Abstract: Systems, methods, and other embodiments associated with quasi-supervised clustering for activity pattern characterization and anomalous activity detection are described. In one embodiment, a method accesses a plurality of data points. An individual data point of the plurality characterizes a pattern of activity associated with an account. The method splits the plurality of data points into clusters of similar data points. The method evaluates the clusters to detect that the individual data point has changed clusters in a manner indicative of an anomalous change to the pattern of activity. And, the method generates an electronic alert that the pattern of activity has changed anomalously.

Abstract: Systems, methods, and other embodiments associated with quasi-supervised clustering for activity pattern characterization and anomalous activity detection are described. In one embodiment, a method generates a first sparse similarity matrix for nearest neighbors of a plurality of data points. The data points each characterize a pattern of activity associated with an account. The method generates a second sparse similarity matrix for random neighbors of the plurality of data points. The method recursively clusters the plurality of data points based on the first sparse similarity matrix. The method quasi-supervises the recursive clustering based on the second sparse similarity matrix to stop the iterative clustering when the data points are split into N clusters. The value of N is not pre-determined. The method detects that the individual data point has changed clusters, indicating anomalous activity. And, the method generates an electronic alert that the anomalous activity is associated with the account.

Abstract: Systems, methods, and other embodiments associated with self-reliant characterization of activities of users are described. In one embodiment, a method includes generating a dataset of data points from a batch of electronic log messages that describe electronic actions taken by various accounts. A data point collectively describes actions of a single account. The method includes modeling distinct activities based on clustering of the data points into M behavioral groups and inferring M or more distinct activities from the dataset by probabilistic activity modeling of the actions. The value of M is derived automatically during the clustering. The method includes predicting activity of a user account to be non-conformant based on other accounts in a behavioral group satisfying a threshold for similarity. And, the method includes generating an electronic alert that indicates the user account to have non-conformant activity.

Abstract: Systems, methods, and other embodiments associated with quasi-supervised clustering for activity pattern characterization and anomalous activity detection are described. In one embodiment, a method generates a first sparse similarity matrix for nearest neighbors of a plurality of data points. The data points each characterize a pattern of activity associated with an account. The method generates a second sparse similarity matrix for random neighbors of the plurality of data points. The method recursively clusters the plurality of data points based on the first sparse similarity matrix. The method quasi-supervises the recursive clustering based on the second sparse similarity matrix to stop the iterative clustering when the data points are split into N clusters. The value of N is not pre-determined. The method detects that the individual data point has changed clusters, indicating anomalous activity. And, the method generates an electronic alert that the anomalous activity is associated with the account.