AU2013100258A4 - Employing changes in computer usage to infer behavior of the user - Google Patents

Abstract

Changes in a person's behavioral characteristics over time are detected by analysis of changes in the person's computer usage over time. Data representing earlier and later computer usage of the person is collected and used to infer earlier and later behavioral characteristics of the person. Changes in the behavioral characteristics represent a recent change in behavioral characteristics of the person and can indicate a trend by which future behavior of the person can be anticipated. To enable abstraction of behavioral characteristics from data items representing discrete acts of the person, a number of predetermined behavioral characteristic inference rules identify data items matched and specify how behavioral characteristic inferences are influenced by the data items. COMPUTER SERVER -- ---- REQUEST WEB PAGE 20 .4 SEND WEB PAGE GENERATE USAGE 210 PROFILE FROM j206 STOREDIN 208 SEND USAGE PROFILE INFER BEHAVIORAL CHARACTERISTICS OF THE USER OF 212 DEVICE 102 FROM USAGE PROFILES

Description

EMPLOYING CHANGES IN COMPUTER USAGE TO INFER BEHAVIOR OF THE USER BACKGROUND OF THE INVENTION 1. Field of the Invention [00011 The present invention relates generally to computer network services and, more particularly, to methods of and systems for computer-based prediction of human behavior. 2. Description of the Related Art [00021 There are many reasons why people or organizations need to better understand an individual, including just what future behavior might be expected of the person. Such reasons include hiring, promotion, and school admission. And yet existing methods of predicting behavior of an applicant subsequent to acceptance as an employee, for example, are often found to be inadequate. Resumes and even personal recommendations are often sketchy at best and frequently unreliable. Part of the problem is that individuals change - both for the better and for the worse. Another problem is the natural lack of objectivity often found in personal recommendations, and the inaccuracies that are common in resumes where the applicant is trying to present his or her past in the most favorable way. Negative information can also be misleading. Rejection of an applicant can be focused on a juvenile arrest in the distant past, yet the person might well have turned his life around long ago. Or, an earlier firing or lack of promotion can cause a reviewer to ignore recently acquired much better work skills and good work habits, or better job performance doing work better suited to the person's skills and interests. Similarly, acceptance or promotion of a person based on a history of excellent performance can entirely miss any very recent changes in work behavior or character that normally would be clear reasons for rejection. 100031 Even a sizable and specific record of an applicant's actual work over a long period of time that does not separately consider recent performance can easily miss crucially important information - good or bad - about the applicant. 100041 A better way of collecting a recent record of a person's actual recent activity and comparing it both to an earlier record and to a group of desirable characteristics would more reliably help understand their abilities and/or predict their future behavior, despite unsuitable earlier history or despite efforts to improve a reviewer's impression of the person's record.

