Characterizing Latent User Interests on Enterprise Networks

We present a methodology for promoting situational awareness of an enterprise network using only network artifacts discernible from network protocol logs. We utilized latent Dirichlet allocation (LDA) over two corpora, the first composed of search queries and the second composed of external domain names issued by enterprise users through the network proxy of a mid-sized enterprise network. We not only quantitatively demonstrate that the LDA topic modeling approach achieves superior fit to the data than do naı̈ve models, but we also demonstrate that a topic modeling approach yields qualitative business analytic information.