Analyzing User Activity with Respect to a Composite Object

A non-transitory computer readable medium having stored therein instructions executable by a processor, wherein the instructions are executable to:

• generate clusters of events in a list of events occurring with respect to a composite object including a first object and a second object, wherein the list of events is generated from a first set of event reports and a second set of event reports, wherein each event in the first set of event reports represents a respective event occurring with respect to the first object, wherein each event in the second set of event reports represents a respective event occurring with respect to the second object, wherein generating the clusters of events occurring with respect to the composite object is based on respective times of occurrence of the events, wherein a time interval between consecutive events in a particular cluster is not greater than a pre-determined time interval;
• generate, using the clusters of events, an analysis of user activity with respect to the composite object, wherein generating the analysis of user activity includes determining one or more features based on a given type of the analysis of the user activity to be generated;
• and
• provide notification to an alert server based on an alert configuration when the analysis of user activity with respect to the composite object indicates a particular behavior.

A system including:

• a computing device, wherein the computing device is configured to:
• generate clusters of events in a list of events occurring with respect to a composite object including a first object and a second object, wherein the list of events is generated from a first set of event reports and a second set of event reports, wherein each event in the first set of event reports represents a respective event occurring with respect to the first object, wherein each event in the second set of event reports represents a respective event occurring with respect to the second object, wherein generating the clusters of events occurring with respect to the composite object is based on respective times of occurrence of the events, wherein a time interval between consecutive events in a particular cluster is not greater than a pre-determined time interval;
• generate, using the clusters of events, an analysis of user activity with respect to the composite object, wherein generating the analysis of user activity includes determining one or more features based on a given type of the analysis of the user activity to be generated;
• and
• provide notification to an alert server based on an alert configuration when the analysis of user activity with respect to the composite object indicates a particular behavior.