SUMMARY OF THE INVENTION 100051 In accordance with the present invention, changes in a person's behavioral characteristics over time are detected by analysis of changes in the person's computer usage over time. The result is that recent behavioral characteristics of the person can be given more weight in determining likely future behavior. 100061 Data representing earlier computer usage of the person as of a given time is collected and used to infer behavioral characteristics of the person at that time. Data representing later computer usage of the person as of a subsequent time is collected and used to infer more recent behavioral characteristics of the person at that subsequent time. Changes in the behavioral characteristics represent a recent change in behavioral characteristics of the person and can indicate a trend by which future behavior of the person can be anticipated. 100071 While data representing usage of a computer by the person can tell us precisely what the person was doing at any given time, the usage data in and of itself generally does not quantify behavioral characteristics of the person. To allow particularly helpful comparisons of behavioral trends of the person, different types of computer usage can be combined to represent a single behavioral characteristic cumulatively. For example, usage of various locally installed e-mail clients and web-based e-mail clients - all different applications - can all influence a single behavioral characteristic of reading and writing e mail. And, a dramatic change in the time a person reads and writes e-mail can indicate a dramatic change in the person. 100081 To enable abstraction of behavioral characteristics from data items representing discrete acts of the person, a number of predetermined behavioral characteristic inference rules identify data items matched and specify how behavioral characteristic inferences are influenced by the data items. BRIEF DESCRIPTION OF THE DRAWINGS 100091 Other systems, methods, features and advantages of the invention will be or will become apparent to one with skill in the art upon examination of the following figures and detailed description. It is intended that all such additional systems, methods, features and advantages be included within this description, be within the scope of the invention, and be protected by the accompanying claims. Component parts shown in the drawings are not necessarily to scale, and may be exaggerated to better illustrate the important features of the invention. In the drawings, like reference numerals may designate like parts throughout the different views, wherein: 100101 FIG. I is a diagram showing a client computer device and a server computer that cooperate to infer recent changes in a person's behavioral characteristics in accordance with one embodiment of the 2 present invention. 100111 FIG. 2 is a transaction flow diagram illustrating the manner in which the client computer and server computer of FIG. I cooperate to create profiles of the early and recent usage of the client computer in accordance with one embodiment of the invention. 100121 FIG. 3 is a logic flow diagram illustrating a step of the transaction flow diagram of FIG. 2 in greater detail. 100131 FIGS. 4 and 5 are logic flow diagrams illustrating alternative embodiments of a step of the transaction flow diagram of FIG. 2 in greater detail. 100141 FIG. 6 is a logic flow diagram illustrating the manner in which the server of FIG. I infers a user profile from a usage profile. 100151 FIG. 7 is a block diagram showing in greater detail the server computer of FIG. 1, including usage profile data. [00161 FIG. 8 is a block diagram showing in greater detail the client computer of FIG. 1, including data relating to its usage. 100171 FIG. 9 is a block diagram of a profile of the usage of a client computer in accordance with one embodiment of the present invention. 100181 FIG. 10 is a block diagram of a behavioral characteristic inference rule used by the server to infer a user profile from a usage profile. 100191 FIG. II is a block diagram of a user profile, representing inferred behavioral characteristics of a person. [00201 FIG. 12 is a logic flow diagram showing the process by which inferred behavior of the user of the client computer during a recent usage period and an earlier usage period is used to determine the whether the user is acceptable for a future relationship in accordance with one embodiment of the invention. DETAILED DESCRIPTION 100211 In accordance with the present invention, a server 106 (FIG. I) infers behavioral characteristics of a computer user from data representing the user's use of a client computer 102 (FIG. 1) at earlier and later times to identify changes in the behavioral characteristics of the user from the earlier time to the later time. 100221 As shown in FIG. 1, client computer 102 and server 106 communicate with one another 3 through a wide area network 104, which is the Internet in this illustrative example. Client computer 102 can be any of a number of types of computer devices, including smartphones, tablets, netbooks, laptops, and desktops. Sources of the personal information relating to past usage on the client computer 102 include browsers and mini-browsers, games, work-related programs---including software used by various professionals--music, and photo and video editors, among a great many possible variations in software and its uses. 100231 Server 106 (FIG. 1) infers behavioral characteristics of the user of client computer 102 in this illustrative example from usage information 830 (FIG. 8) stored on client computer 102 (FIG. 1). Usage information 830 is a record maintained in client computer 102 and includes information regarding the usage of client computer 102. 10024] Transaction flow diagram 200 (FIG. 2) represents the manner in which client computer 102 and server 106 cooperate to infer behavioral characteristics of the user of client computer 102 in this illustrative example. [00251 In step 202, client computer 102 sends a request for a web page to server computer 106. The request can be in the form of a URL specified by the user of client computer 102 using a web browser 820 (FIG. 8) executing in client computer 102 and conventional user interface techniques involving physical manipulation of user input devices 808. Web browser 820 and user input devices 808 and other components of client computer 102 are described in greater detail below. 100261 In step 204 (FIG. 2), server 106 sends the web page that is identified by the request received in step 202. In particular, server 106 includes web server logic 720 (FIG. 7) that responds to the request of step 202 and web application logic 722 that specifies the content to be sent to client computer 102 in response to the request. 100271 In step 206, content of the web page received by client computer 102 causes web browser 820 (FIG. 8) of client computer 102 to generate a usage profile for client computer 102 from usage information 830 (FIG. 8). In this illustrative embodiment, a web browser plug-in 822C is installed in client computer 102 and, invoked by the received content as executed by web browser 820, generates the usage profile from usage information 830. The various elements of client computer 102 and their interaction are described more completely below. In addition, step 206 is described more completely below with respect to logic flow diagram for step 206 (FIG. 3). 100281 In step 208 (FIG. 2), client computer 102 sends the usage profile that was generated in step 206 to server 106. [00291 Server 106 and client computer 102 repeat block 210 of steps 202-208 at least once at some 4 later date. As a result, server 106 has two usage profiles of client computer 102, one from an earlier time and at least one from a later time. Alternatively, if the usage profiles include time stamps for each item of usage data, earlier and later usage profiles can be derived from a single usage profile by excluding items of usage data with time stamps outside of a time range to be represented by a given usage profile. For example, if one usage profile is to be current and the other is to represent usage as of one month earlier, the earlier usage profile can be derived form the current usage profile by including only those items of usage data with time stamps that are at least one month old. 100301 In step 212, behavioral inference logic 724 (FIG. 7) of server 106 infers one or more behavioral characteristics of the user of client device 102 from the usage profiles received in repeated performances of step 208. Differences from an earlier usage profile to a later usage profile represent recent changes in the user's behavior. Recent changes in the user's before are predictive of near future behavior of the user. Two illustrative embodiments of step 212 are respectively described in greater detail below in conjunction with logic flow diagrams 212A (FIG. 4) and 212B (FIG. 5). 