Dynamic episodic networks

Abstract

A method for managing interactions and outcomes includes receiving data describing the propagation of a plurality of items through a system and modeling the propagation of the plurality of items through the system as a plurality of interconnected affinity groups. The method also includes identifying one or more undesirable affinity groups from the plurality of interconnected affinity groups. The method further includes, for each one of the undesirable affinity groups, performing the steps of: predicting at least one interaction required to cause at least a portion of the plurality of items associated with the one of the undesirable affinity groups to propagate to a desirable affinity group and causing the one of the undesirable affinity groups to interact with another affinity group configured to provide with the at least one interaction.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 receiving data describing the propagation of a plurality of items through a system;   
       modeling the propagation of the plurality of items through the system as a plurality of interconnected affinity groups;
 identifying one or more undesirable affinity groups from the plurality of interconnected affinity groups; and 
 for each one of the undesirable affinity groups, performing the steps of:
 predicting at least one interaction required to cause at least a portion of the plurality of items associated with the one of the undesirable affinity groups to propagate to a desirable affinity group, and 
 causing the one of the undesirable affinity groups to interact with another affinity group configured to provide with the at least one interaction. 
 
 
     
     
         2 . The method of  claim 1 , further comprising:
 after causing, repeating the modeling, identifying, and performing until at least one criteria is met.   
     
     
         3 . The method of  claim 2 , wherein the at least one criteria comprises a number of the plurality of items in the one of the undesirable affinity groups propagating to the desirable affinity group exceeding a threshold. 
     
     
         4 . The method of  claim 1 , wherein the plurality of items comprise a plurality of computing devices and one or more items of malware, and wherein at least one of the undesirable affinity groups includes the at least one of the items of malware. 
     
     
         5 . The method of  claim 2 , wherein the modeling comprises simulating the propagation using an initial set of parameters, and wherein the repeating comprises updating the set the parameters prior to repeating the modeling, identifying, and performing. 
     
     
         6 . The method of  claim 5 , wherein the updating comprises comparing properties of the undesirable affinity groups to properties of one or more reference groups, and estimating changes for the set of parameters based on the comparing. 
     
     
         7 . A system comprising:
 a processor; and   a memory, having stored thereon a computer program executable by the processor, the computer program comprising a plurality of code sections for causing the processor to perform steps comprising:
 receiving data describing the propagation of a plurality of items through a system; 
 modeling the propagation of the plurality of items through the system as a plurality of interconnected affinity groups; 
 identifying one or more undesirable affinity groups from the plurality of interconnected affinity groups; and 
   for each one of the undesirable affinity groups, performing the steps of:
 predicting at least one interaction required to cause at least a portion of the plurality of items associated with the one of the undesirable affinity groups to propagate to a desirable affinity group, and 
 causing the one of the undesirable affinity groups to interact with another affinity group configured to provide with the at least one interaction. 
   
     
     
         8 . The system of  claim 7 , the computer program comprising code sections for causing the processor to perform the step of:
 after causing, repeating the modeling, identifying, and performing until at least one criteria is met.   
     
     
         9 . The system of  claim 8 , wherein the at least one criteria comprises a number of the plurality of items in the one of the undesirable affinity groups propagating to the desirable affinity group exceeding a threshold. 
     
     
         10 . The system of  claim 7 , wherein the plurality of items comprise a plurality of computing devices and one or more items of malware, and wherein at least one of the undesirable affinity groups includes the at least one of the items of malware. 
     
     
         11 . The system of  claim 8 , wherein the modeling comprises simulating the propagation using an initial set of parameters, and wherein the repeating comprises updating the set the parameters prior to repeating the modeling, identifying, and performing. 
     
     
         12 . The method of  claim 10 , wherein the updating comprises comparing properties of the undesirable affinity groups to properties of one or more reference groups, and estimating changes for the set of parameters based on the comparing. 
     
     
         13 . A non-transitory computer-readable medium, having stored thereon a computer program executable by a computing device, the computer program comprising a plurality of code sections for:
 receiving data describing the propagation of a plurality of items through a system;   
       modeling the propagation of the plurality of items through the system as a plurality of interconnected affinity groups;
 identifying one or more undesirable affinity groups from the plurality of interconnected affinity groups; and 
 for each one of the undesirable affinity groups, performing the steps of:
 predicting at least one interaction required to cause at least a portion of the plurality of items associated with the one of the undesirable affinity groups to propagate to a desirable affinity group, and 
 causing the one of the undesirable affinity groups to interact with another affinity group configured to provide with the at least one interaction. 
 
 
     
     
         14 . The computer-readable medium of  claim 13 , the computer program further comprising code sections for:
 after causing, repeating the modeling, identifying, and performing until at least one criteria is met.