US 10,567,535 B2Granted

Monitoring and alerting a user to variants from predicted patterns based on real time device analysis

AssigneeInternational Business Machines Corporation

InventorsDean T. Brown, Hernan A. Cunico, Martin G. Keen, David W. Messina

Life of this patent

Estimating the term…

Loading patent…

Abstract

A program product for detecting abnormal behavior of users is disclosed. A computer identifies first and second users based on user definitions and at least one personal device associated with the users. Activities of the users are monitored in real time based on the user definitions, location data received over a time series from the personal devices. A proximity distance, between the personal devices over the time series, is identified based on the location data. The computer generates movement patterns for the personal devices over the time series based on the location data and the proximity distance and creates a workflow. The computer compares the current location with the workflow in real time, and detects a deviation from the workflow in response to the comparing the current location in real time. The computer generates an alert in response to the detecting deviation in real time.

Claims20

Dependent claims

A method implemented by a computer in real time for detecting abnormal behavior of a plurality of users, the method comprising:

identifying, by a computer, a first user based on a first user definition and at least one first-user personal device associated with said first user;
identifying, by the computer, a second user based on a second user definition and at least one second-user personal device associated with said second user;
monitoring activities, by the computer in real time, of said first and second users based on said first and second user definitions, first location data received over a time series from said at least one first-user personal device, and second location data received over said time series from said at least one second-user personal device;
identifying, by the computer in real time, a proximity distance between said at least one first-user and said at least one second-user personal devices over said time series based on said first and second location data;
generating, by the computer in real time, a first movement pattern for said at least one first-user personal device and a second movement pattern for said at least one second-user personal device over said time series based on said first and second location data and said proximity distance;
creating, by the computer in real time, at least one workflow based on a comparison of said first and second movement patterns, said workflow associated with accomplishment of a task by at least one of said first user and second user, said workflow being indicative of relationships between past activities of said first and second users in accomplishing said task, said workflow including a checklist of features associated with said at least one workflow;
monitoring, by the computer in real time, a current location of both of said first and second users based on said at least one first-user personal device and said at least one second-user personal devices;
comparing, by the computer, said current location with said at least one workflow;
detecting, by the computer in real time, a deviation from said at least one workflow in response to said comparing said current location;
generating, by the computer in real time, an alert in response to said detecting said deviation;
providing said alert to at least one of said first and second users based at least in part on said current location and said relationships between past activities of said first and second users in accomplishing said task;
and
updating said workflow upon accomplishment of said task.

10 more elements

A system for detecting in real time abnormal behavior of a plurality of users, the system comprising:

a processor, wherein the processor is configured to perform:
identifying a first user based on a first user definition and at least one first-user personal device associated with said first user;
identifying a second user based on a second user definition and at least one second-user personal device associated with said second user;
monitoring activities of said first and second users based on said first and second user definitions and first location data received over a time series from said at least one first-user personal device and second location data received over said time series from said at least one second-user personal device in real time;
identifying a proximity distance between said at least one first-user and said at least one second-user personal devices over said time series based on said first and second location data in real time;
generating a first movement pattern for said at least one first-user personal device and a second movement pattern for said at least one second-user personal device over said time series based on said first and second location data and said proximity distance;
creating at least one workflow based on a comparison of said first and second movement patterns, said workflow associated with accomplishment of a task by at least one of said first user and said second user, said workflow being indicative of relationships between past activities of said first and second users in accomplishing said task, said workflow including a checklist of features associated with said at least one workflow;
monitoring a current location of at least one of said first and second users based on said at least one first-user personal device and said at least one second-user personal devices in real time;
comparing said current location with said at least one workflow in real time;
detecting a deviation from said at least one workflow in response to said comparing said current location;
generating an alert in response to said detecting said deviation in real time;
providing said alert to at least one of said first and second users based at least in part on said current location and said relationships between past activities of said first and second users in accomplishing said task;
and
updating said workflow upon accomplishment of said task.

11 more elements

A computer program product for detecting abnormal behavior of a plurality of users, the computer program product comprising a computer readable storage medium, the computer readable storage medium not being a propagating signal, the computer readable storage medium readable by a processing circuit and storing instructions run by the processing circuit for performing a method, said method comprising:

identifying a first user based on a first user definition and at least one first-user personal device associated with said first user;
identifying a second user based on a second user definition and at least one second-user personal device associated with said second user;
monitoring activities of said first and second users based on said first and second user definitions and first location data received over a time series from said at least one first-user personal device and second location data received over said time series from said at least one second-user personal device;
identifying a proximity distance between said at least one first-user and said at least one second-user personal devices over said time series based on said first and second location data;
generating a first movement pattern for said at least one first-user personal device and a second movement pattern for said at least one second-user personal device over said time series based on said first and second location data and said proximity distance;
creating at least one workflow based on a comparison of said first and second movement patterns, said workflow associated with accomplishment of a task by at least one of said first user and said second user, said workflow being indicative of relationships between past activities of said first and second users in accomplishing said task, said workflow including a checklist of features associated with said at least one workflow;
monitoring a current location of at least one of said first and second users based on said at least one first-user personal device and said at least one second-user personal devices in real time;
comparing said current location with said at least one workflow in real time;
detecting a deviation from said at least one workflow in response to said comparing said current location;
generating an alert in response to said detecting said deviation in real time;
providing said alert based at least in part on current location and said relationships between past activities of said first and second users in accomplishing said task;
and
updating said workflow upon accomplishment of said task.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/417,885Filed 27 Jan 2017
Published: US 2018/0219759 A12 Aug 2018
Granted: 18 Feb 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

H04L 67/55
Network services: push-based network services
G06Q 10/109
Office automation; Time management: time management, e.g. calendars, reminders, meetings or time accounting
H04L 67/52
Network services: specially adapted for the location of the user terminal
H04L 43/06
Arrangements for monitoring or testing data switching networks: generation of reports