10031] In the first illustrative embodiment shown in logic flow diagram 212A (FIG. 4), behavioral inference logic 724 (i) infers characteristics of the user from the earlier usage profile in step 402, (ii) infers characteristics of the user form the later usage profile in step 404, and (iii) identifies changes in the characteristics from the characteristics of the earlier usage profile to the characteristics of the later usage profile in step 406. 100321 In the second illustrative embodiment shown in logic flow diagram 212B (FIG. 5), behavioral inference logic 724 infers characteristics of the user from the earlier usage profile in step 502. The manner in which behavioral inference logic 724 (FIG. 7) infers characteristics of the user from a usage profile is described below in greater detail with respect to logic flow diagram 600 (FIG. 6). In step 504 (FIG. 5), behavioral inference logic 724 identifies changes in the usage profiles from an earlier usage profile to a later usage profile. 100331 In step 506, behavioral inference logic 724 incrementally infers characteristics of the user from the changes from the earlier usage profile to the later usage profile. In particular, behavioral inference logic 724 starts with the user profile representing characteristics of the user inferred from the earlier usage profile in step 502 and adjusts the user profile according to behavior inferences from only the portions of the later usage profile not included in the earlier profile. In this way, inference processing for common portions of the earlier and later usage profiles is performed only once, increasing efficiency. 100341 The result of step 506 is a user profile representing behavioral characteristics inferred from the entirety of the later usage profile. In step 508, behavioral inference logic 724 identifies changes from the 5 earlier user profile to the later user profile. 100351 As described in greater detail below in conjunction with logic flow diagram 600 (FIG. 6), the characteristics of the user inferred by behavioral inference logic 724 from a usage profile is an abstraction from the usage profile representing a personality profile of the user. The particular characteristics to be inferred by behavioral inference logic 724 depend on the particular personality traits and tendencies of concern to the entity controlling server 106. For example, one organization might highly value punctuality of a given class of employees and might design behavioral inference logic 724 to infer punctuality from times at which employees of the class use their computers. Other examples of personality characteristics that can be inferred from usage profiles include activity in furtherance of work related tasks, activity not related to work tasks (personal or social networking sites, for example), interest in malicious computing, participating in public forums, etc. [00361 One illustration of the value of identifying recent personality changes of a person is as follows. Consider that an employee in a low-security position is a candidate for promotion into a higher-security position. Also consider that a usage profile of the employee shows substantial interest in malicious programming. If comparison to an earlier usage profile indicates that the interest in malicious programming is new or has grown substantially recently, the employee can be determined to be a bad risk for a position with higher security access. On the other hand, if comparison to earlier usage profiles that the employee has always had substantial interest in malicious programming and that the current interest is not greater than, or less than, such can indicate that the employee has a benign, hobby-like interest in malicious programming and can even indicate aptitude in computer security and defending against attacks of malicious programming. [00371 As described above, client computer 102 generates a usage profile from usage information 830 (FIG. 8) in step 206 (FIG. 2), and step 206 is shown in greater detail as logic flow diagram 206 (FIG. 3). In this illustrative embodiment, step 206 is performed by web browser plug-in 822C (FIG. 8). In other embodiments, step 206 can be performed by logic installed in client computer 102, either downloaded from server 106 or installed from portable computer-readable media, for example. 100381 In step 302 (FIG. 3), web browser plug-in 822C (FIG. 8) collects usage information of all types from usage information 830, which includes a number of items of usage activity of client computer 102 each having a type and a value. The value can be complex, including multiple data fields. 100391 There are a number of types of usage information of client computer 102 and a number of ways to gather such information. These types and ways are described in co-pending U.S. Patent Application No 61/,676,251 by Craig S. Etchegoyen on July 26, 2012 for "" (Attorney Docket: UN-014) and that 6 description is incorporated herein by reference. Briefly, item types can include generally be any type of usage information stored on client computer 102 that represents usage of client computer 102, including use of client computer 102's games, professional software, music, and photo editing and video editing software. Such items represent user activity on client computer 102 and can be indicative of subjective needs and preferences of the user. 100401 Loop step 304 (FIG. 3) and next step 312 define a loop in which web browser plug-in 822C (FIG. 8) processes each item of usage information 830 in accordance with steps 304-314. The particular item of usage information 830 processed by web browser plug-in 822C during each iteration of the loop of steps 304-314, is sometimes referred to herein as "the subject item." [00411 In step 306 (FIG. 3), web browser plug-in 822C (FIG. 8) forms a reversible hash of each data element of the subject item. Each data element of the subject item is hashed by web browser plug-in 822C to hide personal information during transport through wide area network 104 (FIG. 1). In particular, item type 904 (FIG. 9) of usage profile item record 902 is a hash of the type of the subject item, and value 906 is a hash of the value of the subject item. 100421 In step 308 (FIG. 3), web browser plug-in 822C (FIG. 8) packages all the reversible hashes of data elements of the subject item into a single, reversible hash representing the subject item in its entirety. Web browser plug-in 822C forms usage information item record 902 (FIG. 9) as a hash of item type 904 and value 906 in this illustrative embodiment. [0043] In step 310 (FIG. 3), web browser plug-in 822C (FIG. 8) adds the hash created in step 308 to an accumulation of data item hashes. The accumulation of data item hashes is a usage profile of client computer 102 sent to server 106 in step 208 (FIG. 2). 100441 Once all items of usage information 830 (FIG. 8) have been processed by web browser plug-in 822C according to the loop of steps 304-312 (FIG. 3), processing according to logic flow diagram 206, and therefore step 206 (FIG. 2), completes. The resulting usage profile is an accumulation of hashes that represent multiple items of usage information stored on client device 102 that represent the subjective needs and preferences of the user as of the date and time that the usage data was collected. 100451 As described above, server 106 (FIG. 1) infers one or more behavioral characteristics of the user in steps 402 (FIG. 4) and 404 and 504 (FIG. 5) from the usage profiles received in step 208 (FIG. 2). This is shown in greater detail as logic flow diagram 600 (FIG. 6). The usage profile is stored by server 106 as a usage profile data record 900 (FIG. 9) in usage profile data 730 (FIG. 7). The behavioral characteristics of the user are represented in a user profile record 1100 (FIG. 11), which can also be stored in usage profile data 730. 