WO2000036534A2

WO2000036534A2 - Controlling and marketing method for utilisation of the internet/intranet

Info

Publication number: WO2000036534A2
Application number: PCT/DE1999/003922
Authority: WO
Inventors: Kurt Klemann; Bernhard Nauer; Maximilian Riegel
Original assignee: Siemens Aktiengesellschaft
Priority date: 1998-12-11
Filing date: 1999-12-08
Publication date: 2000-06-22
Also published as: DE19857336C1; WO2000036534A3; EP1279133A2

Abstract

The invention relates to different methods used with regard to the data of an Internet/Intranet user. The result of said methods, such as the rule-based approach, a neural network with supervised training, a density-based profile modelling and a causal network, are optionally combined in order to obtain more significant information with a reduced error rate with regard to utilisation behaviour. Premature recognition of irregularities in the utilisation behaviour, information about the necessity of network expansion and significant information for marketing purposes and costs is thus guaranteed.

Description

description

Controlling and marketing procedures for the use of the internet / intranet

The subject of the registration relates to a method for recording the usage behavior of a participant on the Internet / intranet comprising the features of claim 1.

Non-contractual use of Internet access (e.g. by private individuals at flat rate tariffs of an Internet service provider or by employees of a company) can reach a level that jeopardizes the business base of an Internet service provider or a company. At present it is technically very difficult to identify such cases of use so early that it is possible to react in good time.

Private and business customers or employees of a company use the Internet / intranet in different ways, e.g. For occasional surfing, for transferring data rates (in different sizes), for playing, etc. Targeted marketing campaigns for the various usage groups on the part of the Internet service provider, recognizing market trends or also determining a company's cost-saving potential (e.g. in corporate networks) have been very difficult so far, since the precise assignment of an Internet / Intranet user to various behavioral categories is not adequately supported.

There are currently various tools for detecting fraud in telecommunications. Such tools are based on various techniques, such as the rule-based approach or neural networks, etc. These techniques are used to evaluate CDR (Call Detail Records) or signaling data from the signaling system CCS7. A tool has been announced under the name "HP OpenView Smart Internet Suite; Smart Internet Usage", which collects, correlates and compresses usage-specific Internet data and offers a retrieval function (data response) on this data. The technical implementation and the exact scope of the retrieval function are not known in detail.

The object of the application is based on the problem of specifying a method which has an increase in the significance of the statement with a reduced error rate compared to conventional methods.

The problem is solved by a method having the features of claim 1.

With this tool, suspicions of non-specific uses (e.g. non-contractual use of the Internet / intranet) can be collected at an early stage (keyword: fraud), as can results that are used for marketing purposes, for market trend recognition, for quick reactions to necessary network expansion of the Internet / Intranet or to save costs when using the Internet / Intranet.

The invention provides Internet service providers and companies with extremely good statements regarding - the type of use of the Internet / intranet (in particular also regarding non-contractual use) - market trends (in particular also about abrupt changes in behavior regarding the use of Internet / intranet) - marketing a necessary network expansion etc. In particular, this invention eliminates the disadvantages of the data mining tools on the market. According to a special embodiment of the subject of the application, the results of the individual methods are gnifikanten statement with extremely low error rate compaction ^¬ tet (combined linked).

Advantageous further developments of the subject of the application are specified in the subclaims.

The subject of the application is explained in more detail below as an exemplary embodiment to the extent necessary for understanding with reference to figures. 1 shows a sequence that has become known,

2 shows a basic block diagram of elements and their interaction in the subject of the application, and FIG. 3 shows an application example for modeling a behavioral category in the causal network.

In the figures, the same designations denote the same elements.

The tool that has become known, as far as can be seen, works as shown in FIG. 1 as follows: In a first step, the Internet data Idat are correlated and processed in a preprocessing PP (for: preprocessing) according to fixed rules for Internet Data Records (IDR) condenses; In a second step, the Internet data records with rules entered by the operator (e.g. in the form of select statements) can be output as the result OUT in an evaluation process RETR (for: retrieval, data ining). It is disadvantageous that - a change in the IDR requires a change in the preprocessor - the rules may only refer to the IDR (in particular also the IDR structure) - the IDR is static, which means that information is lost, based systems are not capable of learning, - purely rule-based systems do not know any "exceptions to the rule" (hence a large number of false statements) - purely rule-based systems do not know any border areas.

