Dynamic session aggregation detection over log sequences using time series analysis
Systems and methods for dynamic session aggregation detection include receiving session logs for one of a plurality of machines operating in a cloud-based system; determining a plurality of time intervals between activities based on the session logs; determining a probability of a new log to be received after each time interval of the plurality of time intervals; calculating a slope from a shortest break interval and a slope to a longest break interval for each log of the session logs; calculating a slope ratio for each log of the session logs; and determining an optimal maximum session duration based on the slope ratios. The steps further include defining a new applicative session each time the machine experiences a break larger than the optimal maximum session duration.
1. A non-transitory computer-readable medium comprising instructions that, when executed, cause a processor to:
receive session logs of a particular application of a specific user for one of a plurality of machines operating in a cloud-based system;
determine a plurality of time intervals between activities based on the session logs;
determine a probability of a new log to be received after each time interval of the plurality of time intervals, wherein the probability of a new log to be received is calculated as a cumsum probability;
calculate a slope from a shortest break interval and a slope to a longest break interval for each log of the session logs;
calculate a slope ratio for each log of the session logs; and
determine an optimal maximum session duration based on the slope ratios.
2. The non-transitory computer-readable medium of claim 1 , wherein the break intervals are intervals of time between actions.
3. The non-transitory computer-readable medium of claim 1 , wherein session logs are received for any number of machines operating in the cloud-based system.
4. The non-transitory computer-readable medium of claim 1 , wherein the session logs are ordered ascending from smallest break interval to largest break interval prior to the calculating.
5. The non-transitory computer-readable medium of claim 1 , wherein the steps further include calculating a median break duration for the received session logs, and wherein the optimal maximum session duration is validated based on the median break duration.
6. The non-transitory computer-readable medium of claim 1 , wherein the optimal maximum session duration is determined based on a log with a maximum slope ratio.
7. The non-transitory computer-readable medium of claim 1 , wherein the steps further include defining a new applicative session each time the machine experiences a break larger than the optimal maximum session duration.
8. A method comprising steps of:
receiving session logs for one of a plurality of machines operating in a cloud-based system;
determining a plurality of time intervals between activities based on the session logs;
determining a probability of a new log to be received after each time interval of the plurality of time intervals, wherein the probability of a new log to be received is calculated as a cumsum probability;
calculating a slope from a shortest break interval and a slope to a longest break interval for each log of the session logs;
calculating a slope ratio for each log of the session logs; and
determining an optimal maximum session duration based on the slope ratios.
9. The method of claim 8 , wherein the break intervals are intervals of time between actions.
10. The method of claim 8 , wherein session logs are received for any number of machines operating in the cloud-based system.
11. The method of claim 8 , wherein the session logs are ordered ascending from smallest break interval to largest break interval prior to the calculating.
12. The method of claim 8 , wherein the steps further include calculating a median break duration for the received session logs, and wherein the optimal maximum session duration is validated based on the median break duration.
13. The method of claim 8 , wherein the optimal maximum session duration is determined based on a log with a maximum slope ratio.
14. The method of claim 8 , wherein the steps further include defining a new applicative session each time the machine experiences a break larger than the optimal maximum session duration.
15. A cloud-based system for providing session separation comprising:
one or more processors; and
memory storing instructions that, when executed, cause the one or more processors to:
receive session logs of a particular application of a specific user for one of a plurality of machines operating in a cloud-based system;
determine a plurality of time intervals between activities based on the session logs;
determine a probability of a new log to be received after each time interval of the plurality of time intervals, wherein the probability of a new log to be received is calculated as a cumsum probability;
calculate a slope from a shortest break interval and a slope to a longest break interval for each log of the session logs;
calculate a slope ratio for each log of the session logs; and
determine an optimal maximum session duration based on the slope ratios.
16. The cloud-based system of claim 15 , wherein the optimal maximum session duration is determined base d on a log with a maximum slope ratio.
17. The cloud-based system of claim 15 , wherein the steps further include defining a new applicative session each time the machine experiences a break larger than the optimal maximum session duration.