependent Claims (19, 20, 21, 22, 23, 24, 25)
-
Specification