In the method according to the application shown in FIG. 2, the Internet data Idat of a rule-based preliminary RBPP (for: rule-based preprocessor), whereby the Internet data is correlated and compressed. The Internet data, possibly in preprocessed form, can be subjected to an intermediate storage INTM (for: Interim Memory) as an intermediate result. The Internet data, possibly in preprocessed form and possibly after buffering, is supplied to a method approach MA which contains a rule-based approach RBA, a neural network with monitored training NNUE, a density-based profile modeling DBPM and a causal neural network KNN, in the following causal network called, has. The method approach MA works, as indicated by two double-headed arrows, with a rule base RB, in which the rules are stored, a database MO / TR, in which the modeling / training data are stored, and a database HIST, in which the evaluation results of the current and previous observation periods are stored together. The intermediate results output by the method approach MA or stored in the database HIST can be subjected to an evaluation in a device COMB (for: combination) and are output as the result OUT.

The method according to the application comprises a combination of four different method approaches, the rule-based approach and three method approaches of neuroinformatics (neural network with monitored training, density-based modeling and causal network). The rule formulation or the modeling using the methods of neuroinformatics are carried out on the basis of data that the Internet service provider or a company saves: RADIUS accounting data (usually saved), TCP dump protocol data (saved if required, scope variable), SNMP (Simple Network Management Protocol) data (storage if required) etc. The resulting model represents a controlling and marketing tool. According to the application method is intended for use on Internet / Intranet data that stores the Internet Service Pro ^¬ vider or a company. Such data include the RADIUS accounting data to TCP dump data and the SNMP data. The method can any other Internet / intra ^¬ net data edit.

The RADIUS accounting data is given by data as described in the IETF specification RFC 2139. A real implementation is e.g. in Livingston Enterprises Inc., Radius dictionary, VI.6, 1997.

The TCP dump data is given by data as described in UNIX man-pages tcpdump - dump traffic on a network '.

The SNMP data are given by data as described in the various RFCs of the IETF. An actual implementation is e.g. in Livingston Enterprises Inc., Configuration SNMP, Manual Portmaster 3.

To speed up the processing of the data, a rule-based preprocessor can optionally be used. The preprocessor has the task of correlating and compressing the Internet / Intranet data in such a way that data sets are delivered with the attribute values required in the actual process.

Basically, a preprocessor can be used, as is provided in the proposed solution. However, this presupposes that the IDR contains a superset of the attribute values required by the method.

In a preferred embodiment of the subject of the application, a rule-based preprocessor is used. The rules control the correlation and compression of the Internet / Intranet data. Is added in the actual process, a new attribute or characteristic falls a characteristic AttributeDescriptor ^¬ but off, the selection rules of the preprocessor mono- times may be adjusted (automatically). An automatic ANPAS ^¬ solution of the selection rules can, as in Figure 2 with ADAP (for: Adaptation) designated via Notifications (unsolicited messages) can be controlled to the Preprocessor.

The method described below can thus

- set up directly on the Internet / intranet data,

- Based on the results of any preprocessor (such as HP (Hewlett Packard) IPR)

- Based on results (labeled INTM in Fig. 2) of a specific rule-based preprocessor.

The actual process is divided into four processes. Each method uses a different method approach. The four different method approaches are: - the rule-based procedure,

- the neural network - supervised learning

- density-based profile modeling

- the causal network.

In the rule-based process, typical user-specific behavior categories can be modeled using rules. Behavior is classified by a behavior category, for example the behavior categories "private use student", "private use employee", "private use freelancer", "use small business", "use large business", "player", "internet / intranet" Addict "," users with high mail volume "etc. can be expressed by their characteristic properties in the form of rules. The rules are applied to all Internet / Intranet data or part of this data (eg the result of preprocessing). The result of the method is that after a period of observation t each user does not can be assigned to one or more behavior categories. The observation period can vary depending on the behavior category and the desired purpose of the observation. For example, it will be chosen to be very small for fraud detection (as part of controlling) (e.g. t = 1 day), while it will take several weeks to achieve marketing statements (e.g. t = 4 weeks). If the results of each observation period t (i) are stored user-specifically in the database HIST, changes in the user behavior can be determined quite simply by comparing the individual results t (i) (for example at the beginning, the use of a user corresponded to the behavior category " Private use student ", now it is more likely to be assigned to the behavior category" use of small business ").

