Taking action based on data evolution

Patent metadata

Field	Value
Publication number	US-12488124-B2
Application number	US-202117302293-A
Country	US
Kind code	B2
Filing date	Apr 29, 2021
Priority date	Apr 29, 2021
Publication date	Dec 2, 2025
Grant date	Dec 2, 2025

Abstract

Data segmentation, analysis, and security is provided. An analysis of a set of generated data evolution paths corresponding to a set of data collected over a defined span of time is performed. A behavior trend is determined based on analysis of the set of generated data evolution paths. A set of action steps is performed automatically based on the determined behavior trend.

First claim

What is claimed is:

1 . A computer-implemented method for data segmentation, analysis, and security, the computer-implemented method comprising:
retrieving, by a computer, a set of customer data collected over a defined span of time; generating, by the computer, a defined number of customer data segmentations for each time period in the defined span of time from the set of customer data collected over the defined span of time using a clustering algorithm; generating, by the computer, a set of customer data evolution paths by linking successor customer data segmentations from different time periods within the defined span of time based on profiling statistical characteristics of each customer data segmentation of the defined number of customer data segmentations corresponding to the different time periods in the defined span of time; performing, by the computer, an analysis of the set of customer data evolution paths linking successor customer data segmentations from the different time periods within the defined span of time; determining, by the computer, a behavior trend based on the analysis of the set of customer data evolution paths linking successor customer data segmentations from the different time periods within the defined span of time, wherein the determined behavior trend is an abnormal customer behavior pattern indicating unauthorized customer data access; and automatically performing, by the computer, a set of data security countermeasures corresponding to the abnormal customer behavior pattern indicating the unauthorized customer data access to mitigate the abnormal customer behavior pattern and increase data security based on the determined behavior trend.

2 . The computer-implemented method of claim 1 , wherein the computer calculates a cluster centroid for each customer data segmentation in the defined number of customer data segmentations and a kernel distance to define kernel area for the each customer data segmentation in the defined number of customer data segmentations, wherein the kernel distance is a distance of a record to its corresponding cluster centroid.

3 . The computer-implemented method of claim 1 further comprising:
determining, by the computer, a set of successor customer data segmentations for each corresponding customer data segmentation in the defined number of customer data segmentations to form the set of customer data evolution paths; and
summarizing, by the computer, the statistical characteristics of each respective customer data evolution path in the set of customer data evolution paths and its corresponding phases in a common profile.

4 . The computer-implemented method of claim 3 , wherein, for a given customer data segmentation in the defined number of customer data segmentations in a given time period in the defined span of time, the computer calculates a successor customer data segmentation in a next time period in the defined span of time for the given customer data segmentation by calculating cluster centroid distances between data segmentations in the next time period and a cluster centroid of the given customer data segmentation for a current time period, and wherein when a cluster centroid distance of a particular customer data segmentation in the next time period is less than a kernel distance of the given customer data segmentation, the computer determines that the particular customer data segmentation in the next time period is the successor customer data segmentation of the given customer data segmentation.

5 . The computer-implemented method of claim 3 , wherein, for a given customer data evolution path in the set of customer data evolution paths, the computer summarizes the statistical characteristics of position of the given customer data evolution path and dispersion of the given customer data evolution path in the common profile, and wherein the computer calculates the position of the given customer data evolution path using cluster centroids for all phases in the given customer data evolution path, and wherein the computer calculates the dispersion of the given customer data evolution path using distances between the position of the given customer data evolution path and cluster centroids of respective phases in the given customer data evolution path.

6 . The computer-implemented method of claim 5 , wherein, for a given phase in the given customer data evolution path, the computer summarizes the statistical characteristics of deviation of the given phase from the given customer data evolution path and deviation of the given phase from an origin of the given customer data evolution path in the common profile, and wherein the computer calculates the deviation of the given phase from the given customer data evolution path using a distance from a cluster centroid of the given phase to the position of the given customer data evolution path, and wherein the computer calculates the deviation of the given phase from the origin of the given customer data evolution path using a distance from the cluster centroid of the given phase to a cluster centroid of the origin of the given customer data evolution path.

7 . The computer-implemented method of claim 3 further comprising:
identifying, by the computer, a new customer data segmentation in new incoming customer data;
performing, by the computer, an assessment of the new customer data segmentation against the common profile containing the statistical characteristics of each respective customer data evolution path and its phases; and
determining, by the computer, a particular customer data evolution path and phase the new customer data segmentation belongs to based on the assessment of the new customer data segmentation against the common profile of the statistical characteristics of each respective customer data evolution path and its phases.

8 . The computer-implemented method of claim 7 , wherein when a kernel distance of the new customer data segmentation to a position of a particular customer data evolution path is less than a median of kernel distances of phases in the particular customer data evolution path, the computer determines that the new customer data segmentation belongs to the particular customer data evolution path, and wherein when the kernel distance of the new customer data segmentation is less than a kernel distance of a particular phase in the particular customer data evolution path that the new customer data segmentation belongs to, the computer determines that the new customer data segmentation belongs to the particular phase.

9 . The computer-implemented method of claim 8 , wherein a customer data segmentation in a customer data evolution path of the set of customer data evolution paths is a phase of that customer data evolution path.

10 . A computer system for data segmentation, analysis, and security, the computer system comprising:
a bus system; a storage device connected to the bus system, wherein the storage device stores program instructions; and a processor connected to the bus system, wherein the processor executes the program instructions to:
retrieve a set of customer data collected over a defined span of time;
generate a defined number of customer data segmentations for each time period in the defined span of time from the set of customer data collected over the defined span of time using a clustering algorithm;
generate a set of customer data evolution paths by linking successor customer data segmentations from different time periods within the defined span of time based on profiling statistical characteristics of each customer data segmentation of the defined number of customer data segmentations corresponding to the different time periods in the defined span

Assignees

• IBM

Inventors

• Xu Jing James
• Han Si Er
• Gao Lei
• Zhang xue ying
• Xu Jing
• Wang Jin

Classifications

• G06F18/24137

  Distances to cluster centroïds · CPC title

• G06F18/2321

  using statistics or function optimisation, e.g. modelling of probability density functions · CPC title

• G06F18/2193

  based on specific statistical tests · CPC title

• G06F16/901

  Indexing; Data structures therefor; Storage structures (for retrieval from the web G06F16/951) · CPC title

• G06F16/906

  Clustering; Classification · CPC title