Patent attributes
Actions in an electronic environment are monitored during a learning period and behavior profiles generated using feature values for those actions. Subsequent behavior can be compared against the profiles to track the anomalies, or mismatches between features of incoming events and features of the profiles. A high percentage of mismatch can make a feature a candidate for exclusion from the behavioral profile. Normalization methods can be applied on features flagged as exclusion candidates. If any normalization sufficiently decreases the mismatch rate, the feature will not be excluded from the behavior profile. Any exclusion candidate feature which does not have an adequate mismatch value after normalization can be removed from tracked features of the corresponding profile. The behavior profile can be used to detect anomalous behavior that deviates from values of the behavior profile.
