Patent ID: 7707284

Claim:
A method for classifying activity performed on a computer system, comprising: defining a plurality of categories for classifying, the activity performed on the computer system using at least one electronic device coupled to the computer system; monitoring, by the at least one electronic device; the activity performed on the computer system, wherein the monitored activity includes a plurality of actions performed on the computer system and a plurality of objects accessed in the plurality of actions performed on the computer system; determining, by the at least one electronic device a chronological timeline for the plurality of actions performed on the computer system, wherein the plurality of actions each occur at a respective chronological position in the chronological timeline; inferring, by the at least one electronic device, one or more relationships between the plurality of objects and the plurality of actions in the chronological timeline, wherein the one or more inferred relationships are derived from the chronological positions for the plurality of actions in the chronological timeline; and classifying, by the at least one electronic device, each of the plurality of objects and each of the plurality of actions in one or more of the plurality of categories based on the one or more inferred relationships; determining, by the at least one electronic device, a strength for each of the one or more inferred relationships based on one or more of frequencies, simultaneous occurrences, sequential occurrences, durations, or temporal proximities associated with the plurality of actions in the chronological timeline, wherein the one or more inferred relationships are inferred in response to determining that the strength for each of the one or more relationships exceed a threshold value; and displaying the one or more inferred relationships and their respective chronological positions in the chronological timeline on a display as a timeline.