7 100461 In step 602 (FIG. 6), behavioral inference logic 724 parses individual reversible hashes representing whole, individual items of usage information from usage profile data record 900 (FIG. 9) and reverses those hashes to reconstruct usage information item records 902 such that usage information item records 902 are readable by behavioral inference logic 724. 100471 In step 604 (FIG. 6), behavioral inference logic 724 initializes a behavioral profile as represented by user profile data record 1100 (FIG. 11). In particular, behavioral inference logic 724 represents that value 1106 of all user characteristics 1104 are initialized to be unknown. 100481 Loop step 606 (FIG. 6) and next step 614 define a loop in which behavioral inference logic 724 (FIG. 7) processes each usage information item record 902 (FIG. 9) of usage profile data record 900 according to steps 608-612 (FIG. 6). During each iteration of the loop of steps 606-614, the particular usage information item processed by behavioral inference logic 724 is sometimes referred to as "the subject usage information item" in the context of logic flow diagram 600. In the same context, usage information record 902 (FIG. 9) represents the subject usage information item. In particular, item type 904 and value 906 represent the type and value, respectively, of the subject usage information item. 100491 In loop step 608 (FIG. 6), behavioral inference logic 724 identifies one or more matching behavioral inference records, such as behavioral inference record 1000 (FIG. 10), for the subject usage information item. Behavioral inference record 1000 matches the usage information item represented by usage information item record 902 if item type 1002 and item type 1004 are the same and application of test value 1004 to value 906 with test operator 1006 yields a "true" result. 100501 It may be helpful to consider the following example. Suppose, for example, that item type 1002 specifies HTTP network traffic events, thus representing web browsing of the user, test value 1004 specifies a regular expression designed to match URLs of web sites believed to be associated with malicious programming, and test operator 1006 specifies a regular expression match operation. Behavioral inference record 1000 would then match usage information item record 902 (FIG. 9) if item type 904 specifies HTTP network traffic events and value 906 includes URLs that are matched by the regular expression of test value 1004. [00511 For each matching behavioral inference record for the subject usage information item, processing by behavioral inference logic 724 (FIG. 7) transfers from loop step 608 (FIG. 6) to step 610. 100521 In step 610, behavioral inference logic 724 adjusts the behavioral profile according to behavioral inference 1008 (FIG. 10) of the matching behavioral inference record. Characteristic 1010 identifies a user characteristic 1102 (FIG. 11) to be adjusted. 100531 User profile data record 1100 represents characteristics of the user. Each of user characteristics 8 1102 represents a particular personal or behavioral characteristic. Characteristic 1104 specifies the particular characteristic and value 1106 represents the degree to which the characteristic is manifest in the user. For example, characteristic 1104 can specify the characteristic of punctuality and value 1106 can represent how punctual the user is. Examples of characteristics include interest in malicious programming, workplace access to inappropriate content, game playing, work, shopping purchases and personal interests, including music. As mentioned above, the particular characteristics to be analyzed in the manner described herein depends on the particular characteristics of interest to the entity operating server 106. 100541 Inference value 1012 represents a particular value for characteristic represented by characteristic 1010. Inference weight 1014 represents an amount by which value 1106 (FIG. 11) is biased toward the value represented by inference value 1012 (FIG. 10). For example, if characteristic 1104 represents interest in malicious programming, value 1106 can represent the degree to which the user has that interest, e.g., represented numerically from 0 for no interest to 100 for an obsession. If fields 1002 1006 (FIG. 10) of behavioral characteristics inference record 1000 match a URL for a computer security web site in the user's browsing history, inference value 1012 can represent full interest in malicious programming and inference weight 1014 can represent relatively light weight since a single visit to a web site related to computer security only slightly suggests an interest in malicious programming. However, if behavioral characteristics inference record 1000 matches a download of malicious code or of tools to develop malicious code, inference weight 1014 can be much greater if it is believed that such activity is highly indicative of interest in malicious programming. 100551 It should be appreciated that the particular matching criteria of fields 1002-1006, inference values, and inference weights to be used are to be designed by the entity operating server 106 according to the entity's particular, subjective needs. One organization may have great interest in detecting employees who might engage in corporate espionage while another, perhaps a religious organization, may have great interest in detecting organization members with strong interest in inappropriate subject matter such as pornography, drugs, sexual activity, for example. The particular activities to be matched by behavioral characteristics inference records such as behavioral characteristics inference record 1000 and the particular characteristic inferences made are up to such organizations to set to meet the organization's specific, subjective needs. 100561 Inferences, such as represented in behavioral characteristics inference record 1000 for example, can be determined empirically by statistical analysis of usage information of a number of known users. When a user voluntarily provides information about her own behavioral characteristics, usage information such as usage information 830 (FIG. 8) is gathered and associated with the usage information such that 9 statistical regression can be performed to determine proper behavioral inferences from such usage information. While users might not always provide accurate self-assessments, their usage information and self-assessments can provide a base for comparison. [00571 In a single performance of step 610 (FIG. 6), value 1106 is biased toward inference value 1012 (FIG. 10) in an amount specified by inference weight 1014. In multiple performances of step 610 (FIG. 6) in the loop of steps 608-612, behavioral inference logic 724 (FIG. 7) adjusts value 1106 (FIG. 11) for each of many user characteristics 1102 and the adjustments accumulate. And behavioral inference logic 724 (FIG. 7) repeats the loop of steps 608-612 for each usage information item record 902 (FIG. 9) of usage profile data record 900. 10058] When behavioral inference logic 724 (FIG. 7) completes the loop of steps 606-614 (FIG. 6) because there are no more usage information items to compare to behavioral inference records and therefore no further adjustments to be made to user profile data record 1100 (FIG. 11), processing by behavioral inference logic 724 (FIG. 7) according to logic flow diagram 600 (FIG. 6) completes. User profile data record 1100 (FIG. 11) is the result of cumulative adjustments made in repeated performances of step 610 (FIG. 6) after being initialized as neutral in step 604. [00591 As described above with respect to logic flow diagram 212A (FIG. 4), a user profile data record for a given user is created for at least two distinct times, resulting in an earlier user profile and a later user profile. Changes in the characteristics from the earlier user profile to the later user profile are determined by comparing user characteristics 1102 (FIG. 11) with matching characteristics 1104 from the earlier and later user profiles. The comparison can be as simple as arithmetic subtraction. For example, value 1106 from a user characteristic 1102 from the earlier user profile is subtracted from value 1106 of the same user characteristic 1102 (as identified by characteristic 1104) from the later user profile. For example, if value 1106 representing interest in malicious programming is 23 on a scale of 0 to 100 in the earlier user profile and is 78 in the later user profile (a difference of +55), a dramatic and recent increase in interest in malicious programming is detected. A subsequent user profile in which the interest in malicious programming is 45 (a difference of -33 from 78) indicates a drop in such interest. 