System and method of searching for classifying user activity performed on a computer system

1. A method for classifying activity performed on a computer system, comprising:

defining a plurality of categories for classifying, the activity performed on the computer system using at least one electronic device coupled to the computer system;

monitoring, by the at least one electronic device; the activity performed on the computer system, wherein the monitored activity includes a plurality of actions performed on the computer system and a plurality of objects accessed in the plurality of actions performed on the computer system;

determining, by the at least one electronic device a chronological timeline for the plurality of actions performed on the computer system, wherein the plurality of actions each occur at a respective chronological position in the chronological timeline;

inferring, by the at least one electronic device, one or more relationships between the plurality of objects and the plurality of actions in the chronological timeline, wherein the one or more inferred relationships are derived from the chronological positions for the plurality of actions in the chronological timeline; and

classifying, by the at least one electronic device, each of the plurality of objects and each of the plurality of actions in one or more of the plurality of categories based on the one or more inferred relationships;

determining, by the at least one electronic device, a strength for each of the one or more inferred relationships based on one or more of frequencies, simultaneous occurrences, sequential occurrences, durations, or temporal proximities associated with the plurality of actions in the chronological timeline, wherein the one or more inferred relationships are inferred in response to determining that the strength for each of the one or more relationships exceed a threshold value; and

displaying the one or more inferred relationships and their respective chronological positions in the chronological timeline on a display as a timeline.

2. The method according to claim 1 , further comprising searching, by the at least one electronic device, the activity performed on the computer system for one or more of the plurality of actions that are classified in one or more of the plurality of categories.

3. The method according to claim 1 , further comprising searching, by the at least one electronic device, the activity performed on the computer system for one or more of the plurality of objects that are classified in one or more of the plurality of categories.

4. The method according to claim 1 , wherein a first one of the plurality of categories is nested within a second one of the plurality of categories.

5. The method according to claim 1 , wherein the plurality of actions include one or more actions that the computer system performs and one or more actions that a user performs on the computer system.

6. The method according to claim 5 , wherein the plurality of objects accessed in the plurality of actions include one or more of applications, documents, files, electronic mail messages, chat sessions, web sites, address book entries, or calendar entries.

7. The method according to claim 1 , wherein at least one of the relationships are not inferred in response to determining that the strength for the at least one relationship does not exceed the threshold value.

8. The method according to claim 1 , wherein the chronological timeline for the plurality of actions comprises a first chronological timeline for a first computer system, and wherein the method further comprises:

monitoring, by the at least one electronic device, activity performed on a second computer system, wherein the monitored activity performed on the second computer system includes one or more actions performed on the second computer system and one or more objects accessed in the one or more actions performed on the second computer system;

determining, by the at least one electronic device, a second chronological timeline for the one or more actions performed on the second computer system, wherein the one or more actions performed on the second computer system each occur at a respective chronological position in the second chronological timeline; and

displaying, by the at least one electronic device, an aggregate timeline for the first computer system and the second computer system, wherein the aggregate timeline includes the plurality of actions performed on the first computer system and the one or more actions performed on the second computer system.

9. A system for classifying activity performed on a computer system, wherein the system comprises at least one electronic device configured to:

define a plurality of categories for classifying the activity performed on the computer system;

monitor the activity performed on the computer system, wherein the monitored activity includes a plurality of actions performed on the computer system and a plurality of objects accessed in the plurality of actions performed on the computer system;

determine a chronological timeline for the plurality of actions performed on the computer system, wherein the plurality of actions each occur at a respective chronological position in the chronological timeline;

infer one or more relationships between the plurality of objects and the plurality of actions in the chronological timeline, wherein the at least one electronic device derives the one or more inferred relationships from the chronological positions for the plurality of actions in the chronological timeline; and

classify each of the plurality of objects and each of the plurality of actions in one or more of the plurality of categories based on the one or more inferred relationships;

determine, by the at least one electronic device, a strength for each of the one or more inferred relationships based on one or more of frequencies, simultaneous occurrences, sequential occurrences, durations, or temporal proximities associated with the plurality of actions in the chronological timeline, wherein the one or more inferred relationships are inferred in response to determining that the strength for each of the one or more relationships exceed a threshold value; and

display the one or more inferred relationships and their respective chronological positions in the chronological timeline on a display as a timeline.

10. The system according to claim 9 , wherein the at least one electronic device is further configured to search the activity performed on the computer system for one or more of the plurality of actions that are classified in one or more of the plurality of categories.

11. The system according to claim 9 , wherein the at least one electronic device is further configured to search the performed on the computer system for one or more of the plurality of objects that are classified in one or more of the plurality of categories.

12. The system according to claim 9 , wherein a first one of the plurality of categories is nested within a second one of the plurality of categories.

13. The system according to claim 9 , wherein the plurality of actions include one or more actions that the computer system performs and one or more actions that a user performs on computer system.

14. The system according to claim 13 , wherein the plurality of objects accessed in the plurality of actions include one or more of applications, documents, files, electronic mail messages, chat sessions, web sites, address book entries, or calendar entries.

15. The system according to claim 9 , wherein at least one of the relationships are not inferred in response to determining that the strength for the at least one relationship does not exceed the threshold value.

16. The system according to claim 9 , wherein the chronological timeline for the plurality of actions comprises a first chronological timeline for a first computer system, and wherein the at least one electronic device is further configured to:

monitor activity performed on a second computer system, wherein the monitored activity performed on the second computer system includes one or more actions performed on the second computer system and one or more objects accessed in the one or more actions performed on the second computer system;

determine a second chronological timeline for the one or more actions performed on the second computer system, wherein the one or more actions performed on the second computer system each occur at a respective chronological position in the second chronological timeline; and

display an aggregate timeline for the first computer system and the second computer system, wherein the aggregate timeline includes the plurality of actions performed on the first computer system and the one or more actions performed on the second computer system.