Patent ID: 9558347
Date: 2017-01-31
CPC Classifications: G06F,G06N,H04L

Claim:
1. A method for detecting abnormal behavior of users, the method comprising: identifying, by one or more processors and from a log of user activity, a first number of actions performed by a user over a first time period that match a pattern of user activity for a task associated with one or more roles of the users, wherein each of the one or more roles represents an authority associated with one or more of the users; identifying, by the one or more processors and from the log of user activity, a second number of actions performed by the user over a second time period that match the pattern of user activity for the task associated with the one or more roles; identifying a difference between amounts of time spent in the one or more roles in the first time period and the second time period based on the first number of actions and the second number of actions; and determining, by the one or more processors, whether the difference exceeds a threshold for abnormal behavior.