Granted Patent B2

US 12,488,124 · App. 17/302,293 · Granted Dec 2, 2025

Inventors: Jing James Xu (Xi'an, CN); Si Er Han (Xi'an, CN); Lei Gao (Xi'an, CN); Xue Ying Zhang (Xi'an, CN); Jing Xu (Xi'an, CN); Jin Wang (Xi'an, CN)

Assignee: International Business Machines Corporation

G06F21/6218G06F16/901G06F16/906G06F18/2193G06F18/2321G06F18/24137

Abstract

Claims (46)

1 . A computer-implemented method for data segmentation, analysis, and security, the computer-implemented method comprising:

retrieving, by a computer, a set of customer data collected over a defined span of time;

generating, by the computer, a defined number of customer data segmentations for each time period in the defined span of time from the set of customer data collected over the defined span of time using a clustering algorithm;

generating, by the computer, a set of customer data evolution paths by linking successor customer data segmentations from different time periods within the defined span of time based on profiling statistical characteristics of each customer data segmentation of the defined number of customer data segmentations corresponding to the different time periods in the defined span of time;

performing, by the computer, an analysis of the set of customer data evolution paths linking successor customer data segmentations from the different time periods within the defined span of time;

determining, by the computer, a behavior trend based on the analysis of the set of customer data evolution paths linking successor customer data segmentations from the different time periods within the defined span of time, wherein the determined behavior trend is an abnormal customer behavior pattern indicating unauthorized customer data access; and

automatically performing, by the computer, a set of data security countermeasures corresponding to the abnormal customer behavior pattern indicating the unauthorized customer data access to mitigate the abnormal customer behavior pattern and increase data security based on the determined behavior trend.

2 . The computer-implemented method of claim 1 , wherein the computer calculates a cluster centroid for each customer data segmentation in the defined number of customer data segmentations and a kernel distance to define kernel area for the each customer data segmentation in the defined number of customer data segmentations, wherein the kernel distance is a distance of a record to its corresponding cluster centroid.

3 . The computer-implemented method of claim 1 further comprising:

determining, by the computer, a set of successor customer data segmentations for each corresponding customer data segmentation in the defined number of customer data segmentations to form the set of customer data evolution paths; and

summarizing, by the computer, the statistical characteristics of each respective customer data evolution path in the set of customer data evolution paths and its corresponding phases in a common profile.

4 . The computer-implemented method of claim 3 , wherein, for a given customer data segmentation in the defined number of customer data segmentations in a given time period in the defined span of time, the computer calculates a successor customer data segmentation in a next time period in the defined span of time for the given customer data segmentation by calculating cluster centroid distances between data segmentations in the next time period and a cluster centroid of the given customer data segmentation for a current time period, and wherein when a cluster centroid distance of a particular customer data segmentation in the next time period is less than a kernel distance of the given customer data segmentation, the computer determines that the particular customer data segmentation in the next time period is the successor customer data segmentation of the given customer data segmentation.

5 . The computer-implemented method of claim 3 , wherein, for a given customer data evolution path in the set of customer data evolution paths, the computer summarizes the statistical characteristics of position of the given customer data evolution path and dispersion of the given customer data evolution path in the common profile, and wherein the computer calculates the position of the given customer data evolution path using cluster centroids for all phases in the given customer data evolution path, and wherein the computer calculates the dispersion of the given customer data evolution path using distances between the position of the given customer data evolution path and cluster centroids of respective phases in the given customer data evolution path.

6 . The computer-implemented method of claim 5 , wherein, for a given phase in the given customer data evolution path, the computer summarizes the statistical characteristics of deviation of the given phase from the given customer data evolution path and deviation of the given phase from an origin of the given customer data evolution path in the common profile, and wherein the computer calculates the deviation of the given phase from the given customer data evolution path using a distance from a cluster centroid of the given phase to the position of the given customer data evolution path, and wherein the computer calculates the deviation of the given phase from the origin of the given customer data evolution path using a distance from the cluster centroid of the given phase to a cluster centroid of the origin of the given customer data evolution path.

7 . The computer-implemented method of claim 3 further comprising:

identifying, by the computer, a new customer data segmentation in new incoming customer data;

performing, by the computer, an assessment of the new customer data segmentation against the common profile containing the statistical characteristics of each respective customer data evolution path and its phases; and

determining, by the computer, a particular customer data evolution path and phase the new customer data segmentation belongs to based on the assessment of the new customer data segmentation against the common profile of the statistical characteristics of each respective customer data evolution path and its phases.

8 . The computer-implemented method of claim 7 , wherein when a kernel distance of the new customer data segmentation to a position of a particular customer data evolution path is less than a median of kernel distances of phases in the particular customer data evolution path, the computer determines that the new customer data segmentation belongs to the particular customer data evolution path, and wherein when the kernel distance of the new customer data segmentation is less than a kernel distance of a particular phase in the particular customer data evolution path that the new customer data segmentation belongs to, the computer determines that the new customer data segmentation belongs to the particular phase.

