Patent ID: 9367809
Filing Date: 2016-06-14
CPC Classification: G06F,G06N,H04L

Claim Text:
1. A contextual graph matching based anomaly detection system comprising: at least one processor; a master directed graph generator, executed by the at least one processor, to evaluate computer-generated log file data to create, in a computer memory, a master directed graph that specifies known events and transitions between the known events; a master directed graph decomposer, executed by the at least one processor, to process the master directed graph to identify a plurality of unique walks through the master directed graph, and to decompose the plurality of unique walks into their probability distributions as a plurality of decomposed master graph walks; an incoming directed graph generator, executed by the at least one processor, to evaluate incoming computer-generated log file data to create an incoming directed graph that specifies unknown events and transitions between the unknown events; an incoming directed graph decomposer, executed by the at least one processor, to process the incoming directed graph to identify an incoming walk through the incoming directed graph, and to decompose the incoming walk into its probability distribution as a decomposed incoming walk; a graph matcher, executed by the at least one processor, to: an anomaly detector, executed by the at least one processor, to select one of the plurality of decomposed master graph walks based on the overlap score, the difference score, and the correlation score, and to detect an anomaly based on the selected one of the plurality of decomposed master graph walks.