100601 While merely reporting changes in user profiles over time in a human-readable format to a human supervisor provides the supervisor with substantial insight into employee behavior not yet seen in the art, behavioral inference logic 724 (FIG. 7) can be configured to periodically infer personal characteristics of number of people and to automatically report changes in user profiles that exceed predetermined triggering criteria. Such criteria can be specified by the entity operating server 106 according to the entity's particular needs and interests. In one illustrative example, behavioral inference logic 724 is configured to notify one or more predetermined supervisors when any user profile 10 characteristic changes by more than 10% in a two-week period. 100611 In some embodiments, differences between earlier and later user profiles are not measured directly but by comparison of each of the user profiles to a predetermined reference profile. Logic flow diagram 1200 of FIG. 12 shows one such example. [00621 In step 1202, behavioral inference logic 724 (FIG. 7) compares the later user profile representing a user's characteristics inferred from the recent period of usage to predetermined reference usage profile that represents acceptable user characteristics. Just as the entity operating server 106 decides what characteristics are important and how they are inferred, the entity also defines acceptable ranges for such characteristics according to the specific needs and interests of the entity. If behavioral inference logic 724 (FIG. 7) finds, in test step 1204 (FIG. 12), the later user profile is not within the predetermined ranges of the reference usage profile, behavioral inference logic 724 (FIG. 7) determines that the person's likely future behavior is unacceptable in terminal step 1206 (FIG. 12). 100631 If, however, behavioral inference logic 724 (FIG. 7) finds, in step 1204 (FIG. 12), the later user profile is within the predetermined ranges of the reference usage profile, processing transfers to step 1208. In step 1208, behavioral inference logic 724 (FIG. 7) compares the earlier user profile representing a user's characteristics inferred from the earlier period of usage to the predetermined reference usage profile. 100641 If behavioral inference logic 724 (FIG. 7) finds, in test step 1210 (FIG. 12), the earlier user profile is not within the predetermined ranges of the reference usage profile, behavioral inference logic 724 (FIG. 7) determines that the person's likely future behavior is uncertain, i.e., neither determined to be acceptable or to be unacceptable, in terminal step 1212 (FIG. 12). 100651 If, however, behavioral inference logic 724 (FIG. 7) finds, in test step 1210 (FIG. 12), the earlier user profile is within the predetermined ranges of the reference usage profile, behavioral inference logic 724 (FIG. 7) determines that the person's likely future behavior is acceptable in terminal step 1214 (FIG. 12). 100661 In effect, in logic flow diagram 1200, behavioral inference logic 724 (FIG. 7) determines that a person's like future behavior is (i) unacceptable if recent behavior of the person is unacceptable, (ii) acceptable if recent and earlier behavior of the person is acceptable, and (iii) uncertain if the person's recent behavior is acceptable but earlier behavior was not acceptable. [00671 The usage of the computer devices of the great majority of users is sufficiently similar as to make it possible to limit the number of different predetermined behavioral profiles while still accurately determining, not only whether the past behavior of a user of computer 102 is acceptable, but, perhaps, I I whether it will change - for the better or the worse. Since the behavior of some users change, other users with the same behavioral profile can be predicted to eventually make similar behavioral changes. As a result, noting recent changes in personal data from a behavioral profile provides a clue to the future behavior of others with the same profile. Information on users whose usage profiles changed is manually entered into the behavioral profile data resident on server 106. 100681 Server computer 106 is shown in greater detail in FIG. 7. Server 106 includes one or more microprocessors 702 (collectively referred to as CPU 702) that retrieve data and/or instructions from memory 704 and execute retrieved instructions in a conventional manner. Memory 704 can include generally any computer-readable medium including, for example, persistent memory such as magnetic and/or optical disks, ROM, and PROM and volatile memory such as RAM. 100691 CPU 702 and memory 704 are connected to one another through a conventional interconnect 706, which is a bus in this illustrative embodiment and which connects CPU 702 and memory 704 to network access circuitry 712. Network access circuitry 712 sends and receives data through computer networks such as wide area network 104 (FIG. 1). 100701 A number of components of server 106 are stored in memory 704. In particular, web server logic 720 and web application logic 722, including behavioral inference logic 724, are all or part of one or more computer processes executing within CPU 702 from memory 704 in this illustrative embodiment but can also be implemented using digital logic circuitry. [0071] Web server logic 720 is a conventional web server. Web application logic 722 is content that defines one or more pages of a web site and is served by web server logic 720 to client devices such as client computer 102. Behavioral inference logic 724 is a part of web application logic 722 that infers one or more behavioral characteristics of users of client computers in the manner described above. [00721 Usage profile data 730 and behavioral inference information 732 are data stored persistently in memory 704 and can each be organized as one or more databases. [00731 Client computer 102 is a personal computing device and is shown in greater detail in FIG. 8. Client computer 102 includes one or more microprocessors 802 (collectively referred to as CPU 802) that retrieve data and/or instructions from memory 804 and execute retrieved instructions in a conventional manner. Memory 804 can include generally any computer-readable medium including, for example, persistent memory such as magnetic and/or optical disks, ROM, and PROM and volatile memory such as RAM. [00741 CPU 802 and memory 804 are connected to one another through a conventional interconnect 806, which is a bus in this illustrative embodiment and which connects CPU 802 and memory 804 to one 12 or more input devices 808, output devices 810, and network access circuitry 812. Input devices 808 can include, for example, a keyboard, a keypad, a touch-sensitive screen, a mouse, a microphone, and one or more cameras. Output devices 810 can include, for example, a display - such as a liquid crystal display (LCD) - and one or more loudspeakers. Network access circuitry 812 sends and receives data through computer networks such as wide area network 104 (FIG. 1). [00751 A number of components of client computer 102 are stored in memory 804. In particular, web browser 820 is all or part of one or more computer processes executing within CPU 802 from memory 804 in this illustrative embodiment but can also be implemented using digital logic circuitry. As used herein, "logic" refers to (i) logic implemented as computer instructions and/or data within one or more computer processes and/or (ii) logic implemented in electronic circuitry. Web browser plug-ins 822A-C are each all or part of one or more computer processes that cooperate with web browser 820 to augment the behavior of web browser 820. The manner in which behavior of a web browser is augmented by web browser plug-ins is conventional and known and is not described herein. [00761 Usage information 830 is data stored persistently in memory 804 and can be organized as one or more databases. [00771 The above description is illustrative only and is not limiting. The present invention is defined solely by the claims which follow and their full range of equivalents. It is intended that the following appended claims be interpreted as including all such alterations, modifications, permutations, and substitute equivalents as fall within the true spirit and scope of the present invention. 13

