System and method of searching for classifying user activity performed on a computer system

• US 7,908,371 B2
• Filed: 03/04/2010
• Issued: 03/15/2011
• Est. Priority Date: 08/03/2005
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Friedman, Nathaniel Dourif, Trowbridge, Jon Eric
• Primary Examiner(s): NEURAUTER, GEORGE C
• Application Number:
  US12/717,693
• Publication Number:
  US 20100191737A1
• Time in Patent Office: 376 Days
• Field of Search: 709/224, 707/999.006
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 16/337 Profile generation, learning or modification
• CPC Class Codes: G06F 16/338 Presentation of query results
• CPC Class Codes: G06F 16/40 of multimedia data, e.g. slideshows comprising image and additional audio data retrieval of still image data G06F16/50; retrieval of audio data G06F16/60; retrieval of video data G06F16/70
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: Y10S 707/99936 Pattern matching access

Abstract

The invention is directed to a system and method of managing information associated with user actions. A monitoring system may gather and store information associated with user actions. Relationships may be inferred between user actions based on time or other criteria. A user may define classifications of user actions. These classifications may be used to retrieve information associated with user actions.

Claims

1. A method for classifying activity performed on a computer system, comprising:

monitoring the activity performed on the computer system using at least one electronic device coupled to the computer system, wherein the monitored activity includes a plurality of actions performed on the computer system and a plurality of objects accessed in the plurality of actions performed on the computer system;

determining, by the at least one electronic device, a chronological timeline for the plurality of actions performed on the computer system;

inferring, by the at least one electronic device, one or more relationships between the plurality of objects and the plurality of actions in the chronological timeline;

classifying, by the at least one electronic device, each of the plurality of objects and each of the plurality of actions in one or more of a plurality of categories based on the one or more inferred relationships; and

displaying the one or more inferred relationships on a display device.

2. The method of claim 1, further comprising defining the plurality of categories in response to the electronic device receiving an input that establishes the plurality of categories.

3. The method of claim 2, wherein defining the plurality of categories includes nesting a first one of the plurality of categories within a second one of the plurality of categories in response to the input that establishes the plurality of categories.

4. The method of claim 1, further comprising searching, by the at least one electronic device, the activity performed on the computer system for one or more of the plurality of actions that are classified in one or more of the plurality of categories.

5. The method of claim 1, further comprising determining, by the at least one electronic device, a strength for each of the one or more relationships, wherein the one or more relationships are inferred in response to determining that the strength for each of the one or more relationships exceed a threshold value.

6. The method of claim 5, wherein at least one of the relationships are not inferred in response to determining that the strength for the at least one relationship does not exceed the threshold value.

7. The method of claim 1, wherein the plurality of actions include one or more of actions that the computer system performs or actions that a user performs on the computer system.

8. The method of claim 1, wherein the chronological timeline for the plurality of actions comprises a first chronological timeline for a first computer system, and wherein the method further comprises:

monitoring, by the at least one electronic device, activity performed on a second computer system, wherein the monitored activity performed on the second computer system includes one or more actions performed on the second computer system and one or more objects accessed in the one or more actions performed on the second computer system;

determining, by the at least one electronic device, a second chronological timeline for the one or more actions performed on the second computer system, wherein .the one or more actions performed on the second computer system each occur at a respective chronological position in the second chronological timeline; and

displaying an aggregate timeline for the first computer system and the second computer system on the display device, wherein the aggregate timeline includes the plurality of actions performed on the first computer system and the one or more actions performed on the second computer system.

9. The method of claim 1, wherein the plurality of actions include each occur at a respective chronological position in the chronological timeline.

10. The method of claim 9, wherein the one or more inferred relationships are derived from the chronological positions for the plurality of actions in the chronological timeline.

11. A system for classifying activity performed on a computer system, wherein the system comprises at least one electronic device having one or more hardware components configured to:

monitor the activity performed on the computer system, wherein the monitored activity includes a plurality of actions performed on the computer system and a plurality of objects accessed in the plurality of actions performed on the computer system;

determine a chronological timeline for the plurality of actions performed on the computer system;

infer one or more relationships between the plurality of objects and the plurality of actions in the chronological timeline;

classify each of the plurality of objects and each of the plurality of actions in one or more of the plurality of categories based on the one or more inferred relationships; and

display the one or more inferred relationships on a display device.

12. The system of claim 11, wherein the one or more hardware components associated with the at least one electronic device are further configured to define the plurality of categories in response to receiving an input that establishes the plurality of categories.

13. The system of claim 12, wherein to define the plurality of categories, the one or more hardware components associated with the at least one electronic device are further configured to nest a first one of the plurality of categories within a second one of the plurality of categories in response to the input that establishes the plurality of categories.

14. The system of claim 11, wherein the one or more hardware components associated with the at least one electronic device are further configured to search the activity performed on the computer system for one or more of the plurality of actions that are classified in one or more of the plurality of categories.

15. The system of claim 11, wherein the one or more hardware components associated with the at least one electronic device are further configured to determine a strength for each of the one or more relationships, wherein the one or more relationships are inferred in response to determining that the strength for each of the one or more relationships exceed a threshold value.

16. The system of claim 15, wherein at least one of the relationships are not inferred in response to determining that the strength for the at least one relationship does not exceed the threshold value.

17. The system of claim 11, wherein the plurality of actions include one or more of actions that the computer system performs or actions that a user performs on the computer system.

18. The system of claim 11, wherein the chronological timeline for the plurality of actions comprises a first chronological timeline for a first computer system, and wherein the one or more hardware components associated with the at least one electronic device are further configured to:

monitor activity performed on a second computer system, wherein the monitored activity performed on the second computer system includes one or more actions performed on the second computer system and one or more objects accessed in the one or more actions performed on the second computer system;

determine a second chronological timeline for the one or more actions performed on the second computer system, wherein the one or more actions performed on the second computer system each occur at a respective chronological position in the second chronological timeline; and

display an aggregate timeline for the first computer system and the second computer system on the display device, wherein the aggregate timeline includes the plurality of actions performed on the first computer system and the one or more actions performed on the second computer system.

19. The system of claim 11, wherein the plurality of actions include each occur at a respective chronological position in the chronological timeline.

20. The system of claim 19, wherein the one or more hardware components associated with the at least one electronic device derives the one or more inferred relationships from the chronological positions for the plurality of actions in the chronological timeline.