SYSTEMS AND USER INTERFACES FOR DYNAMIC AND INTERACTIVE INVESTIGATION OF BAD ACTOR BEHAVIOR BASED ON AUTOMATIC CLUSTERING OF RELATED DATA IN VARIOUS DATA STRUCTURES

• US 20160253750A1
• Filed: 05/11/2016
• Published: 09/01/2016
• Est. Priority Date: 12/22/2014
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Visbal, Alexander, Thompson, James, Sum, Marvin, Ma, Jason, Fu, Bing Jie, Nepomnyashchiy, Ilya, Witherspoon, Devin, Lai, Victoria, Berler, Steven, Smaliy, Alexei, Lee, Suchan
• Granted Patent: US 9,589,299 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1036 for multiple virtual address spaces, e.g. segmentation G06F12/1045 takes precedence
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/287 Visualization; Browsing
• CPC Class Codes: G06F 16/34 Browsing; Visualisation therefor
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 18/23 Clustering techniques
• CPC Class Codes: G06F 18/40 Software arrangements specially adapted for pattern recognition, e.g. user interfaces or toolboxes therefor
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, automatically tag and group those clustered data structures, and provide results of the automated analysis and grouping in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a tiled display of the groups of related data clusters such that the analyst may quickly and efficiently evaluate the groups of data clusters. In particular, the groups of data clusters may be dynamically re-grouped and/or filtered in an interactive user interface so as to enable an analyst to quickly navigate among information associated with various groups of data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation.

Claims

1. A computer system comprising:

one or more non-transitory computer readable storage devices configured to store;

a plurality of computer executable instructions; and

a plurality of data clusters, each data cluster including a respective one or more data items and associated metadata, each data cluster further associated with a respective one or more tag types and a respective tag value for each of the one or more tag types; and

one or more hardware computer processors in communication with the one or more non-transitory computer readable storage devices and configured to execute the plurality of computer executable instructions in order to;

generate user interface data for rendering a user interface on a computing device, the user interface including one or more selectable elements useable by a user for indicating a tag type;

in response to receiving an indication of a first tag type, update the user interface data such that the user interface further includes a plurality of first tiles, wherein;

the plurality of first tiles are arranged across a portion of the user interface,

each of the first tiles represents a different tag value of the first tag type,

each of the first tiles displays a time-based graph showing events associated with data clusters associated with the respective tag values of the respective first tiles,

each of the time-based graphs of the first tiles includes at least one common axis and a common range for the at least one common axis; and

in response to selection of a tile of the plurality of first tiles, update the user interface data such that, in the user interface, the time-based graph associated with the selected tile is resized to be displayed entirely horizontally across the portion of the user interface while maintaining the common axis and common range previously displayed by the selected tile.

2. The computer system of claim 1, wherein the one or more hardware computer processors are further configured to execute the plurality of computer executable instructions in order to:

for each data cluster of the plurality of data clusters;

determine a data cluster type associated with the data cluster;

associate one or more tag types with the data cluster based on data cluster tagging rules associated with the determined data cluster type; and

for each tag type of the one or more tags types, associate at least one tag value with the tag type based at least in part on one or more data items of the data cluster.

3. The computer system of claim 1, wherein associating one or more tag types with the particular data cluster comprises:

determining one or more tag types associated with the data cluster type.

4. The computer system of claim 3, wherein associating one or more tag types with the particular data cluster further comprises:

analyzing the particular data cluster to identify one or more tag values to associate with at least one of the one or more tag types.

5. The computer system of claim 1, wherein each of the first tiles indicates a number of critical alerts associated with the respective first tiles.

6. The computer system of claim 1, wherein the plurality of first tiles are arranged in the portion of the user interface in order of number of critical alerts.

7. The computer system of claim 1, wherein the plurality of first tiles are colored to represent a tag value having more or fewer critical alerts.

8. The computer system of claim 1, wherein the time-based graphs represent a merger or aggregation of a plurality of data items associated with data clusters associated with the respective tag values of the respective first tiles.

9. The computer system of claim 1, wherein the interactive user interface further includes one or more selectable filter criteria, wherein the one or more hardware computer processors are further configured to execute the plurality of computer executable instructions in order to:

filter the plurality of data clusters based on one or more filter criteria.

10. The computer system of claim 9, wherein the one or more hardware computer processors are further configured to execute the plurality of computer executable instructions in order to:

receive an indication of the one or more filter criteria via a user selection of at least one of the one or more selectable filter criteria.

11. The computer system of claim 9, wherein the one or more selectable filter criteria include at least one of a tag value, a cluster type, or a state.

12. The computer system of claim 11, wherein the one or more hardware computer processors are further configured to execute the plurality of computer executable instructions in order to:

further in response to receiving the indication of the first tag type;

identify one or more data clusters associated with the first tag type; and

generate a plurality of first groups of the one or more identified data clusters, wherein each of the first groups is associated with a different common tag value of the first tag type.

13. The computer system of claim 12, wherein:

filtering the plurality of data clusters comprises determining a subset of data clusters of the plurality of data clusters satisfying the one or more filter criteria, and

generating the plurality of first groups of the plurality of data clusters is based on the subset of data clusters.

14. The computer system of claim 9, wherein filter criteria of the one or more filter criteria of the same type are applied disjunctively when filtering the plurality of data clusters.

15. The computer system of claim 14, wherein filter criteria of the one or more filter criteria of different types are applied conjunctively when filtering the plurality of data clusters.

16. The computer system of claim 1, wherein the one or more hardware computer processors are further configured to execute the plurality of computer executable instructions in order to:

determine the one or more selectable elements based on one or more tag types associated with a type of investigation to be performed by the user.

17. The computer system of claim 1, wherein the user interface further includes one or more selectable assignable states, wherein the one or more hardware computer processors are further configured to execute the plurality of computer executable instructions in order to:

receive an indication of one of the assignable states via a user selection of one of the one or more selectable assignable states;

associate one or more groups of data clusters with the indicated one of the assignable states.