Order Independent Data Categorization, Indication, and Remediation Across Realtime Datasets of Live Service Environments

Patent metadata

Field	Value
Publication number	US-2022092086-A1
Application number	US-202017029524-A
Country	US
Kind code	A1
Filing date	Sep 23, 2020
Priority date	Sep 23, 2020
Publication date	Mar 24, 2022
Grant date	—

Abstract

A computer-implemented method is provided of finding one or more data items that match one or more defined criteria in a dataset. The method comprises identifying data snippets of the dataset using a set of one or more attention rules; categorizing the identified data snippets using fuzzy matching by assigning them to buckets such that each bucket contains data snippets that are similar to another according to a similarity measure; classifying buckets containing data snippets having more than a threshold number of the true positive data items as true positive buckets and remaining buckets as false positive buckets; calculating culling rules based on the true positive buckets and the false positive buckets, and using the culling rules to remove the false positive data items from the true positive buckets.

First claim

1 . An order independent computer-implemented method, the method comprising:
receiving content from a real-time dataset of a live service environment; identifying data snippets of the dataset using a set of one or more attention rules, wherein each identified data snippet includes either a true positive data item or a false positive data item, wherein a true positive data item is a data item that matches one or more defined criteria, and a false positive data item is a data item that does not match the one or more defined criteria; categorizing the identified data snippets using fuzzy matching by assigning them to buckets such that each bucket contains data snippets that are similar to one another according to a similarity measure; classifying buckets containing data snippets having more than a threshold number of the true positive data items as true positive buckets and remaining buckets as false positive buckets; calculating culling rules based on the true positive buckets and the false positive buckets; and using the culling rules to remove the false positive data items from the true positive buckets.

2 . The computer-implemented method of claim 1 , wherein the one or more defined criteria comprises sensitivity of information.

3 . The computer-implemented method of claim 1 , comprising receiving the dataset in the form of a stream.

4 . The computer-implemented method of claim 1 , wherein the fuzzy matching is performed using fuzzy hashing.

5 . The computer-implemented method of claim 4 , wherein the fuzzy hashing is performed using SSDeep, SDHash, Nilsimsa or TLSH.

6 . The computer-implemented method of claim 5 , wherein two data snippets are considered to be similar and assigned to the same bucket if a comparison score above a threshold has been calculated for the two data snippets.

7 . The computer-implemented method of claim 1 , wherein
the set of one or more attention rules are adapted over time.

8 . A computer-readable medium comprising computer executable instructions stored thereon which, when executed by one or more processors cause the processors to: perform a method of finding one or more data items that match one or more defined criteria in a dataset, the method comprising:
identifying data snippets of the dataset using a set of attention rules, wherein each identified data snippet includes either a true positive data item or a false positive data item, wherein a true positive data item is a data item that matches one or more defined criteria, and a false positive data item is a data item that does not match the one or more defined criteria; categorizing the identified data snippets using fuzzy matching by assigning them to buckets such that each bucket contains the data snippets that are similar to another according to a similarity measure; classifying the buckets containing data snippets having more than a threshold number of the true positive data items as true positive buckets and remaining buckets as false positive buckets; calculating culling rules based on the true positive buckets and the false positive buckets; and using the culling rules to remove the false positive data items from the true positive buckets.

9 . The computer-readable medium of claim 8 , wherein the culling rules are calculated in such a way that recall rate is maximised while also keeping precision rate as high as possible.

10 . The computer-readable medium of claim 8 , wherein the culling rules are calculated such that a minimum set of culling rules maximises the amount of culling done on the false positive buckets.

11 . The computer-readable medium of claim 8 , wherein the culling rules are calculated by calculating the subset of features that are present in all data snippets of the false positive buckets but are not present in the true positive buckets.

12 . The computer-readable medium of claim 8 , wherein the culling rules are considered to be precise.

13 . The computer-readable medium of claim 8 , wherein the culling rules are recalculated at a point of time that is determined using a Fast Fourier Transformation.

14 . The computer-readable medium of claim 8 , wherein the culling rules are recalculated at a point of time that is determined by ratio of new data added to all data known.

15 . A computer system, comprising
one or more processors; one or more computer-readable media having computer-executable instructions stored on the one or more processors, wherein the one or more computer-executable instructions are configured to cause the one or more processors to perform a method of finding one or more data items that match one or more defined criteria in a dataset, the method comprising:
identifying data snippets of the dataset using a set of one or more attention rules, wherein each identified data snippet includes either a true positive data item or a false positive data item, wherein a true positive data item is a data item that matches one or more defined criteria, and a false positive data item is a data item that does not match the one or more defined criteria;
categorizing the identified data snippets using fuzzy matching by assigning them to buckets such that each bucket contains data snippets that are similar to another according to a similarity measure;
classifying the buckets containing data snippets having more than a threshold number of true positive data items as true positive buckets and remaining buckets as false positive buckets;
calculating culling rules based on the true positive buckets and the false positive buckets; and
using the culling rules to remove the false positive data items from the true positive buckets.

16 . The computer system of claim 15 , wherein the set of one or more attention rules and the culling rules are implemented in the form of regular expression filtering.

17 . The computer system of claim 15 , wherein the context of the data item is defined by features in the vicinity of the data item.

18 . The computer system of claim 15 , wherein the step of classifying the buckets as false positive buckets and true positive buckets is done either manually by a user visually assessing the content of the buckets or automatically by a machine.

19 . The computer system of claim 15 , wherein the method is repeated at least 20 times to yield a required recall rate and precision rate.

20 . The computer system of claim 15 , wherein the method is repeated until all data snippets containing data items have been correctly assigned to true positive buckets.

Assignees

• Electronic Arts Inc

Inventors

• Tumpic Denis
• Schafer Brian
• Nix James
• Aofolaju Shina
• Campbell Jesse

Classifications

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N5/048

  Fuzzy inferencing · CPC title

• G06F16/2468 Primary

  Fuzzy queries · CPC title

• G06N7/023

  Learning or tuning the parameters of a fuzzy system · CPC title

• G06F16/2255

  Hash tables · CPC title