The goal is to formulate rules for each behavior category. The rules are described with the help of logical expressions in which the fields (attributes) of the different data records are used as variables, e.g. Use of "private contract employee":: = applies to all data records of the observation period: usage time Monday to Friday between 5 p.m. and midnight and usage time on weekends from 0 a.m. to midnight and data transfer rate <2 megabytes per usage and max. Usage time = 2 hours) Use "private contract freelancer":: = there is a data record of the observation period for which the following applies: No use of "private contract employee" and for all data records of the observation period applies: data transfer rate <10 megabytes per day and max. Usage time = 8 hours In principle, the rules can refer to one or more data records (including different files).

In the application phase of the rule-based method, all selected rules are checked for the specified data at time t. The results are initially logged in a user-specific manner in the HIST database. Strength of the rule-based procedure:

- Classification least categories of user behavior in the form of Verhal ^¬

- Trends, marketing statements, breaches of contract, etc. can be easily derived from this

In the monitored approach, a neural network is trained with a set of examples. The prerequisite for the training is that the associated target value is given for each example, i.e. at the time of the training it must be known whether e.g. for the example under consideration, there was or was not a specified use (specified uses can be, for example, "breach of contract by private contract employee", "use of focus on surfing", "use of focus on players" etc.) The target values to be examined and the attributes characteristic of the example must be specified. The characteristic attributes determine the behavior of a user. The behavior in turn depends on certain attribute values (the data itself). Characteristic attributes can e.g. his:

- Average usage time of the user in one day over an observation period (e.g. four weeks)

- Scatter the usage time of the user

- maximum usage time - minimum usage time

- Average transmission rate of the user in one day over an observation period (e.g. four weeks)

- Spread of the transmission rate of the user

- maximum rate - minimum rate

- Average service life of the user of special internet / intranet services over an observation period (e.g. four weeks)

- Scattering of the usage time of the user - maximum usage time

- minimal usage time etc. In the training phase (preliminary steps) of the neural network, the aim is to create a model that, based on the given example, decides for a user whether or not the Internet / Intranet access is used with regard to one or more defined target values. The model is created by the supervised training, the basics of which are in Rumelhart, DE, Hinton, GE and Williams, RJ Learning infernal representation by error backpropagation, In Parallel Distributed Processing, pp. 318-362, Cambridge, MA, MIT Press, 1986 ) are described in detail.

The following steps are carried out in the training phase: Each user is assigned a behavior pattern in the form of attributes that describes a certain profile over a longer period of time. The attributes characterize the use with regard to a defined target value. The period on which the behavior pattern is based should not be shorter than four weeks and before the point in time when the method for the above-mentioned Purpose is applied.

The neural network is trained on the use of the defined target values using training data. With the training data, it is known whether the use can be assigned to a specific target value or not.

In the application phase of the neural network, which begins after the training phase has been completed, the following steps are carried out continuously:

Based on the examples, the neural network decides whether the use can be assigned to a specific target value or not. This user-specific decision is logged in the HIST database as the result of the observation period. If necessary, the neural network can be trained with new target values with regard to its use (for example cases of contract violations not yet known).

This method is applicable when the user is part of the data.

Strength of this method:

- Easy assignment of exceptions - Taking exceptions into account in the result

- ability to learn

Density-based profile modeling is a probabilistic modeling of the behavior of each user (probabilistic profile modeling), i.e. a model is created for each user based on the examples belonging to this user. These examples consist of characteristic attributes and certain attribute values that describe the use of the Internet / intranet with regard to one or more target values. Examples of characteristic attributes are described in the previous section.

