Patent ID: 9747551
Date: 2017-08-29
CPC Classifications: G06F,G06N,G06Q,H04L

Claim:
1. A computer-implemented method comprising: identifying a user whose behavior is classified as anomalous during a particular time interval; determining observed community feature values for a community of users of which the user is a member, the community of users being defined by a partition of users in a user graph for the particular time interval, the user graph having nodes that represent distinct users and edges that represent relationships between users from user behavior of the users in the particular time interval; determining predicted community feature values for the community, the predicted community feature values being determined from a community model generated using aggregate community feature values computed from a community graph having nodes that each represent a partition of a respective user graph within one of multiple time intervals, the community graph having edges between nodes that represent matching partitions of respective user graphs across adjacent time intervals; determining that the predicted community feature values are consistent with the observed community feature values; determining observed user feature values of the user during the particular time interval from the user graph for the particular time interval; determining whether the observed user feature values are consistent with the observed community feature values; classifying the behavior of the user as not anomalous when the observed user feature values are consistent with the observed community feature values; and classifying the behavior of the user as anomalous when the observed user feature values are not consistent with the observed community feature values.