Detecting abnormal data access based on data similarity

A system for monitoring network traffic in a network:

• one or more network monitoring computers (NM Cs), comprising:
• a memory that stores at least instructions;
• and
• one or more processors that execute instructions that are configured to cause performance of actions, including:
• collecting one or more values that summarize one or more characteristics of a document access activity based on one or more summarization models that are trained to determine the one or more values;
• obtaining two or more documents that are similar to each other based on one or more recognition models that are trained to identify one or more common characteristics of the two or more documents;
• obtaining a quality score associated with each summarization model that is below a threshold value to initiate retraining of one or more portions of the one or more summarization models, wherein the retraining employs one or more rules for an exclusion or an inclusion of a document type, a directory, a similar document, or an application that is associated with the document access activity;
• and
• displaying a user interface that includes one or more reports that are specifically collected for a particular user based on a particular document access activity of interest, wherein the user interface displays one or more interactive controls to collect feedback from the particular user regarding the particular document activity of interest, and wherein the collected feedback is used to retrain the one or more summarization models and the one or more recognition models;
• and
• one or more client computers, comprising:
• a memory that stores at least instructions;
• and
• one or more processors that execute instructions that perform actions, including:
• performing the document access activity.

A network monitoring computer (NMC) for monitoring network traffic between one or more computers, comprising:

• a memory that stores at least instructions;
• and
• one or more processors that execute instructions that are configured to cause performance of actions, including:
• collecting one or more values that summarize one or more characteristics of a document access activity based on one or more summarization models that are trained to determine the one or more values;
• obtaining two or more documents that are similar to each other based on one or more recognition models that are trained to identify one or more common characteristics of the two or more documents;
• obtaining a quality score associated with each summarization model that is below a threshold value to initiate retraining of one or more portions of the one or more summarization models, wherein the retraining employs one or more rules for an exclusion or an inclusion of a document type, a directory, a similar document, or an application that is associated with the document access activity;
• and
• displaying a user interface that includes one or more reports that are specifically collected for a particular user based on a particular document access activity of interest, wherein the user interface displays one or more interactive controls to collect feedback from the particular user regarding the particular document activity of interest, and wherein the collected feedback is used to retrain the one or more summarization models and the one or more recognition models.

A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions, by the one or more networking monitoring computers, are configured to cause performance of the method, comprising:

• collecting one or more values that summarize one or more characteristics of a document access activity based on one or more summarization models that are trained to determine the one or more values;
• obtaining two or more documents that are similar to each other based on one or more recognition models that are trained to identify one or more common characteristics of the two or more documents;
• obtaining a quality score associated with each summarization model that is below a threshold value to initiate retraining of one or more portions of the one or more summarization models, wherein the retraining employs one or more rules for an exclusion or an inclusion of a document type, a directory, a similar document, or an application that is associated with the document access activity;
• and
• displaying a user interface that includes one or more reports that are specifically collected for a particular user based on a particular document access activity of interest, wherein the user interface displays one or more interactive controls to collect feedback from the particular user regarding the particular document activity of interest, and wherein the collected feedback is used to retrain the one or more summarization models and the one or more recognition models.