9 . The computer-implemented method of claim 8 , wherein a customer data segmentation in a customer data evolution path of the set of customer data evolution paths is a phase of that customer data evolution path.

10 . A computer system for data segmentation, analysis, and security, the computer system comprising:

a bus system;

a storage device connected to the bus system, wherein the storage device stores program instructions; and

a processor connected to the bus system, wherein the processor executes the program instructions to:

retrieve a set of customer data collected over a defined span of time;

generate a defined number of customer data segmentations for each time period in the defined span of time from the set of customer data collected over the defined span of time using a clustering algorithm;

generate a set of customer data evolution paths by linking successor customer data segmentations from different time periods within the defined span of time based on profiling statistical characteristics of each customer data segmentation of the defined number of customer data segmentations corresponding to the different time periods in the defined span of time;

perform an analysis of the set of customer data evolution paths linking successor customer data segmentations from the different time periods within the defined span of time;

determine a behavior trend based on the analysis of the set of customer data evolution paths linking successor customer data segmentations from the different time periods within the defined span of time, wherein the determined behavior trend is an abnormal customer behavior pattern indicating unauthorized customer data access; and

automatically perform a set of data security countermeasures corresponding to the abnormal customer behavior pattern indicating the unauthorized customer data access to mitigate the abnormal customer behavior pattern and increase data security based on the determined behavior trend.

11 . The computer system of claim 10 , wherein the processor further executes the program instructions to:

determine a set of successor customer data segmentations for each corresponding customer data segmentation in the defined number of customer data segmentations to form the set of customer data evolution paths; and

summarize the statistical characteristics of each respective customer data evolution path in the set of customer data evolution paths and its corresponding phases in a common profile.

12 . The computer system of claim 11 , wherein, for a given customer data segmentation in the defined number of customer data segmentations in a given time period in the defined span of time, the computer system calculates a successor customer data segmentation in a next time period in the defined span of time for the given customer data segmentation by calculating cluster centroid distances between data segmentations in the next time period and a cluster centroid of the given customer data segmentation for a current time period, and wherein when a cluster centroid distance of a particular customer data segmentation in the next time period is less than a kernel distance of the given customer data segmentation, the computer system determines that the particular customer data segmentation in the next time period is the successor customer data segmentation of the given customer data segmentation.

13 . A computer program product for data segmentation, analysis, and security, the computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method of:

retrieving, by the computer, a set of customer data collected over a defined span of time;

generating, by the computer, a defined number of customer data segmentations for each time period in the defined span of time from the set of customer data collected over the defined span of time using a clustering algorithm;

generating, by the computer, a set of customer data evolution paths by linking successor customer data segmentations from different time periods within the defined span of time based on profiling statistical characteristics of each customer data segmentation of the defined number of customer data segmentations corresponding to the different time periods in the defined span of time;

performing, by the computer, an analysis of the set of customer data evolution paths linking successor customer data segmentations from the different time periods within the defined span of time;

determining, by the computer, a behavior trend based on the analysis of the set of customer data evolution paths linking successor customer data segmentations from the different time periods within the defined span of time, wherein the determined behavior trend is an abnormal customer behavior pattern indicating unauthorized customer data access; and

automatically performing, by the computer, a set of data security countermeasures corresponding to the abnormal customer behavior pattern indicating the unauthorized customer data access to mitigate the abnormal customer behavior pattern and increase data security based on the determined behavior trend.

14 . The computer program product of claim 13 further comprising:

determining, by the computer, a set of successor customer data segmentations for each corresponding customer data segmentation in the defined number of customer data segmentations to form the set of customer data evolution paths; and

summarizing, by the computer, the statistical characteristics of each respective customer data evolution path in the set of customer data evolution paths and its corresponding phases in a common profile.

15 . The computer program product of claim 14 , wherein, for a given customer data segmentation in the defined number of customer data segmentations in a given time period in the defined span of time, the computer calculates a successor customer data segmentation in a next time period in the defined span of time for the given customer data segmentation by calculating cluster centroid distances between data segmentations in the next time period and a cluster centroid of the given customer data segmentation for a current time period, and wherein when a cluster centroid distance of a particular customer data segmentation in the next time period is less than a kernel distance of the given customer data segmentation, the computer determines that the particular customer data segmentation in the next time period is the successor customer data segmentation of the given customer data segmentation.

16 . The computer program product of claim 15 , wherein, for a given customer data evolution path in the set of customer data evolution paths, the computer summarizes the statistical characteristics of position of the given customer data evolution path and dispersion of the given customer data evolution path in the common profile, and wherein the computer calculates the position of the given customer data evolution path using cluster centroids for all phases in the given customer data evolution path, and wherein the computer calculates the dispersion of the given customer data evolution path using distances between the position of the given customer data evolution path and cluster centroids of respective phases in the given customer data evolution path.

Assignments (1)

Continuity (1)

References Cited (27)