Patent ID: 9479518
Filing Date: 2016-10-25
CPC Classification: G06F,H04L

Claim Text:
1. A method of detecting anomalous behavior, comprising: receiving resource access data indicating for each resource in a set of resources respective usage data for each of one or more users of the resource; using a processor to perform hierarchical clustering analysis to determine at each of two or more hierarchical levels a set of one or more clusters of users, resources, or both, wherein using the processor to perform hierarchical clustering analysis includes performing a K-D partitioning of the resource access data to create a K-D tree, wherein using the processor to perform hierarchical clustering analysis further includes segmenting the K-D tree into a plurality of sub-trees, and performing a minimax linkage hierarchical clustering analysis of each sub-tree; computing a level-specific anomaly score at each of said two or more hierarchical levels, wherein the level-specific anomaly score at each of said two or more hierarchical levels is based at least in part on anomalous behavior of the resource access data of a corresponding hierarchical level, wherein anomalous behavior of one of said two or more hierarchical levels is different than anomalous behavior of another of said two or more hierarchical levels; aggregating the level-specific anomaly scores across said two or more hierarchical levels to determine an aggregate anomaly score; and using the aggregate anomaly score to determine whether an anomaly has been detected.