Community generation based on a common set of attributes

Patent metadata

Field	Value
Publication number	US-11468124-B2
Application number	US-201916297527-A
Country	US
Kind code	B2
Filing date	Mar 8, 2019
Priority date	Jan 21, 2019
Publication date	Oct 11, 2022
Grant date	Oct 11, 2022

Abstract

A system, method, and machine-readable storage medium for forming a community based on a common set of attributes are provided. In some embodiments, the method includes creating a list of entities associated with a plurality of users, each entity included in the list of entities being accessed by a user of the plurality of users. The method also includes identifying a first entity accessed by a group of users of the plurality of users. The method further includes determining a first set of entities accessed by each user of the group of users, the first set of entities being included in the list of entities. The method also includes removing the first entity and the first set of entities from the list of entities. The method further includes forming a first community including the group of users, the first entity, and the first set of entities.

First claim

What is claimed is:

1. A method, comprising:
collecting, by a storage system, access data of a plurality of entities by a plurality of users across one or more storage devices of the storage system, each entity from the plurality of entities comprising an object, a file, a directory, or a set of blocks;
creating, by the storage system, a list of entities from the plurality of entities, each entity included in the list of entities being previously stored on the storage system and accessed by a user of the plurality of users;
ordering, by the storage system, the list of entities in descending order based on a number of distinct users that have accessed one or more entities from among the list of entities, each entity from among the list of entities having a respective number of distinct users;
selecting, by the storage system, an entity from among the list of entities as a first anchor entity that has a highest number of distinct users from among the respective numbers of distinct users corresponding to remaining entities in the ordered list of entities, the highest number of distinct users being a group of users from among the plurality of users;
determining, by the storage system, a first subset of entities from among the list of entities, each entity of the first subset of entities having been accessed by each distinct user of the group of users;
removing, by the storage system, the first anchor entity and the first subset of entities from the list of entities;
forming, by the storage system based on the selecting and the determining, a first community including the group of users that have accessed the first anchor entity and the first subset of entities, the first anchor entity, and the first subset of entities, the first community providing a relationship between the group of users and the first anchor entity and the first subset of entities; and
using, by the storage system, the first community as a baseline for insight into activity of one or more users from among the group of users in the first community with respect to the first anchor entity and the first subset of entities.

2. The method of claim 1 , further comprising:
determining, by the storage system after the removing, that one or more entities remains in the ordered list of entities; and
removing, by the storage system in another iteration through the ordered list of entities based on the determining that one or more entities remains, a second anchor entity and a second subset of entities from the ordered list of entities, the second anchor entity and the second subset of entities being accessed by a second group of users of the plurality of users.

3. The method of claim 1 , further comprising:
forming a second community including a second group of users, a second anchor entity, and a second subset of entities, the second anchor entity and the second subset of entities being included in the ordered list of entities and being accessed by the second group of users of the plurality of users.

4. The method of claim 1 , further comprising:
forming a second community including a second group of users, a second anchor entity, and a second subset of entities, the second anchor entity and the second subset of entities being included in the ordered list of entities and being accessed by the second group of users of the plurality of users, wherein at least one user from the plurality of users is included in the first and the second communities.

5. The method of claim 1 , further comprising:
forming a second community including a second group of users, a second anchor entity, and a second subset of entities, the second anchor entity and the second subset of entities being included in the ordered list of entities and being accessed by the second group of users of the plurality of users, wherein the first subset of entities and the second subset of entities are disjoint.

6. The method of claim 1 , further comprising:
in response to a determination to form a second community based on an entity-overlap parameter, forming the second community including a second anchor entity, a second subset of entities, and a second group of users of the plurality of users, the second anchor entity and the second subset of entities being included in the ordered list of entities and being accessed by the second group of users.

7. The method of claim 1 , further comprising:
in response to a determination to form a second community based on a reduction module setting, forming the second community including a second anchor entity, a second subset of entities, and a second group of users of the plurality of users, the second anchor entity and the second subset of entities being included in the ordered list of entities and being accessed by the second group of users.

8. The method of claim 1 , further comprising:
in response to a determination to form a second community based on a heuristic, forming the second community including a second anchor entity, a second subset of entities, and a second group of users of the plurality of users, the second anchor entity and the second subset of entities being included in the ordered list of entities and being accessed by the second group of users.

9. The method of claim 1 , wherein the using further comprises:
determining, by the storage system, that access behavior by a user belonging to the first community is suspicious based on a disproportionate increase in access rate by the user relative to access rates of other users belonging to the first community; and
determining, by the storage system, that the access behavior by the user is not suspicious based on a proportionate increase in the access rate by the user relative to the access rates of the other users.

10. A non-transitory machine-readable medium having stored thereon instructions for performing a method, comprising machine executable code which when executed by at least one machine, causes the machine to:
obtain, by a storage system, a list of entities, each entity having been accessed by one or more distinct users of a plurality of users, each entity included in the list of entities being previously stored on the storage system and comprising an object, a file, a directory, or a set of blocks;
order, by the storage system, the list of entities in descending order based on a number of distinct users that have accessed one or more entities from among the list of entities, each entity from among the list of entities having a respective number of distinct users;
select, by the storage system, a first anchor entity from the ordered list of entities, the first anchor entity having been accessed by a greater number of distinct users than remaining entities in the ordered list of entities;
determine, by the storage system, a group of distinct users that has accessed the first anchor entity based on the number of distinct users that have accessed the first anchor entity;
determine, by the storage system, a first subset of entities from among the list of entities, each entity of the first subset of entities having been accessed by each user of the group of distinct users;
remove, by the storage system, the first anchor entity and the first subset of entities from the list of entities;
form, by the storage system based on the selection of the first anchor entity, the determination of the group of distinct users, and the determination of the first subset of entities, a first community including the group of distinct users that have accessed the first anchor entity and the first subset of entities, the first anchor entity, and the first subset of entities, the first community providing a relationship between the group of distinct users and the first anchor entity and the first

Assignees

• Netapp Inc

Inventors

• Kessel Omri
• Kamila Shailaja
• Uppuluri Pratyush
• Basak Jayanta

Classifications

• G06F16/906 Primary

  Clustering; Classification · CPC title

• G06Q10/10 Primary

  Office automation; Time management · CPC title