Patent ID: 9727723
Date: 2017-08-08
CPC Classifications: G06F,H04L

Claim:
1. A method of detecting anomalous use of resources, comprising: receiving resource access data indicating for each resource in a set of resources respective usage data for each of one or more users of the resource; using a processor to perform cluster analysis to determine one or more clusters of users, said clusters being determined based upon a characteristic of users that does not relate to resource usage by said users; for each cluster, determining a set of recommended resources to be associated with the cluster, said recommended resources being determined based upon accesses by users that are members of the cluster; and for each user of at least a subset of users, generating for the user a temporal behavior based model that reflects one or more resources included in the set of recommended resources associated with a corresponding cluster of which the user is a member, wherein the generating for the user the temporal behavior based model includes augmenting the temporal behavior based model to include a no access scenario in which no resource is accessed by the user over a threshold period of time such that detection of the no access scenario does not trigger an anomaly in relation to usage data for the user.