In the training phase of density-based profile modeling, the following steps are carried out: Each user is assigned a set of examples that illustrate the behavior of the

Describes users over a longer period of time. The period of time on which the behavior pattern is based should not be shorter than four weeks and before the time when the method is used for control and marketing purposes. A probabilistic profile is created for each user. This is done by density estimation using the EM algorithm. The exact description is contained in Chris Bishop, Neural Networks in Pattern Recognition, Oxford Press, 1996. After completing the training phase, the application phase of density-based profile modeling begins, in which the following steps are carried out continuously: The data, for example, one day in terms of for the probabilistic profiling of certain data contents is analyzed (a new example is created). The density-based profile model outputs a value that represents a probability of using the internet / intranet of the entity under consideration with regard to the defined target values. This value is logged. If this value differs from the previous values beyond a predefined threshold value, then there is a message that the result should be displayed in any case.This method can be used to easily determine if the use of the Internet / intranet suddenly changes In the current example, the profile model is adapted. This method can be used if the user is part of the data. Powerful of this method: - Detection of an abrupt change in user behavior - Learning ability

The basis for the method of the causal network is the modeling of typical behavior scenarios in the form of causal dependencies and probabilities of certain data contents, as shown in the example "private use of employees" m Fig. 3. A private use of employee PA is assigned a certain usage time UC (for: UseClock), a certain usage period UT (for: UseTi e) and a certain transmission rate RATE. The days of the week, depending on whether it is a working day WD (for: working day) or a weekend WE (for: week end), influence the amount of time of use, the length of use and the transmission rate. The causal dependencies are based on the evaluation of known cases. They do not have to be assigned to specific users. The following steps are carried out in the phase of modeling the causal network: The causal dependencies with regard to the data content are formulated for all data. At the points where the causal dependencies exist, corresponding probabilities are assigned. The domain knowledge of the specialist is necessary in the modeling phase. The basis of the causal network is described in Fmn V. Jensen, An Introduction to Bayesian Networks, UCL Press 1996. In the application phase of the causal len network are continuously following steps Runaway ^¬ leads: The records of the test data are analyzed con ^¬ continuously deliver on existing causal dependencies out. For each user or event, a decision is made as to the likelihood of specific use with regard to the defined scenario. This decision is logged as a result of the observation period in the HIST database. If the user is part of the data, the results are logged in a user-specific manner. The probabilities behind the causal dependencies can be re-adapted. The causal dependencies on new, as yet unknown categories are added to the existing causal dependencies as required. This method can also be used when the user is not part of the data set. In this case, a category cannot be assigned to a specific user. Strength of the method of the causal network: - Assignment of border areas in behavior categories- Recognition of border areas in behavior categories- Learning ability It is basically possible to output the individual results of the individual procedures. In a further embodiment of the subject of the application, the individual results of the individual processes are condensed into one overall result. This consolidation includes the individual results of the different processes. The individual results can come from both the current and past observation periods. Each of the methods described has specific strengths. This can be exploited in the case of a compression, as described in the following example: A user x is, for example, clearly assigned to the behavior category "private use freelancer" if he has used the Internet for more than 2 hours in one day (based on the example rule shown above). However, the causal network sees this user x rather in the behavior scenario "private use of employees", since, for example, he has kept the usage time of less than 2 hours in more than 90% of the data records. These findings could then be result to be displayed in such a way that the use of the Internet / intranet by the user x is, with a few minor exceptions, a "private use of employees". Another example of a compression is the trend detection by evaluating the results of different observation periods.

Claims

claims

1. Procedure for recording the usage behavior of a subscriber on the Internet / intranet, according to which - the subscriber data are logged over a specified period - the logged subscriber data are evaluated according to at least one of the following procedures:

• rule-based approach, • neural network, monitored trained,

• density based profile modeling,

• causal network in such a way that a participant is assigned to a category of usage behavior in accordance with his participant behavior.

2. The method according to claim 1, characterized in that the subscriber data are given by at least one of the following categories of data: RADIUS data, SNMP data, TCP dump protocol data.

3. The method according to any one of the preceding claims, characterized in that the subscriber data are subjected to a rule-based pretreatment before the evaluation.

4. The method according to claim 3, characterized in that the pretreated subscriber data are buffered before the evaluation.

5. The method according to any one of claims 3 or 4, characterized in that, depending on the evaluation result, at least one of the methods automatically adjusts the selection rules for the pretreatment of the subscriber data.

6. The method according to any one of the preceding claims, characterized in that the results, in particular the current results, the evaluations of the individual methods are linked to an end result.

7. The method according to any one of the preceding claims, characterized in that the results of the evaluations of the individual methods of a current observation period and a past observation period are linked to an end result.