Patent ID: 9699206
Date: 2017-07-04
CPC Classifications: G06F,G06N,H04L

Claim:
1. A computer-implemented method, comprising: analyzing, by a computing system, historical data of a frequency with which nodes in a network create and receive new edges; establishing, by the computing system, baseline models of behavior among the edges in the network based on the analysis of the historical data; determining, by the computing system, whether each edge in a path or other subgraph is a new edge or a previously existing edge; when an edge is new, calculating, by the computing system, a probability for the edge based on a probability of an originating node initiating a new edge and a receiving node receiving the new edge; when an edge previously exists, applying, by the computing system, a model based on observed behavior to obtain the probability for the edge; detecting, by the computing system, a new edge whose appearance is deemed rare, according to a baseline statistical model, such that a probability of observing the new edge is lower than a predetermined threshold during a time window t; and flagging the new edge, by the computing system, as potentially anomalous when the deviation from the respective baseline model is detected.