Patent Publication Number: US-2022229903-A1

Title: Feature extraction and time series anomaly detection over dynamic graphs

Description:
BACKGROUND 
     A graph is a data structure wherein vertices (also called nodes or points) are interconnected by pairs known as edges (also called links, lines, or arrows). The pairs can be unordered or ordered (i.e., directional). The edges define relationships between vertices, for example showing how data changes over time. Graphs often include connected components, which are subgraphs in which any two or more vertices are connected to each other by edges and are connected to no additional vertices in the rest of the graph. 
     Graphs are common data structures which can be used across many real-world applications, such as social networks, connections between users of a product, navigation through streets (e.g., using map applications), pandemic spread in a population, etc. In all these use cases, the graphs will change over time and can be considered as dynamic graphs. Connected components can appear, change, and disappear within dynamic graphs over time, sometimes indicating anomalous behavior within the system being represented by the graph. It would be very useful to be able to leverage time series data expressed by the dynamic graphs to detect anomalies (e.g., exponential growth of a specific area could indicate emerging fraudulent activity, anomalous traffic congestion, disease outbreak areas, etc.). One challenge is that time series anomaly detection algorithms generally cannot take a graph as input, as these algorithms process numerical time series data. 
    
    
     
       BRIEF DESCRIPTIONS OF THE DRAWINGS 
         FIG. 1  shows an example feature extraction and time series anomaly detection system according to some embodiments of the disclosure. 
         FIGS. 2A-2B  show example graph evolutions according to some embodiments of the disclosure. 
         FIGS. 3A-3B  show an example feature extraction and time series anomaly detection process according to some embodiments of the disclosure. 
         FIG. 4  shows an example tree building process according to some embodiments of the disclosure. 
         FIGS. 5A-5C  show an example graph evolution according to some embodiments of the disclosure. 
         FIG. 6  shows an example chart of graph evolution according to some embodiments of the disclosure. 
         FIG. 7  shows an example matrix according to some embodiments of the disclosure. 
         FIG. 8  shows an example component tracking process according to some embodiments of the disclosure. 
         FIG. 9  shows an example vector creation process according to some embodiments of the disclosure. 
         FIG. 10  shows an example time series analysis and output process according to some embodiments of the disclosure. 
         FIG. 11  shows a computing device according to some embodiments of the disclosure. 
     
    
    
