System and method of searching for classifying user activity performed on a computer system

• US 7,707,284 B2
• Filed: 06/21/2006
• Issued: 04/27/2010
• Est. Priority Date: 08/03/2005
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Friedman, Nathaniel Dourif, Trowbridge, Jon Eric
• Primary Examiner(s): NEURAUTER, GEORGE C
• Application Number:
  US11/471,631
• Publication Number:
  US 20070033187A1
• Time in Patent Office: 1,406 Days
• Field of Search: 709/224, 707/6
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 16/337 Profile generation, learning or modification
• CPC Class Codes: G06F 16/338 Presentation of query results
• CPC Class Codes: G06F 16/40 of multimedia data, e.g. slideshows comprising image and additional audio data retrieval of still image data G06F16/50; retrieval of audio data G06F16/60; retrieval of video data G06F16/70
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: Y10S 707/99936 Pattern matching access

Abstract

The invention is directed to a system and method of managing information associated with user actions. A monitoring system may gather and store information associated with user actions. Relationships may be inferred between user actions based on time or other criteria. A user may define classifications of user actions. These classifications may be used to retrieve information associated with user actions.

Claims

1. A method for classifying activity performed on a computer system, comprising:

defining a plurality of categories for classifying, the activity performed on the computer system using at least one electronic device coupled to the computer system;

monitoring, by the at least one electronic device;

the activity performed on the computer system, wherein the monitored activity includes a plurality of actions performed on the computer system and a plurality of objects accessed in the plurality of actions performed on the computer system;

determining, by the at least one electronic device a chronological timeline for the plurality of actions performed on the computer system, wherein the plurality of actions each occur at a respective chronological position in the chronological timeline;

inferring, by the at least one electronic device, one or more relationships between the plurality of objects and the plurality of actions in the chronological timeline, wherein the one or more inferred relationships are derived from the chronological positions for the plurality of actions in the chronological timeline; and

classifying, by the at least one electronic device, each of the plurality of objects and each of the plurality of actions in one or more of the plurality of categories based on the one or more inferred relationships;

determining, by the at least one electronic device, a strength for each of the one or more inferred relationships based on one or more of frequencies, simultaneous occurrences, sequential occurrences, durations, or temporal proximities associated with the plurality of actions in the chronological timeline, wherein the one or more inferred relationships are inferred in response to determining that the strength for each of the one or more relationships exceed a threshold value; and

displaying the one or more inferred relationships and their respective chronological positions in the chronological timeline on a display as a timeline.

2. The method according to claim 1, further comprising searching, by the at least one electronic device, the activity performed on the computer system for one or more of the plurality of actions that are classified in one or more of the plurality of categories.

3. The method according to claim 1, further comprising searching, by the at least one electronic device, the activity performed on the computer system for one or more of the plurality of objects that are classified in one or more of the plurality of categories.

4. The method according to claim 1, wherein a first one of the plurality of categories is nested within a second one of the plurality of categories.

5. The method according to claim 1, wherein the plurality of actions include one or more actions that the computer system performs and one or more actions that a user performs on the computer system.

6. The method according to claim 5, wherein the plurality of objects accessed in the plurality of actions include one or more of applications, documents, files, electronic mail messages, chat sessions, web sites, address book entries, or calendar entries.

7. The method according to claim 1, wherein at least one of the relationships are not inferred in response to determining that the strength for the at least one relationship does not exceed the threshold value.

8. The method according to claim 1, wherein the chronological timeline for the plurality of actions comprises a first chronological timeline for a first computer system, and wherein the method further comprises:

monitoring, by the at least one electronic device, activity performed on a second computer system, wherein the monitored activity performed on the second computer system includes one or more actions performed on the second computer system and one or more objects accessed in the one or more actions performed on the second computer system;

determining, by the at least one electronic device, a second chronological timeline for the one or more actions performed on the second computer system, wherein the one or more actions performed on the second computer system each occur at a respective chronological position in the second chronological timeline; and

displaying, by the at least one electronic device, an aggregate timeline for the first computer system and the second computer system, wherein the aggregate timeline includes the plurality of actions performed on the first computer system and the one or more actions performed on the second computer system.

9. A system for classifying activity performed on a computer system, wherein the system comprises at least one electronic device configured to:

define a plurality of categories for classifying the activity performed on the computer system;

monitor the activity performed on the computer system, wherein the monitored activity includes a plurality of actions performed on the computer system and a plurality of objects accessed in the plurality of actions performed on the computer system;

determine a chronological timeline for the plurality of actions performed on the computer system, wherein the plurality of actions each occur at a respective chronological position in the chronological timeline;

infer one or more relationships between the plurality of objects and the plurality of actions in the chronological timeline, wherein the at least one electronic device derives the one or more inferred relationships from the chronological positions for the plurality of actions in the chronological timeline; and

classify each of the plurality of objects and each of the plurality of actions in one or more of the plurality of categories based on the one or more inferred relationships;

determine, by the at least one electronic device, a strength for each of the one or more inferred relationships based on one or more of frequencies, simultaneous occurrences, sequential occurrences, durations, or temporal proximities associated with the plurality of actions in the chronological timeline, wherein the one or more inferred relationships are inferred in response to determining that the strength for each of the one or more relationships exceed a threshold value; and

display the one or more inferred relationships and their respective chronological positions in the chronological timeline on a display as a timeline.

10. The system according to claim 9, wherein the at least one electronic device is further configured to search the activity performed on the computer system for one or more of the plurality of actions that are classified in one or more of the plurality of categories.

11. The system according to claim 9, wherein the at least one electronic device is further configured to search the performed on the computer system for one or more of the plurality of objects that are classified in one or more of the plurality of categories.

12. The system according to claim 9, wherein a first one of the plurality of categories is nested within a second one of the plurality of categories.

13. The system according to claim 9, wherein the plurality of actions include one or more actions that the computer system performs and one or more actions that a user performs on computer system.

14. The system according to claim 13, wherein the plurality of objects accessed in the plurality of actions include one or more of applications, documents, files, electronic mail messages, chat sessions, web sites, address book entries, or calendar entries.

15. The system according to claim 9, wherein at least one of the relationships are not inferred in response to determining that the strength for the at least one relationship does not exceed the threshold value.

16. The system according to claim 9, wherein the chronological timeline for the plurality of actions comprises a first chronological timeline for a first computer system, and wherein the at least one electronic device is further configured to:

monitor activity performed on a second computer system, wherein the monitored activity performed on the second computer system includes one or more actions performed on the second computer system and one or more objects accessed in the one or more actions performed on the second computer system;

determine a second chronological timeline for the one or more actions performed on the second computer system, wherein the one or more actions performed on the second computer system each occur at a respective chronological position in the second chronological timeline; and

display an aggregate timeline for the first computer system and the second computer system, wherein the aggregate timeline includes the plurality of actions performed on the first computer system and the one or more actions performed on the second computer system.