IP Library Granted Patent US 11,783,216
Granted Patent B2
US 11,783,216 · App. 17/091,088 · Granted Oct 10, 2023

Analyzing behavior in light of social time

Inventors: Josh Lospinoso (San Antonio, TX); Guy Louis Filippelli (Sparks Glencoe, MD); Christopher Poirel (Baltimore, MD); James Michael Detwiler (Baltimore, MD)
Assignee: Forcepoint LLC
G06N7/01G06N5/022G06N5/048G06N20/00G06Q10/10G06Q30/00G06Q30/0201G06N5/04
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,783,216
App. No.
17/091,088
Granted
Oct 10, 2023
Kind
B2
Abstract

A relational event history is determined based on a data set, the relational event history including a set of relational events that occurred in time among a set of actors. Data is populated in a probability model based on the relational event history, where the probability model is formulated as a series of conditional probabilities that correspond to a set of sequential decisions by an actor for each relational event, where the probability model includes one or more statistical parameters and corresponding statistics. A baseline communications behavior for the relational event history is determined based on the populated probability model, and departures within the relational event history from the baseline communications behavior are determined.

Claims (51)

1. A method for creating a relational event history comprising:

receiving data from a data source, the data source providing information regarding an event;

determining a relational event history from the data set, the relational event history comprising an event that occurred at a particular time by an actor, the event being strictly ordered with other events enacted in time by a set of actors, the strict ordering providing the relational event history; and,

populating, based on the relational event history, data in a probability model, the probability model being formulated as a series of conditional probabilities that correspond to a set of sequential decisions by the actor and the set of actors of the other events, the probability model including a statistical parameter and a corresponding statistic;

determining, based on the populated probability model, a baseline behavior for the relational event history, the determining the baseline behavior being based upon the statistical parameter and the corresponding statistic; and,

using the relational event history to determine whether behavior associated with the event represents a departure from the baseline behavior.

2. The method of claim 1 , wherein:

the determining the relational event history comprises providing extracted data from the data to provide extracted data, transforming the extracted data to provide transformed data, loading the transformed data to provide loaded data and enriching the loaded data.

3. The method of claim 1 , wherein:

the event and the each of the other events comprise a respective set of characteristics.

4. The method of claim 3 , wherein:

the respective set of characteristics comprise at least one of information regarding a sender, information regarding a recipient, information regarding a mode of the event and information indicating a time the event occurred.

5. The method of claim 3 , wherein:

the set of characteristics comprise at least one of a unique identifier of the event, information regarding a duration of the event, information regarding formatting of the event in the data source.

6. The method of claim 1 , further comprising:

determining a subset of actors, at least one decision included in the set of sequential decisions comprising selecting a recipient of a relational event from the subset of actors.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code for creating a relational event history, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

receiving data from a data source, the data source providing information regarding an event;

determining a relational event history from the data set, the relational event history comprising an event that occurred at a particular time by an actor, the event being strictly ordered with other events enacted in time by a set of actors, the strict ordering providing the relational event history; and,

populating, based on the relational event history, data in a probability model, the probability model being formulated as a series of conditional probabilities that correspond to a set of sequential decisions by the actor and the set of actors of the other events, the probability model including a statistical parameter and a corresponding statistic;

determining, based on the populated probability model, a baseline behavior for the relational event history, the determining the baseline behavior being based upon the statistical parameter and the corresponding statistic; and,

using the relational event history to determine whether behavior associated with the event represents a departure from the baseline behavior.

8. The system of claim 7 , wherein:

the determining the relational event history comprises providing extracted data from the data to provide extracted data, transforming the extracted data to provide transformed data, loading the transformed data to provide loaded data and enriching the loaded data.

9. The system of claim 7 , wherein:

the event and the each of the other events comprise a respective set of characteristics.

10. The system of claim 9 , wherein:

the respective set of characteristics comprise at least one of information regarding a sender, information regarding a recipient, information regarding a mode of the event and information indicating a time the event occurred.

11. The system of claim 7 , wherein:

the set of characteristics comprise at least one of a unique identifier of the event, information regarding a duration of the event, information regarding formatting of the event in the data source.

12. The system of claim 7 , wherein the instructions are further configured for:

determining a subset of actors, at least one decision included in the set of sequential decisions comprising selecting a recipient of a relational event from the subset of actors.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

receiving data from a data source, the data source providing information regarding an event;

determining a relational event history from the data set, the relational event history comprising an event that occurred at a particular time by an actor, the event being strictly ordered with other events enacted in time by a set of actors, the strict ordering providing the relational event history; and,

populating, based on the relational event history, data in a probability model, the probability model being formulated as a series of conditional probabilities that correspond to a set of sequential decisions by the actor and the set of actors of the other events, the probability model including a statistical parameter and a corresponding statistic;

determining, based on the populated probability model, a baseline behavior for the relational event history, the determining the baseline behavior being based upon the statistical parameter and the corresponding statistic; and,

using the relational event history to determine whether behavior associated with the event represents a departure from the baseline behavior.

14. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the determining the relational event history comprises providing extracted data from the data to provide extracted data, transforming the extracted data to provide transformed data, loading the transformed data to provide loaded data and enriching the loaded data.

15. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the event and the each of the other events comprise a respective set of characteristics.

16. The non-transitory, computer-readable storage medium of claim 15 , wherein:

the respective set of characteristics comprise at least one of information regarding a sender, information regarding a recipient, information regarding a mode of the event and information indicating a time the event occurred.

17. The non-transitory, computer-readable storage medium of claim 13 , wherein:

the set of characteristics comprise at least one of a unique identifier of the event, information regarding a duration of the event, information regarding formatting of the event in the event data source.

18. The non-transitory, computer-readable storage medium of claim 13 , wherein the computer executable instructions are further configured for:

determining a subset of actors, at least one decision included in the set of sequential decisions comprising selecting a recipient of a relational event from the subset of actors.

Assignments (4)
CHANGE OF NAME Recorded Mar 21, 2025
From: FORCEPOINT FEDERAL HOLDINGS LLC
To: EVERFOX HOLDINGS LLC
Reel/Frame 070588/0074 →
PARTIAL PATENT RELEASE AND REASSIGNMENT AT REEL/FRAME 055052/0302 Recorded Oct 3, 2023
From: CREDIT SUISSE, AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT
To: FORCEPOINT FEDERAL HOLDINGS LLC (F/K/A FORCEPOINT LLC)
Reel/Frame 065103/0147 →
SECURITY INTEREST Recorded Sep 29, 2023
From: FORCEPOINT FEDERAL HOLDINGS LLC
To: APOLLO ADMINISTRATIVE AGENCY LLC, AS COLLATERAL AGENT
Reel/Frame 065086/0822 →
CHANGE OF NAME Recorded May 12, 2021
From: FORCEPOINT LLC
To: FORCEPOINT FEDERAL HOLDINGS LLC
Reel/Frame 056216/0309 →
Continuity (9)
Continuation 16432414 · Jun 5, 2019
Continuation 15399147 · Jan 5, 2017
Continuation 14148346 · Jan 6, 2014
Provisional Application 61771625 · Mar 1, 2013
Provisional Application 61803876 · Mar 21, 2013
Provisional Application 61771611 · Mar 1, 2013
Provisional Application 61772878 · Mar 5, 2013
Provisional Application 61820090 · May 6, 2013
Related Publication 20210056453A1 · Feb 25, 2021