Patent ID: 9038180
Filing Date: 2015-05-19
Classification: G06F,G06N,H04L

Abstract:
1. A computer-implemented method, comprising: analyzing, by a computing system, historical data of a frequency with which nodes create and receive new edges in a computer network; establishing, by the computing system, baseline models of behavior among the edges in the computer network based on the analysis of the historical data; detecting, by the computing system, a new edge whose appearance is deemed rare, according to a baseline statistical model, such that a probability of observing the new edge is lower than a predetermined threshold during a time window t; and flagging the new edge, by the computing system, as potentially anomalous when the deviation from the respective baseline model is detected, wherein for a given source node x initiating the new edge to destination node y, a probability model of x initiating the new edge in the given time window is given by where P