Analyzing Activity Data of an Information Management System

Abstract

In an information management system, activity data is collected and analyzed for patterns. The information management system may be policy based. Activity data may be organized as entries including information on user, application, machine, action, object or document, time, and location. When checking for patterns in the activity or historical data, techniques may include inferencing, frequency checking, location and distance checking, and relationship checking, and any combination of these. Analyzing the activity data may include comparing like types or categories of information for two or more entries.

The invention claimed is: 
     
         1 . A method comprising:
 providing a plurality of rules to manage information of an information management system, wherein a first rule comprises a condition between a first entity and a second entity;   providing activity data stored in a log associated with the first entity, the second entity, and a third entity the activity data comprising:   a first activity data at a first time indicating sending of the e-mail from the first entity to the third entity; and   a second activity data at a second time indicating sending of the e-mail from the third entity to the second entity, wherein the first time and the second time are different;   inspecting at least the first rule to extract the condition between the first entity and the second entity;   analyzing the log for the first activity data and the second activity data to derive a relationship between the first entity and the second entity, wherein the relationship comprises:   a first correlation between sending of the e-mail from the first entity to the third entity as provided in the first activity data and sending of the e-mail from the third entity to the second entity as provided in the second activity data, the first correlation being based on the sending of the e-mail; and   detecting a potential satisfaction of the condition because of the first correlation in the relationship.   
     
     
         2 . The method of  claim 1  wherein the condition comprises that the first entity is not permitted to send an e-mail to the second entity. 
     
     
         3 . The method of  claim 1  wherein the first activity data is received at a server from a first device of the first entity, and the second activity data is received at the server from a second device of the third entity. 
     
     
         4 . The method of  claim 1  wherein the analyzing the first activity data and the second activity data comprises matching the third entity as provided in the first activity data with the third entity as provided in the second activity. 
     
     
         5 . The method of  claim 1  wherein the first entity is a first user and the second entity is a second user. 
     
     
         6 . The method of  claim 1  wherein the first entity is a first device and the second entity is a second device. 
     
     
         7 . The method of  claim 1  wherein the first entity is a first application program and the second entity is a second application program. 
     
     
         8 . The method of  claim 1  wherein the inspecting at least the first rule to extract the condition between the first entity and the second entity comprises inspecting a plurality of rules. 
     
     
         9 . A method of operating an information management system comprising:
 providing a first rule comprising a condition between a first entity and a second entity;   providing activity data stored in a log associated with the first entity, the second entity, and a third entity, the activity data comprising:   a first activity data at a first time indicating inputting of information into an e-mail by the first entity;   a second activity data at a second time indicating sending of the e-mail from the first entity to the third entity; and   a third activity data at a third time indicating sending of the e-mail from the third entity to the second entity, wherein the first time, the second time, and the third time are different;   inspecting at least the first rule to extract the condition between the first entity and the second entity;   analyzing the first activity data, the second activity data, and the third activity data to derive a relationship between the first entity and the second entity, wherein the relationship comprises:   a first association between inputting of information into an e-mail by the first entity as provided in the first activity data and sending of the e-mail from the first entity to the third entity as provided in the second activity data, the first association being based on the first entity; and   a second association between sending of the e-mail from the first entity to the third entity as provided in the second activity data and sending of the e-mail from the third entity to the second entity as provided in the third activity data, the second association being based on the sending of the e-mail; and   detecting a potential satisfaction of the condition because of the first association and the second association in the relationship.   
     
     
         10 . The method of  claim 9  wherein the condition comprises that the first entity is not permitted to send the information input into the e-mail to the second entity. 
     
     
         11 . The method of  claim 9  wherein the first activity data is received at a server from a first device of the first entity, and the third activity data is received at the server from a second device of the third entity. 
     
     
         12 . The method of  claim 9  wherein the analyzing the first activity data and the second activity data comprises matching the first entity as provided in the first activity data with the first entity as provided in the second activity. 
     
     
         13 . The method of  claim 9  wherein the first entity is a first user and the second entity is a second user. 
     
     
         14 . The method of  claim 9  wherein the first entity is a first device and the second entity is a second device. 
     
     
         15 . The method of  claim 9  wherein the first entity is a first application program and the second entity is a second application program. 
     
     
         16 . The method of  claim 9  wherein the inspecting at least the first rule to extract the condition between the first entity and the second entity comprises inspecting a plurality of rules. 
     
     
         17 . A method comprising:
 providing a plurality of rules to manage information of an information management system, wherein a first rule comprises a condition between a first user and a second user;   providing activity data stored in a log associated with the first user, the second user, and a third user, the activity data comprising:   a first activity data at a first time indicating drafting of an e-mail by the first user;   a second activity data at a second time indicating sending of the e-mail from the first user to the third user; and   a third activity data at a third time indicating sending of the e-mail from the third user to the second user, wherein the first time, the second time, and the third time are different;   inspecting at least the first rule to extract the condition between the first user and the second user;   analyzing the log for the first activity data, the second activity data, and the third activity data to derive a relationship between the first user and the second user, wherein the relationship comprises:   a first correlation between drafting of the e-mail by the first user as provided in the first activity data and sending of the e-mail from the first user to the third user as provided in the second activity data, the first correlation being based on the first user; and   a second correlation between sending of the e-mail from the first user to the third user as provided in the second activity data and sending of the e-mail from the third user to the second user as provided in the third activity data, the second correlation being based on the sending of the e-mail; and   detecting a potential satisfaction of the condition because of the first correlation and the second correlation in the relationship.   
     
     
         18 . The method of  claim 17  wherein the condition comprises that the first entity is not permitted to send an e-mail to the second entity.