Adaptive behavior profiling and anomaly scoring through continuous learning
AssigneeInternational Business Machines Corporation
InventorsPau-Chen Cheng, Lawrence Koved, Kapil K. Singh
Life of this patent
Estimating the term…
Abstract
Generating a behavior profile is provided. A newness score is calculated for a data point corresponding to a context of an access request to a resource made by a user of a client device. Newness scores for a plurality of data points corresponding to contexts of a plurality of access requests are aggregated to form an aggregated newness score. In response to determining that the aggregated newness score is greater than or equal to a pre-defined newness score threshold, data points stored in a data point cache and a long-term storage are used to generate a new behavior profile for the user or update an existing behavior profile for the user.
Claims19
A computer-implemented method for generating a behavior profile, the computer-implemented method comprising:
- calculating, by a computer, a newness score for a newly received data point in a data point cache corresponding to a context of an access request to a resource made by a user of a client device;
- generating, by the computer, a fuzzy set of data points corresponding to the newly received data point using a pre-determined number of previously cached data points within a pre-defined distance measure from the newly received data point in the data point cache;
- aggregating, by the computer, newness scores for a plurality of data points corresponding to contexts of a plurality of access requests made by the user to form an aggregated newness score;
- and
- responsive to the computer determining that the aggregated newness score is greater than or equal to a pre-defined newness score threshold, generating, by the computer, the behavior profile identifying a behavior pattern of the user that corresponds to the plurality of access requests made by the user using the fuzzy set of data points within the pre-defined distance measure from the newly received data point in the data point cache.
A computer system for generating a behavior profile, the computer system comprising:
- a bus system;
- a storage device connected to the bus system, wherein the storage device stores program instructions;
- and
- a processor connected to the bus system, wherein the processor executes the program instructions to:
- calculate a newness score for a newly received data point in a data point cache corresponding to a context of an access request to a resource made by a user of a client device;
- generate a fuzzy set of data points corresponding to the newly received data point using a pre-determined number of previously cached data points within a pre-defined distance measure from the newly received data point in the data point cache;
- aggregate newness scores for a plurality of data points corresponding to contexts of a plurality of access requests made by the user to form an aggregated newness score;
- and
- generate the behavior profile identifying a behavior pattern of the user that corresponds to the plurality of access requests made by the user using the fuzzy set of data points within the pre-defined distance measure from the newly received data point in the data point cache in response to determining that the aggregated newness score is greater than or equal to a pre-defined newness score threshold.
A computer program product for generating a behavior profile, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
- calculating, by the computer, a newness score for a newly received data point in a data point cache corresponding to a context of an access request to a resource made by a user of a client device;
- generating, by the computer, a fuzzy set of data points corresponding to the newly received data point using a pre-determined number of previously cached data points within a pre-defined distance measure from the newly received data point in the data point cache;
- aggregating, by the computer, newness scores for a plurality of data points corresponding to contexts of a plurality of access requests made by the user to form an aggregated newness score;
- and
- responsive to the computer determining that the aggregated newness score is greater than or equal to a pre-defined newness score threshold, generating, by the computer, the behavior profile identifying a behavior pattern of the user that corresponds to the plurality of access requests made by the user using the fuzzy set of data points within the pre-defined distance measure from the newly received data point in the data point cache.
Dependencies are inferred from the claim text.