Sensor event based activity hour modelling
The present disclosure provides techniques for sensor event based activity hour modelling. A processing device obtains, via a sensor application installed on a user device, a plurality of events occurring on the user device, where each event in the plurality of events includes a respective day and a respective time. The processing device aggregates, based on the respective day and the respective time, the plurality of events to generate time series data. The processing device performs a smoothing operation on the time series data to generate a curve. The processing device classifies an event on the user device as usual or unusual based on a baseline level of activity on the user device and the curve.
1 . A method, comprising:
obtaining, via a sensor application installed on a user device, a plurality of events occurring on the user device, wherein each event in the plurality of events indicates a respective day and a respective time;
aggregating, based on the respective day and the respective time, the plurality of events to generate time series data;
performing a smoothing operation on the time series data to generate a curve, wherein the curve comprises a plurality of data points, and wherein a data point in the plurality of data points is based on a difference between a mean event count for a day and a time and a mean event count for the user device for a plurality of weeks, the mean event count for the day and the time and the mean event count for the user device for the plurality of weeks being based on events created by the sensor application installed on the user device;
obtaining, via the sensor application, a new event that occurs on the user device after the plurality of events occur on the user device, wherein the new event comprises a first date and a first time, and wherein the new event comprises a data egress event;
classifying, by a processing device, the new event on the user device as usual or unusual based on a baseline level of activity on the user device, the curve, and the first date and the first time of the new event; and
transmitting, to an analyst device, an indication that the new event is unusual based on the classification of the new event.
2 . The method of claim 1 , wherein the time series data is in a day-hour format in which a number of events is recorded for each hour of each day.
3 . The method of claim 1 , wherein the performing the smoothing operation on the time series data comprises performing the smoothing operation on a first data point in the time series data, and wherein the performing the smoothing operation on the data point comprises performing the smoothing operation based on adjacent data points of the first data point.
4 . The method of claim 1 , further comprising:
establishing the baseline level of activity on the user device based on at least one of the time series data or the curve.
5 . The method of claim 1 , further comprising:
outputting an indication of the classification of the new event.
6 . The method of claim 1 , wherein the plurality of events is associated with working hours and non-working hours of a user.
7 . The method of claim 1 , wherein the performing the smoothing operation on the time series data comprises computing a moving average for the time series data, and wherein the classifying the new event as usual or unusual is based on the moving average and the baseline level of activity.
8 . The method of claim 1 , wherein a combination of the curve and the baseline level of activity are indicative of estimated active hours and estimated non-active hours of the user device during each day of a week.
9 . The method of claim 1 , wherein the new event is associated with cybersecurity.
10 . The method of claim 1 , further comprising:
determining a change of a time zone of the user device; and
adjusting the curve based on the change of the time zone, wherein the classifying the new event on the user device is based on the adjusted curve.
11 . The method of claim 1 , wherein the plurality of events is obtained from a time period starting from an activation of the user device.
12 . The method of claim 1 , further comprising:
determining that a number of a subset of events in the plurality of events is below a threshold number of events for a time period; and
removing the subset of events from the plurality of events prior to aggregating the plurality of events.
13 . A system, comprising:
a memory; and
a processing device operatively coupled to the memory, to:
obtain, via a sensor application installed on a user device, a plurality of events occurring on the user device, wherein each event in the plurality of events indicates a respective day and a respective time;
aggregate, based on the respective day and the respective time, the plurality of events to generate time series data;
perform a smoothing operation on the time series data to generate a curve, wherein the curve comprises a plurality of data points, and wherein a data point in the plurality of data points is based on a difference between a mean event count for a day and a time and a mean event count for the user device for a plurality of weeks, the mean event count for the day and the time and the mean event count for the user device for the plurality of weeks being based on events created by the sensor application installed on the user device;
obtain, via the sensor application, a new event that occurs on the user device after the plurality of events occur on the user device, wherein the new event comprises a first date and a first time, and wherein the new event comprises a data egress event;
classify the new event on the user device as usual or unusual based on a baseline level of activity on the user device, the curve, and the first date and the first time of the new event; and
transmit, to an analyst device, an indication that the new event is unusual based on the classification of the new event.
14 . The system of claim 13 , wherein the time series data is in a day-hour format in which a number of events is recorded for each hour of each day.
15 . The system of claim 13 , wherein the plurality of events is associated with working hours and non-working hours of a user.
16 . The system of claim 13 , wherein a combination of the curve and the baseline level of activity are indicative of estimated active hours and estimated non-active hours of the user device during each day of a week.
17 . A non-transitory computer readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to:
obtain, via a sensor application installed on a user device, a plurality of events occurring on the user device, wherein each event in the plurality of events indicates a respective day and a respective time;
aggregate, based on the respective day and the respective time, the plurality of events to generate time series data;
perform a smoothing operation on the time series data to generate a curve, wherein the curve comprises a plurality of data points, and wherein a data point in the plurality of data points is based on a difference between a mean event count for a day and a time and a mean event count for the user device for a plurality of weeks, the mean event count for the day and the time and the mean event count for the user device for the plurality of weeks being based on events created by the sensor application installed on the user device;
obtaining, via the sensor application, a new event that occurs on the user device after the plurality of events occur on the user device, wherein the new event comprises a first date and a first time, and wherein the new event comprises a data egress event;
classify, by the processing device, the new event on the user device as usual or unusual based on a baseline level of activity on the user device, the curve, and the first date and the first time of the new event; and
transmit, to an analyst device, an indication that the new event is unusual based on the classification of the new event.
18 . The non-transitory computer readable medium of claim 17 , wherein the time series data is in a day-hour format in which a number of events is recorded for each hour of each day.
19 . The non-transitory computer readable medium of claim 17 , wherein the plurality of events are associated with working hours and non-working hours of a user.
20 . The non-transitory computer readable medium of claim 17 , wherein a combination of the curve and the baseline level of activity are indicative of estimated active hours and estimated non-active hours of the user device during each day of a week.