Assurance of user behavioral patterns in software applications with quasi-supervised clustering

Abstract

Systems, methods, and other embodiments associated with quasi-supervised clustering for activity pattern characterization and anomalous activity detection are described. In one embodiment, a method generates a first sparse similarity matrix for nearest neighbors of a plurality of data points. The data points each characterize a pattern of activity associated with an account. The method generates a second sparse similarity matrix for random neighbors of the plurality of data points. The method recursively clusters the plurality of data points based on the first sparse similarity matrix. The method quasi-supervises the recursive clustering based on the second sparse similarity matrix to stop the iterative clustering when the data points are split into N clusters. The value of N is not pre-determined. The method detects that the individual data point has changed clusters, indicating anomalous activity. And, the method generates an electronic alert that the anomalous activity is associated with the account.