Document History System and its Application to Abnormal Document Access Pattern Detection with a Probabilistic Model

Abstract

We present a design and implementation of tracing document history and its application to detecting abnormal document access patterns. We have been working on document history system, which enables us to trace complete access history of operations for both electronic and paper documents. Document history system organizes access pattern trees based on dependency of user operations on documents. We also present a new probabilistic model, multi-layered tree Markov model (MTMM), in order to analyze access pattern trees of documents. The main feature of MTMM is to conduct tree pattern summarization and multilevel structural abstraction for trees. Our contribution is multi-level structural abstraction by incorporating hierarchical inner-state structure of Markov model. Abnormal patterns, such as sending documents to unexpected users, can be detected by applying MTMM to access pattern trees of document history system. We clarify the feasibility and effectiveness of our MTMM by several experiments for synthetic trees and real document access pattern trees.