Claims (15)

1. A method for inferring changes in one or more behavioral characteristics of a user of a remote located computer, the method comprising: receiving earlier usage information data from the remotely-located computer, wherein the earlier usage information data includes one or more items of data representing user-initiated activity of the remotely-located computer prior to an earlier time; receiving later usage information data from the remotely-located computer, wherein the later usage information data includes one or more items of data representing user-initiated activity of the remotely-located computer prior to a later time, wherein the later time is subsequent to the earlier time; for each of the items of data of the earlier and later usage information data: determining that one or more applicable ones of one or more predetermined behavioral characteristic inference rules apply to the item of data; and adjusting one or more behavioral characteristic inferences according to the applicable predetermined behavioral characteristic inference rules; inferring one or more earlier characteristics of the user from the behavioral characteristic inferences from the items of data from the earlier usage information data; inferring one or more later characteristics of the user from the behavioral characteristic inferences from the items of data from the later usage information data; and identifying differences from the earlier characteristics to the later characteristics.

2. The method of claim 1 further comprising: comparing the earlier characteristics to a predetermined range of acceptable characteristics; comparing the later characteristics to a predetermined range of acceptable characteristics; upon a condition in which the later characteristics are not within the predetermined range, determining that the user's likely future behavior is unacceptable; upon a condition in which the later characteristics are within the predetermined range and the earlier characteristics are not within the predetermined range, determining that the acceptability of the user's likely future behavior is uncertain; and upon a condition in which the later characteristics are within the predetermined range and the earlier characteristics are within the predetermined range, determining that the user's likely future behavior is acceptable.

