Method and system for website user account management based on event transition matrixes

• US 8,966,036 B1
• Filed: 11/24/2010
• Issued: 02/24/2015
• Est. Priority Date: 11/24/2010
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Southey, Finnegan, Asgekar, Amogh, Panesar, Kiran Singh
• Primary Examiner(s): Joo, Joshua
• Assistant Examiner(s): Naji, Younes
• Application Number:
  US12/954,470
• Time in Patent Office: 1,553 Days
• US Class Current: 709/223
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 4/08 User group management

Abstract

A method for categorizing multiple users of a website based on their respective transition patterns between successive types of user activities is implemented at a computing device having one or more processors and memory. After receiving one or more log files from a data source, the computing device generates respective event transition matrixes for multiple users in accordance with the users'"'"' event records such that each element of each respective event transition matrix includes a probability of an occurrence of two consecutive event types A and B for the same user. Based on an analysis of the multiple users'"'"' event transition matrixes, the computing device categorizes the multiple users into at least two distinct groups of users and performs one or more operations to the website'"'"'s user accounts associated with one or more users from one of the groups.

Claims

1. A method, comprising:

at a computing system having one or more processors and memory storing programs executed by the one or more processors;

accessing event records associated with multiple users of a website, each event record identifying a respective user activity at the website and having an associated event type;

generating a respective event transition matrix for each of the multiple users, each respective event transition matrix being generated in accordance with a respective user'"'"'s event records;

wherein each element of each respective event transition matrix includes a probability of an occurrence of two consecutive event types A and B for the respective user;

wherein at least one element of each respective event transition matrix corresponds to two distinct event types;

wherein event type A has occurred at least once during a predefined time period; and

wherein the probability of the occurrence of the two consecutive event types A and B for a respective user is, at least in part, dependent on a count of the occurrence of the two consecutive event types A and B during the predefined time period divided by a count of the occurrence of the event type A during the predefined time period;

categorizing the multiple users into at least two distinct groups of users based on an analysis of the multiple users'"'"' event transition matrixes; and

performing one or more operations to user accounts of the website, the user accounts being associated with one or more users from one of the at least two distinct groups of users.

2. The method of claim 1, wherein the event transition matrixes are two- dimensional.

3. The method of claim 1, wherein categorizing the multiple users further includes:

accessing additional event records associated with one or more respective users of the multiple users during a first predefined time period;

updating the respective event transition matrixes of the one or more respective users using the additional event records;

repeating said receiving and updating for a plurality of additional predefined time periods; and

re-categorizing one or more of the multiple users using one or more of the updated event transition matrixes.

4. The method of claim 1, wherein each row and column of a respective event transition matrix corresponds to a distinct event type selected from the group consisting of user account access, user profile management, content generation, content visit, content retrieval, and user communication.

5. The method of claim 1, wherein the probability of the occurrence of the two consecutive event types A and B for the respective user has an associated confidence level that is, at least in part, dependent on the count of the occurrence of the two consecutive event types A and B during the predefined time period.

6. The method of claim 1, wherein the analysis includes determining a similarity metric between first and second event transition matrixes based on the probability differences between elements of the first event transition matrix and corresponding elements of the second event transition matrix, each respective probability difference being an absolute difference between a first probability at an element of the first event transition matrix and a second probability at a corresponding element of the second event transition matrix and each probability corresponding to a respective pair of consecutive event types.

7. The method of claim 6, wherein a respective probability difference is weighted by at least one of a confidence level for the first probability and a confidence level for the second probability.

8. The method of claim 6, wherein a respective probability difference is weighted by a minimum of a confidence level for the first probability and a confidence level for the second probability.

9. The method of claim 1, wherein categorizing the multiple users comprises:

determining a similarity metric between a respective user'"'"'s event transition matrix and a predefined event transition matrix, wherein the predefined event transition matrix is configured to represent a malicious attack of the website; and

identifying the respective user as being associated with the malicious attack if the determined similarity metric satisfies a criterion with respect to a predefined threshold.

10. The method of claim 9, wherein the criterion specifies that the similarity metric is greater than the predefined threshold.

11. The method of claim 1, wherein categorizing the multiple users comprises:

for each pair of a first user and a second user of the multiple users, determining a similarity metric between the first user'"'"'s event transition matrix and the second user'"'"'s event transition matrix;

analyzing the similarity metrics associated with different pairs of users; and

in accordance with the analysis of the similarity metrics, identifying a group of users whose similarity metrics satisfy one or more predefined clustering criteria.

12. The method of claim 1, wherein performing the one or more operations comprises restricting access to the website by a respective group of users of the at least two distinct groups of users.

