System and method for time-based clustering of data-access instances
View Patent ↗In one embodiment, a method includes accessing a data-access history for a time period, the data-access history comprising a plurality of data-access instances. The method further includes initially associating each data-access instance with a time-based data-access cluster of a plurality of time-based data-access clusters based, at least in part, on a time of the data-access instance. In addition, the method includes iteratively refining a time distribution of the plurality of data-access instances across the plurality of time-based data-access clusters. Further, the method includes facilitating a time-density analysis of the plurality of data-access instances using the iteratively refined plurality of time-based data-access clusters.
1. A method comprising, by a computer system comprising computer hardware:
accessing a data-access history of a user for a time period, the data-access history comprising a plurality of data-access instances of the user during the time period;
initially associating each data-access instance with a time-based data-access cluster of a plurality of time-based data-access clusters based, at least in part, on a time of the data-access instance;
iteratively refining a time distribution of the plurality of data-access instances across the plurality of time-based data-access clusters;
identifying a particular time-based data-access cluster of the iteratively refined plurality of time-based data-access clusters as having a high time density in relation to others of the iteratively refined plurality of time-based data-access clusters; and
reporting the particular time-based data-access cluster in relation to the user.
2. The method of claim 1 , wherein the initially associating comprises:
selecting a centroid for each time-based data-access cluster, wherein each centroid corresponds to at least one of the plurality of data-access instances;
for each non-centroid data-access instance of the plurality of data-access instances, determining a best-match cluster of the plurality of time-based data-access clusters; and
wherein, for each non-centroid data-access instance, the determining of the best-match cluster is based, at least in part, on a time distance between the non-centroid data-access instance and the centroid of each of the plurality of time-based data-access clusters.
3. The method of claim 2 , wherein the selecting comprises randomly selecting a centroid for each time-based data-access cluster.
4. The method of claim 2 , wherein the iteratively refining comprises repeatedly grouping the plurality of data-access instances by time until stop criteria is met.
5. The method of claim 4 , wherein the grouping comprises:
determining a centroid for each time-based data-access cluster, wherein each centroid corresponds to at least one of the plurality of data-access instances;
for each non-centroid data-access instance of the plurality of data-access instances, determining a best-match cluster of the plurality of time-based data-access clusters; and
wherein, for each non-centroid data-access instance, the determining of the best-match cluster is based, at least in part, on a time distance between the non-centroid data-access instance and the centroid of each of the plurality of time-based data-access clusters.
6. The method of claim 5 , wherein, for each time-based data-access cluster, the determining of the centroid comprises determining a median value of data-access instances associated with the time-based data-access cluster.
7. The method of claim 4 , wherein the stop criteria comprises at least one of:
a number of iterations of the grouping; and
a number of data-access-instance movements resulting from a most-recent iteration of the grouping.
8. The method of claim 1 , wherein the plurality of data-access instances relate to file accesses on a file system.
9. An information handling system comprising:
a processing unit, wherein the processing unit is operable to implement a method, the method comprising:
accessing a data-access history of a user for a time period, the data-access history comprising a plurality of data-access instances of the user during the time period;
initially associating each data-access instance with a time-based data-access cluster of a plurality of time-based data-access clusters based, at least in part, on a time of the data-access instance;
iteratively refining a time distribution of the plurality of data-access instances across the plurality of time-based data-access clusters;
identifying a particular time-based data-access cluster of the iteratively refined plurality of time-based data-access clusters as having a high time density in relation to others of the iteratively refined plurality of time-based data-access clusters; and
reporting the particular time-based data-access cluster in relation to the user.
10. The information handling system of claim 9 , wherein the initially associating comprises:
selecting a centroid for each time-based data-access cluster, wherein each centroid corresponds to at least one of the plurality of data-access instances;
for each non-centroid data-access instance of the plurality of data-access instances, determining a best-match cluster of the plurality of time-based data-access clusters; and
wherein, for each non-centroid data-access instance, the determining of the best-match cluster is based, at least in part, on a time distance between the non-centroid data-access instance and the centroid of each of the plurality of time-based data-access clusters.
11. The information handling system of claim 10 , wherein the selecting comprises randomly selecting a centroid for each time-based data-access cluster.
12. The information handling system of claim 10 , wherein the iteratively refining comprises repeatedly grouping the plurality of data-access instances by time until stop criteria is met.
13. The information handling system of claim 12 , wherein the grouping comprises:
determining a centroid for each time-based data-access cluster, wherein each centroid corresponds to at least one of the plurality of data-access instances;
for each non-centroid data-access instance of the plurality of data-access instances, determining a best-match cluster of the plurality of time-based data-access clusters; and
wherein, for each non-centroid data-access instance, the determining of the best-match cluster is based, at least in part, on a time distance between the non-centroid data-access instance and the centroid of each of the plurality of time-based data-access clusters.
14. The information handling system of claim 13 , wherein, for each time-based data-access cluster, the determining of the centroid comprises determining a median value of data-access instances associated with the time-based data-access cluster.
15. The information handling system of claim 12 , wherein the stop criteria comprises at least one of:
a number of iterations of the grouping; and
a number of data-access-instance movements resulting from a most-recent iteration of the grouping.
16. The information handling system of claim 9 , wherein the plurality of data-access instances relate to file accesses on a file system.
17. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:
accessing a data-access history of a user for a time period, the data-access history comprising a plurality of data-access instances of the user during the time period;
initially associating each data-access instance with a time-based data-access cluster of a plurality of time-based data-access clusters based, at least in part, on a time of the data-access instance;
iteratively refining a time distribution of the plurality of data-access instances across the plurality of time-based data-access clusters;
identifying a particular time-based data-access cluster of the iteratively refined plurality of time-based data-access clusters as having a high time density in relation to others of the iteratively refined plurality of time-based data-access clusters; and
reporting the particular time-based data-access cluster in relation to the user.