3. The method of claim 1 wherein the predetermined behavioral characteristic inference rules are determined empirically. 14

4. The method of claim I wherein the items of data of the earlier usage information data and the later usage information data include time stamps.

5. The method of claim I wherein each of the predetermined behavioral characteristic inference rules comprises: matching criteria by which applicability of the predetermined behavioral characteristic inference rule to each of the items of data of the earlier usage information data and the later usage information data; characteristic data identifying a particular behavioral characteristic whose inference is influenced by application of the predetermined behavioral characteristic inference rule; and inference adjustment data specifying the manner in which application of the predetermined behavioral characteristic inference rule adjusts the particular behavioral characteristic.

6. A computer readable medium useful in association with a computer which includes one or more processors and a memory, the computer readable medium including computer instructions which are configured to cause the computer, by execution of the computer instructions in the one or more processors from the memory, to infer changes in one or more behavioral characteristics of a user of a remote-located computer by at least: receiving earlier usage information data from the remotely-located computer, wherein the earlier usage information data includes one or more items of data representing user-initiated activity of the remotely-located computer prior to an earlier time; receiving later usage information data from the remotely-located computer, wherein the later usage information data includes one or more items of data representing user-initiated activity of the remotely-located computer prior to a later time, wherein the later time is subsequent to the earlier time; for each of the items of data of the earlier and later usage information data: determining that one or more applicable ones of one or more predetermined behavioral characteristic inference rules apply to the item of data; and adjusting one or more behavioral characteristic inferences according to the applicable predetermined behavioral characteristic inference rules; inferring one or more earlier characteristics of the user from the behavioral characteristic inferences from the items of data from the earlier usage information data; inferring one or more later characteristics of the user from the behavioral characteristic inferences from the items of data from the later usage information data; and identifying differences from the earlier characteristics to the later characteristics.

