Patent ID: 9712420
Date: 2017-07-18
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method comprising: determining, using a data processing device, that a first entity was involved in a first event occurring at a first time; determining, using the data processing device, that a second entity, different from the first entity, was involved in a second event, separate from the first event, occurring at a second time different from the first time; comparing the first time with the second time using the data processing device to determine whether the first time is within a specified amount of time from the second time; in response to determining that the first entity was involved in an event that occurred within the specified amount of time of an event in which the second entity was involved, storing information in non-volatile storage media indicative of an existence of an implied relationship between the first entity and the second entity, wherein storing the information indicative of the existence of the implied relationship comprises: creating, in a graph, a first edge connecting a node for the first entity to a node for the second entity; marking the first edge as being implied rather than real; and modifying a weight of the first edge based at least in part on a specified value, wherein modifying the weight of the first edge based at least in part on the specified value comprises incrementing the weight based at least in part on a temporal distance between the first event and the second event; wherein the first entity is a first endpoint in a network; wherein the second entity is a second endpoint in the network; wherein the first event is a first transaction in which the first endpoint sent data to a third endpoint different from the first and second endpoints in the network; and wherein the second event is a second transaction in which a fourth endpoint different from the first, second, and third endpoints in the network sent data to the second endpoint, applying via the data processing device a convolution window as a matched filter to a series of signals representing extents of co-temporal activity by endpoints connected to a common node during different time slices in a series of time slices; and causing the data processing device to use results of the application of the convolution window to produce a filtered series of signals in which a signal-to-noise ratio has been increased relative to the series of signals prior to the application; and reporting to an output device that said implied relationship exists.