Analyzing behavior in light of social time

• US 9,542,650 B2
• Filed: 01/06/2014
• Issued: 01/10/2017
• Est. Priority Date: 03/01/2013
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Forcepoint LLC)
• Original Assignee: Redowl Analytics, Inc. (Forcepoint LLC)
• Inventors: Lospinoso, Josh, Filippelli, Guy Louis
• Primary Examiner(s): Starks, Wilbert L
• Application Number:
  US14/148,346
• Publication Number:
  US 20140250050A1
• Time in Patent Office: 1,100 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/022 Knowledge engineering; Knowledge acquisition
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 5/048 Fuzzy inferencing
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: G06Q 30/0201 Market modelling; Market analysis; Collecting market data

Abstract

A relational event history is determined based on a data set, the relational event history including a set of relational events that occurred in time among a set of actors. Data is populated in a probability model based on the relational event history, where the probability model is formulated as a series of conditional probabilities that correspond to a set of sequential decisions by an actor for each relational event, where the probability model includes one or more statistical parameters and corresponding statistics, and where at least one of the one or more statistics is determined using a decay function. A baseline communications behavior for the relational event history is determined based on the populated probability model, and, based on a second set of values for the statistical parameters, departures within the relational event history from the baseline communications behavior are determined.

Claims

1. A method comprising:

determining a relational event history based on a data set, the relational event history comprising a set of relational events that occurred in time among a set of actors;

populating data in a probability model based on the relational event history, wherein the probability model is formulated as a series of conditional probabilities that correspond to a set of sequential decisions by an actor for each relational event, wherein the probability model includes one or more statistical parameters and corresponding statistics, and wherein at least one of the one or more statistics is determined using a decay function;

determining, by one or more processing devices, a baseline communications behavior for the relational event history based on the populated probability model, wherein the baseline comprises a first set of values for the one or more statistical parameters; and

determining, based on a second set of values for the statistical parameters, departures from the baseline communications behavior within the relational event history, wherein the second set of values for the statistical parameters are determined based on one or more subsets of the relational events included in the relational event history.

2. The method of claim 1, wherein the one or more statistics relate to one or more of senders of relational events, modes of relational events, topics of relational events, or recipients of relational events.

3. The method of claim 1, wherein, to determine the at least one statistic using a decay function, the method comprises:

selecting a subset of one or more relational events from the relational event history;

determining, based on the decay function, weights for the one or more relational events contained in the selected subset of relational events;

weighting the selected subset of relational events based on the determined weights; and

determining, based on the weighted relational events, the at least one statistic.

4. The method of claim 3 wherein a weight determined for a relational event indicates the impact of the relational event on the probability of a future relational event'"'"'s occurrence.

5. The method of claim 3, wherein the decay function is configured to determine weights for relational events based on clock time.

6. The method of claim 3, wherein the decay function is configured to determine weights for relational events based on social time.

7. The method of claim 6, wherein the decay function is configured to determine weights for the one or more relational events contained in the selected subset of relational events by determining a weight for a first relational event based on a number of relational events in the selected subset that occurred between the first relational event and a second relational event.

8. The method of claim 6, wherein the decay function is configured to determine weights for the one or more relational events contained in the selected subset of relational events by determining a weight for a first relational event based on a number of relational events in the selected subset that involved the actor and that occurred between the first relational event and a second relational event.

9. The method of claim 6, wherein the decay function is configured to determine weights for the one or more relational events contained in the selected subset of relational events by determining a weight for a first relational event based on a number of relational events in the selected subset that were sent by the actor and that occurred between the first relational event and a second relational event.

10. The method of claim 1, further comprising outputting, based on one or more user inputs, graphical analyses of the relational event history, wherein the one or more user inputs include inputs relating to a hypothesis regarding communications behavior within the relational event history, and wherein the output graphical analyses include one or more graphics representing determined departures from the determined baseline communications behavior.

11. A system comprising:

one or more processing devices; and

one or more non-transitory computer-readable media coupled to the one or more processing devices having instructions stored thereon which, when executed by the one or more processing devices, cause the one or more processing devices to perform operations comprising;

determining a relational event history based on a data set, the relational event history comprising a set of relational events that occurred in time among a set of actors;

populating data in a probability model based on the relational event history, wherein the probability model is formulated as a series of conditional probabilities that correspond to a set of sequential decisions by an actor for each relational event, wherein the probability model includes one or more statistical parameters and corresponding statistics, and wherein at least one of the one or more statistics is determined using a decay function;

determining, by one or more processing devices, a baseline communications behavior for the relational event history based on the populated probability model, wherein the baseline comprises a first set of values for the one or more statistical parameters; and

determining, based on a second set of values for the statistical parameters, departures from the baseline communications behavior within the relational event history, wherein the second set of values for the statistical parameters are determined based on one or more subsets of the relational events included in the relational event history.

12. The system of claim 11, wherein the one or more statistics relate to one or more of senders of relational events, modes of relational events, topics of relational events, or recipients of relational events.

13. The system of claim 11, wherein, to determine the at least one statistic using a decay function, the method comprises:

selecting a subset of one or more relational events from the relational event history;

determining, based on the decay function, weights for the one or more relational events contained in the selected subset of relational events;

weighting the selected subset of relational events based on the determined weights; and

determining, based on the weighted relational events, the at least one statistic.

14. The system of claim 13, wherein a weight determined for a relational event indicates the impact of the relational event on the probability of a future relational event'"'"'s occurrence.

15. The system of claim 13, wherein the decay function is configured to determine weights for relational events based on clock time.

16. The system of claim 13, wherein the decay function is configured to determine weights for relational events based on social time.

17. The system of claim 16, wherein the decay function is configured to determine weights for the one or more relational events contained in the selected subset of relational events by determining a weight for a first relational event based on a number of relational events in the selected subset that occurred between the first relational event and a second relational event.

18. The system of claim 16, wherein the decay function is configured to determine weights for the one or more relational events contained in the selected subset of relational events by determining a weight for a first relational event based on a number of relational events in the selected subset that involved the actor and that occurred between the first relational event and a second relational event.

19. The system of claim 16, wherein the decay function is configured to determine weights for the one or more relational events contained in the selected subset of relational events by determining a weight for a first relational event based on a number of relational events in the selected subset that were sent by the actor and that occurred between the first relational event and a second relational event.

20. A non-transitory computer-readable medium embodying one or more instructions thereon which, when executed, cause one or more computer processors to perform steps comprising:

determining a relational event history based on a data set, the relational event history comprising a set of relational events that occurred in time among a set of actors;

populating data in a probability model based on the relational event history, wherein the probability model is formulated as a series of conditional probabilities that correspond to a set of sequential decisions by an actor for each relational event, wherein the probability model includes one or more statistical parameters and corresponding statistics, and wherein at least one of the one or more statistics is determined using a decay function;

determining, by one or more processing devices, a baseline communications behavior for the relational event history based on the populated probability model, wherein the baseline comprises a first set of values for the one or more statistical parameters; and

determining, based on a second set of values for the statistical parameters, departures from the baseline communications behavior within the relational event history, wherein the second set of values for the statistical parameters are determined based on one or more subsets of the relational events.