7. The computer readable medium of claim 6 wherein the computer instructions are configured to 15 cause the computer, by execution of the computer instructions in the one or more processors from the memory, to infer changes one or more behavioral characteristics of a user of a remote-located computer by at least also: comparing the earlier characteristics to a predetermined range of acceptable characteristics; comparing the later characteristics to a predetermined range of acceptable characteristics; upon a condition in which the later characteristics are not within the predetermined range, determining that the user's likely future behavior is unacceptable; upon a condition in which the later characteristics are within the predetermined range and the earlier characteristics are not within the predetermined range, determining that the acceptability of the user's likely future behavior is uncertain; and upon a condition in which the later characteristics are within the predetermined range and the earlier characteristics are within the predetermined range, determining that the user's likely future behavior is acceptable.

8. The computer readable medium of claim 6 wherein the predetermined behavioral characteristic inference rules are determined empirically.

9. The computer readable medium of claim 6 wherein the items of data of the earlier usage information data and the later usage information data include time stamps.

10. The computer readable medium of claim 6 wherein each of the predetermined behavioral characteristic inference rules comprises: matching criteria by which applicability of the predetermined behavioral characteristic inference rule to each of the items of data of the earlier usage information data and the later usage information data; characteristic data identifying a particular behavioral characteristic whose inference is influenced by application of the predetermined behavioral characteristic inference rule; and inference adjustment data specifying the manner in which application of the predetermined behavioral characteristic inference rule adjusts the particular behavioral characteristic. It.

A computer system comprising: at least one processor; a computer readable medium that is operatively coupled to the processor; network access circuitry that is operatively coupled to the processor; and behavioral inference logic (i) that executes at least in part in the processor from the computer readable medium and (ii) that, when executed, causes the computer system to infer changes in one or 16 more behavioral characteristics of a user of a remote-located computer by at least: receiving earlier usage information data from the remotely-located computer, wherein the earlier usage information data includes one or more items of data representing user-initiated activity of the remotely-located computer prior to an earlier time; receiving later usage information data from the remotely-located computer, wherein the later usage information data includes one or more items of data representing user-initiated activity of the remotely-located computer prior to a later time, wherein the later time is subsequent to the earlier time; for each of the items of data of the earlier and later usage information data: determining that one or more applicable ones of one or more predetermined behavioral characteristic inference rules apply to the item of data; and adjusting one or more behavioral characteristic inferences according to the applicable predetermined behavioral characteristic inference rules; inferring one or more earlier characteristics of the user from the behavioral characteristic inferences from the items of data from the earlier usage information data; inferring one or more later characteristics of the user from the behavioral characteristic inferences from the items of data from the later usage information data; and identifying differences from the earlier characteristics to the later characteristics.

12. The computer system of claim 11 wherein execution of the behavioral inference logic causes the computer to infer changes one or more behavioral characteristics of a user of a remote-located computer by at least also: comparing the earlier characteristics to a predetermined range of acceptable characteristics; comparing the later characteristics to a predetermined range of acceptable characteristics; upon a condition in which the later characteristics are not within the predetermined range, determining that the user's likely future behavior is unacceptable; upon a condition in which the later characteristics are within the predetermined range and the earlier characteristics are not within the predetermined range, determining that the acceptability of the user's likely future behavior is uncertain; and upon a condition in which the later characteristics are within the predetermined range and the earlier characteristics are within the predetermined range, determining that the user's likely future behavior is acceptable.

13. The computer system of claim 11 wherein the predetermined behavioral characteristic inference rules are determined empirically. 17

14. The computer system of claim I 1 wherein the items of data of the earlier usage information data and the later usage information data include time stamps.

15. The computer system of claim 11 wherein each of the predetermined behavioral characteristic inference rules comprises: matching criteria by which applicability of the predetermined behavioral characteristic inference rule to each of the items of data of the earlier usage information data and the later usage information data; characteristic data identifying a particular behavioral characteristic whose inference is influenced by application of the predetermined behavioral characteristic inference rule; and inference adjustment data specifying the manner in which application of the predetermined behavioral characteristic inference rule adjusts the particular behavioral characteristic. 18