IP Library › Granted Patent US 12706933
Granted Patent B1
US 12706933 · App. 18/489,463 · Granted Aug 11, 2026

Automatically classifying user activity for cohort analysis

Inventors: Trevor A. Welsh (Birmingham, MI); Harish Kumar Bharat Singh (Pleasanton, CA); Weifei Zeng (Sunnyvale, CA); Yijou Chen (Cupertino, CA)
Assignee: FORTINET, INC.
H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L43/045H04L43/06H04L63/10H04L67/306H04L67/535G06F16/2456
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12706933
App. No.
18/489,463
Granted
Aug 11, 2026
Kind
B1
Abstract

Automatically classifying user activity for cohort analysis, including: gathering first information describing data upload activity of a user; gathering second information describing data upload activity for one or more cohorts of the user; and determining, based on the first information and the second information, a risk evaluation for the user.

Claims (30)

1 . A method of automatically classifying user activity for cohort analysis, the method comprising:

gathering first information describing data upload activity of a user including content of data uploaded by the user;

gathering second information describing data upload activity for one or more cohorts of the user;

determining one or more classifications of content of data uploaded by the user using one or more machine learning models configured to classify uploaded data:

determining one or more classifications of content of data uploaded by the one or more cohorts using the one or more machine learning models; and

determining, based on a comparison of the one or more classifications of the content of data uploaded by the user and the one or more classifications of content of data uploaded by the one or more cohorts a risk evaluation for the user.

2 . The method of claim 1 , wherein the risk evaluation for the user is based on a comparison of the data upload activity of the user to the data upload activity for the one or more cohorts.

3 . The method of claim 1 , wherein determining the risk evaluation for the user comprises determining one or more classifications of data uploaded by the user and one or more classifications of data uploaded by the one or more cohorts.

4 . The method of claim 3 , wherein determining one or more classifications of data uploaded by the user and one or more classifications of data uploaded by the one or more cohorts comprises providing, as input to one or more models configured to classify data, one or more of the data uploaded by the user and the data uploaded by the one or more cohorts.

5 . The method of claim 1 , wherein determining the risk evaluation for the user comprises determining one or more classifications of recipients of data uploaded by the user and one or more classifications of recipients of data uploaded by the one or more cohorts.

6 . The method of claim 5 , wherein determining one or more classifications of recipients of data uploaded by the user and one or more classifications of recipients of data uploaded by the one or more cohorts comprises providing, as input to one or more models configured to classify recipients of data, content served by one or more of the recipients of data uploaded by the user and the recipients of data uploaded by the one or more cohorts.

7 . The method of claim 1 , wherein one or more of the data upload activity of the user or the data upload activity of the one or more cohorts corresponds to data pasted for upload.

8 . The method of claim 1 , further comprising identifying the one or more cohorts of the user.

9 . The method of claim 1 , wherein determining a risk evaluation for the user is performed in response to a request to upload data from the user.

10 . The method of claim 1 , further comprising controlling access to one or more resources by the user based on the risk evaluation.

11 . A non-transitory computer readable medium having stored thereon a computer program product for automatically classifying user activity for cohort analysis, the computer program product including computer program instructions that, when executed:

gather first information describing data upload activity of a user including content of data uploaded by the user;

gather second information describing data upload activity for one or more cohorts of the user;

determine one or more classifications of content of data uploaded by the user using one or more machine learning models configured to classify uploaded data;

determine one or more classifications of content of data uploaded by the one or more cohorts using the one or more machine learning models; and

determine, based on a comparison of the one or more classifications of the content of data uploaded by the user and the one or more classifications of content of data uploaded by the one or more cohorts a risk evaluation for the user.

12 . The non-transitory computer readable medium of claim 11 , wherein the risk evaluation for the user is based on a comparison of the data upload activity of the user to the data upload activity for the one or more cohorts.

13 . The non-transitory computer readable medium of claim 11 , wherein determining the risk evaluation for the user comprises determining one or more classifications of data uploaded by the user and one or more classifications of data uploaded by the one or more cohorts.

14 . The non-transitory computer readable medium of claim 13 , wherein determining one or more classifications of data uploaded by the user and one or more classifications of data uploaded by the one or more cohorts comprises providing, as input to one or more models configured to classify data, one or more of the data uploaded by the user and the data uploaded by the one or more cohorts.

15 . The non-transitory computer readable medium of claim 11 , wherein determining the risk evaluation for the user comprises determining one or more classifications of recipients of data uploaded by the user and one or more classifications of recipients of data uploaded by the one or more cohorts.

16 . The non-transitory computer readable medium of claim 15 , wherein determining one or more classifications of recipients of data uploaded by the user and one or more classifications of recipients of data uploaded by the one or more cohorts comprises providing, as input to one or more models configured to classify recipients of data, content served by one or more of the recipients of data uploaded by the user and the recipients of data uploaded by the one or more cohorts.

17 . The non-transitory computer readable medium of claim 11 , wherein one or more of the data upload activity of the user or the data upload activity of the one or more cohorts corresponds to data pasted for upload.

18 . The non-transitory computer readable medium of claim 11 further comprising computer program instructions that, when executed, carry out the step of identifying the one or more cohorts of the user.

19 . The non-transitory computer readable medium of claim 11 , wherein determining a risk evaluation for the user is performed in response to a request to upload data from the user.

20 . The non-transitory computer readable medium of claim 11 further comprising computer program instructions that, when executed, carry out the step of generating a polygraph.