Generating cohorts using automated weighting and multi-level ranking

Patent metadata

Field	Value
Publication number	US-10698910-B2
Application number	US-201515766655-A
Country	US
Kind code	B2
Filing date	Oct 9, 2015
Priority date	Oct 9, 2015
Publication date	Jun 30, 2020
Grant date	Jun 30, 2020

Abstract

Automated weighting is performed that includes transforming a behavior of each respective dimension of multiple dimensions of a selected group of events to a respective weight, the respective weight determined based on a distribution of values of the respective dimension, and where the weight determined for a first of the plurality of dimensions is greater than the weight determined for a second of the plurality of dimensions. Similarity values are computed indicating similarities between further events and the selected group of events, the similarity values based on a combination of the weights and distances between the further events and the selected group of events. Cohorts of the further events are generated by performing multi-level ranking that comprises ranking groups of the further events based on the similarity values, and applying merging to the groups to produce merged groups. The cohorts are visualized in a graphical visualization.

First claim

What is claimed is:

1. A method comprising:
performing, by a system comprising a processor, automated weighting comprising transforming a behavior of each respective dimension of a plurality of dimensions of a selected group of events to a respective weight, the respective weight determined based on a distribution of values of the respective dimension, wherein the weight determined for a first of the plurality of dimensions is greater than the weight determined for a second of the plurality of dimensions;
computing, by the system, similarity values indicating similarities between further events and the selected group of events the similarity values based on a combination of the weights and distances between the further events and the selected group of events;
generating, by the system, cohorts of the further events by performing multi-level ranking that comprises ranking groups of the further events based on the similarity values, and applying merging to the groups to produce merged groups; and
visualizing, by the system, the cohorts in a graphical visualization.

2. The method of claim 1 , wherein the generating of the cohorts further comprises:
re-ranking the merged groups to form the cohorts.

3. The method of claim 2 , wherein the generating of the cohorts further comprises:
splitting at least a first merged group of the merged groups based on the first merged group including more than one value of a constraint dimension, wherein the splitting produces split merged groups,
wherein the re-ranking is applied to the split merged groups.

4. The method of claim 1 , wherein the generating of the cohorts further comprises:
selecting a subset of initial groups of the further events based on distance values between the initial groups of the further events and the selected group of events, the distance values based on differences between diversity values of dimensions of the initial groups of the further events and the selected group of events, wherein the ranking is applied to the groups of the further events in the subset.

5. The method of claim 1 , wherein the merging comprises merging a first group of the further events and a second group of the further events in response to a first distance of the first group of the further events to the selected group of events being within a threshold of a second distance of the second group of the further events to the selected group of events.

6. The method of claim 1 , further comprising:
sorting the further events according to the similarity values; and
identifying the groups of the further events using the sorted further events.

7. The method of claim 1 , wherein the respective weight of each respective dimension of the plurality of dimensions is derived from a diversity value of the respective dimension.

8. The method of claim 1 , wherein the respective weight of each respective dimension of the plurality of dimensions is derived from an entropy value of the respective dimension.

9. The method of claim 1 , further comprising receiving an interactive user selection in a visualization of pixels representing events, the interactive user selection providing the selected group of events.

10. The method of claim 1 , further comprising performing correlation analysis to determine a correlation between dimensions and to adjust the weights of correlated dimensions.

11. A system comprising:
at least one processor; and
a memory to store instructions executable on the at least one processor to:
determine weights of respective dimensions of a profile of events, the weight determined for each respective dimension based on a distribution of values of the respective dimension, wherein the weight determined for a first of the dimensions is greater than the weight determined for a second of the dimensions;
compute similarity values indicating similarities between further events and the profile of events, the similarity values based on a combination of the weights and distances between the further events and the profile of events;
identify initial groups of the further events according to the similarity values;
perform multi-level ranking comprising:
ranking the initial groups of the further events based on diversity values of the initial groups of the further events;
selecting a subset of the ranked initial groups of the further events, and re-ranking the groups of the further events in the selected subset based on the similarity values, and
merging the re-ranked groups of the further events to produce merged groups of the further events;

determine cohorts of the further events based on the merged groups of the further events; and
visualize the cohorts in a graphical visualization.

12. The system of claim 1 , wherein the multi-level ranking further comprises:
splitting a first merged group of the merged groups of the further events based on the first merged group having more than one value of a constraint dimension, the splitting producing split merged groups of the further events.

13. The system of claim 12 , wherein the multi-level ranking further comprises:
re-ranking the split merged groups of the further events according to the similarity values, wherein the cohorts are determined based on the re-ranked split merged groups of the further events.

14. The system of claim 11 , wherein the weights are based on entropy values of the dimensions.

15. An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:
receive a user selection to select a group of events;
perform automated weighting comprising transforming a behavior of each respective dimension of a plurality of dimensions of the selected group of events to a respective weight, the respective weight determined based on a distribution of values of the respective dimension, wherein the weight determined for a first of the plurality of dimensions is greater than the weight determined for a second of the plurality of dimensions;
compute similarity values indicating similarities between further events and the selected group of events, the similarity values based on a combination of the weights and distances between the further events and the selected group of events;
generating, by the system, cohorts of the further events by performing multi-level ranking that comprises ranking groups of the further events based on the similarity values, applying merging to the groups to produce merged groups, and splitting the merged groups; and
visualize the cohorts in a graphical visualization.

Assignees

• Entit Software Llc
• Micro Focus Llc

Inventors

• Hao Ming C
• Chang Nelson L
• Scaggs Justin Aaron
• Hamborg Felix
• Keim Daniel

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F16/24578 Primary

  using ranking · CPC title

• G06F7/16

  Combined merging and sorting · CPC title

• G06F16/248

  Presentation of query results · CPC title