13. The method of claim 1, wherein the website is a social network website.

14. The method of claim 1, wherein the analysis includes determining a similarity metric between first and second event transition matrixes based on the probability differences between elements of the first event transition matrix and corresponding elements of the second event transition matrix.

15. A computer system, comprising:

one or more processors; and

memory storing one or more programs configured for execution by the one or more processors to perform the following operations;

accessing event records associated with multiple users of a website, each event record identifying a respective user activity at the website and having an event type;

generating a respective event transition matrix for each of the multiple users, each respective event transition matrix being generated in accordance with a respective user'"'"'s event records;

wherein each element of each respective event transition matrix includes a probability of an occurrence of two consecutive event types A and B for the respective user;

wherein at least one element of each respective event transition matrix corresponds to two distinct event types;

wherein event type A has occurred at least once during a predefined time period; and

wherein the probability of the occurrence of the two consecutive event types A and B for a respective user is, at least in part, dependent on a count of the occurrence of the two consecutive event types A and B during the predefined time period divided by a count of the occurrence of the event type A during the predefined time period;

categorizing the multiple users into at least two distinct groups of users based on an analysis of the multiple users'"'"' event transition matrixes; and

performing one or more operations to user accounts of the website, the user accounts being associated with one or more users from one of the at least two distinct groups of users.

16. The system of claim 15, wherein categorizing the multiple users further includes:

accessing additional event records associated with one or more respective users of the multiple users during a first predefined time period;

updating the respective event transition matrixes of the one or more respective users using the additional event records;

repeating said receiving and updating for a plurality of additional predefined time periods; and

re-categorizing one or more of the multiple users using one or more of the updated event transition matrixes.

17. The system of claim 15, wherein each row and column of a respective event transition matrix corresponds to a distinct event type selected from the group consisting of user account access, user profile management, content generation, content visit, content retrieval, and user communication.

18. The system of claim 15, wherein the analysis includes determining a similarity metric between first and second event transition matrixes based on the probability differences between elements of the first event transition matrix and corresponding elements of the second event transition matrix, each respective probability difference being an absolute difference between a first probability at an element of the first event transition matrix and a second probability at a corresponding element of the second event transition matrix and each probability corresponding to a respective pair of consecutive event types.

19. The system of claim 18, wherein a respective probability difference is weighted by at least one of a confidence level for the first probability and a confidence level for the second probability.

20. A non-transitory computer-readable storage medium storing one or more programs for execution by one or more processors of a computing system, the one or more programs comprising instructions for:

accessing event records associated with multiple users of a website, each event record identifying a respective user activity at the website and having an event type;

generating a respective event transition matrix for each of the multiple users, each respective event transition matrix being generated in accordance with a respective user'"'"'s event records;

wherein each element of each respective event transition matrix includes a probability of an occurrence of two consecutive event types A and B for the respective user;

wherein at least one element of each respective event transition matrix corresponds to two distinct event types;

wherein event type A has occurred at least once during a predefined time period; and

wherein the probability of the occurrence of the two consecutive event types A and B for a respective user is, at least in part, dependent on a count of the occurrence of the two consecutive event types A and B during the predefined time period divided by a count of the occurrence of the event type A during the predefined time period;

categorizing the multiple users into at least two distinct groups of users based on an analysis of the multiple users'"'"' event transition matrixes; and

performing one or more operations to user accounts of the website, the user accounts being associated with one or more users from one of the at least two distinct groups of users.

21. The storage medium of claim 20, wherein categorizing the multiple users further includes:

accessing additional event records associated with one or more respective users of the multiple users during a first predefined time period;

updating the respective event transition matrixes of the one or more respective users using the additional event records;

repeating said receiving and updating for a plurality of additional predefined time periods; and

re-categorizing one or more of the multiple users using one or more of the updated event transition matrixes.

22. The storage medium of claim 20, wherein each row and column of a respective event transition matrix corresponds to a distinct event type selected from the group consisting of user account access, user profile management, content generation, content visit, content retrieval, and user communication.

23. The storage medium of claim 20, wherein the analysis includes determining a similarity metric between first and second event transition matrixes based on the probability differences between elements of the first event transition matrix and corresponding elements of the second event transition matrix, each respective probability difference being an absolute difference between a first probability at an element of the first event transition matrix and a second probability at a corresponding element of the second event transition matrix and each probability corresponding to a respective pair of consecutive event types.

24. The storage medium of claim 23, wherein a respective probability difference is weighted by at least one of a confidence level for the first probability and a confidence level for the second probability.