     DETAILED DESCRIPTION OF SEVERAL EMBODIMENTS 
     Embodiments described herein can build a dynamic graph, create a data structure to map connected components of the dynamic graph between time frames, and track the changes in the connected components over time (e.g., through merges, growth in size, formation of new connected components, etc.). The entire process can be done incrementally (e.g., only adding the new nodes and edges created in every time frame) in order to omit the need to build a full-scale graph at every time frame. The latest graph is saved at every time frame, along with a compact representation describing the changes in the connected components over time. Then, this data is used to generate a time series data set that can be input to time series anomaly detection algorithms, allowing these algorithms to effectively process the data from the dynamic graph. 
     The disclosed embodiments provide highly efficient processing of very large-scale data sets. For example, in a dynamic graph, nodes can be added and new connections between existing nodes can be formed over time. This can create a situation where two connected components are merged at a specific time frame. Therefore, there is no one-to-one mapping between the indices of the connected components over time. However, creating a graph for every time frame over and over again (meaning at day 10, ten graphs need to be created or saved and loaded from memory) is not computationally feasible when dealing with large scale graphs. In contrast, the incremental approach described herein is much more computationally efficient. By constructing a graph from tabular data and then calculating the connected components within the graph, the incremental approach can provide an explanation of the change in connected components over time from a single graph, that of a most recent time frame, rather than requiring every graph from time t=1 to time t=1+(present time). 
     The disclosed embodiments also enable graph data to be processed using time series algorithms. Conversion of dynamic graph data to time series data using the disclosed approaches involves generating an entirely new data set (time series data) from a source data set (dynamic graph data), effectively translating the source data set into a form that can be used by a system that requires inputs in a different format altogether. Specifically, time-series anomaly detection can be performed based on dynamic graph data, allowing automatic anomaly detection to be applied to find problems in a much broader set of systems than ever before. 
       FIG. 1  shows an example feature extraction and time series anomaly detection system  100  according to some embodiments of the disclosure. System  100  may include a variety of hardware, firmware, and/or software components that interact with one another and with data sources and/or monitored systems  10 . For example, system  100  includes connected component processing  110 , tree building processing  120 , path extraction processing  130 , vector conversion processing  140 , and time series analysis processing  150 , each of which may be implemented by one or more computers (e.g., as described below with respect to  FIG. 11 ). As described in detail below, connected component processing  110  receives graph data (e.g., from a system being monitored  10 , such as a computing network or population) and identify connected components therein. Once connected components are identified, tree building processing  120  can construct a tree including changes over time, path extraction processing  130  can extract relationships among the changes over time, and vector conversion processing  140  can turn the results into numeric vectors. Time series analysis processing  150  can use the numeric vectors as inputs to time series analysis algorithm(s) and, as a result, report on the status of monitored system  10  and/or control monitored system  10 .  FIGS. 2A-10  illustrate the functioning of system  100  in detail. 
     Data source/monitored system  10 , system  100 , and individual elements of system  100  (connected component processing  110 , tree building processing  120 , path extraction processing  130 , vector conversion processing  140 , and time series analysis processing  150 ) are each depicted as single blocks for ease of illustration, but those of ordinary skill in the art will appreciate that these may be embodied in different forms for different implementations. For example, system  100  may be provided by a single device or plural devices, and/or any or all of its components may be distributed across multiple devices. In another example, while connected component processing  110 , tree building processing  120 , path extraction processing  130 , vector conversion processing  140 , and time series analysis processing  150  are depicted separately, any combination of these elements may be part of a combined hardware, firmware, and/or software element. Moreover, while one data source/monitored system  10  is shown, in practice, the data source and the monitored system may be separate from one another and/or there may be multiple data sources, multiple monitored systems, or both. 
       FIGS. 2A-2B  show example graph evolutions according to some embodiments of the disclosure. These example graph evolutions are presented to describe the general concepts surrounding the evolution of a dynamic graph over time. Subsequent figures show how system  100  performs processing on dynamic graphs in view of the features shown in  FIGS. 2A-2B . 
       FIG. 2A  shows an example wherein a graph at time t−1  210  precedes a graph at time t  220 . In this basic example, the graph at time t−1  210  has five connected components, and the graph at time t  220  has five connected components. However, the connected components are not the same. Between time t−1 and time t, two of the old connected components merged into one, and an entirely new connected component emerged. 
       FIG. 2B  provides specific examples of how connected components can change over time. In a growth example  230 , a connected component changes from time t−1 to time t by adding a node (i.e., growing in size). In a merge example  240 , two connected components existing at time t−1 merge before time t, resulting in a new connected component at time t that is a combination of the nodes of the previous two connected components. In a new component example  250 , an entirely new connected component appears between time t−1 and time t. 
       FIGS. 3A-3B  show an example feature extraction and time series anomaly detection process  300  according to some embodiments of the disclosure. In view of the connected component behaviors in graph data sets, such as those illustrated above, system  100  can perform process  300  to create time-series data from graphs and use the time-series data to perform anomaly detection for the systems represented by the graphs. 
     At  302 , system  100  receives data from data source/monitored system  10 . In some embodiments, the data can include a plurality of graph snapshots for a plurality of consecutive periodic time samples. System  100  calculates connected components from the graph snapshots. For example, the graph snapshots can be for a plurality of time frames, and system  100  can receive these snapshots all at once or separately as time elapses. The graph snapshots include graphs at specific time frames having vertices and edges, and system  100  can map between connected components in consecutive graph snapshots. The graph snapshots can include data describing at least one feature of each connected component (e.g., at least one value or other data point for each vertex and/or edge). For example, as seen in  FIG. 3B  in particular, a vertex of a graph can have an ID, a timestamp, and an attribute value. The attributes can be anything that can be represented in a graph (e.g., descriptions of a node of a network, identifying information for a person infected with a communicable disease, etc.). 
     In some embodiments, the data received at  302  can be in tabular form (e.g., with columns of ID, timestamp, and attribute value and rows for specific entries as in the example of  FIG. 3B , or any other table in other embodiments). In this case, system  100  can apply any known or proprietary connection graph generation algorithm to generate the graph snapshots. 
     At  304 , system  100  builds a tree from the graph data obtained at  302 . Given a set of periodic (e.g., daily) snapshots of a graph with connected components, system  100  may have data describing mapping between connected component IDs in consecutive snapshots, including indications of merges between different connected components (note that each connected component at time t can be a merge between several components from time t−1, remain the same size, or grow without a merge). System  100  may also have data describing additional features or attributes regarding each component (e.g., size, fraud ratio, average degree, number of edges, etc.). From these snapshots, system  100  can recursively build a tree tracking an evolution of one of the connected components through the plurality of graph snapshots, the tree including a root node representing the connected component at a final one of the consecutive periodic time samples and a plurality of leaf nodes branching from the root node. 
       FIG. 4  shows an example of processing performed at  304  according to some embodiments of the disclosure in detail.  FIGS. 5A-5C  illustrate an example graph evolution  500 ,  FIG. 6  shows an example chart of graph evolution  600 , and  FIG. 7  shows an example matrix, according to some embodiments of the disclosure. The processing performed at  304  and  306  is explained as follows with reference to the processing illustrated in  FIG. 4  and the examples of  FIGS. 5A-7 . 
     At  402 , system  100  can calculate connected components for a given time t. For example, this begins at t=0 in matrix Mo. The matrix can have dimensions (1, number of connected components at t=0). As noted above, connected components are made up of connected nodes each having their own attributes. This is shown, for example, in  FIG. 5A , which is a graph  500  at time t=0. This example graph has four connected components—red  502  with three nodes, blue  504  with  21  nodes, green  506  with six nodes, and orange  508  with three nodes. System  100  identifies these connected components from the graph data obtained at  302 . 
     At  404 , system  100  can add nodes and attributes to an auxiliary dictionary. The auxiliary dictionary is stored in a memory accessible to or part of system  100  and contains the set of nodes which belong to each connected component as well as any attributes or features being tracked (e.g., average degree, number of edges etc.). This data structure is bound in size by O (number of nodes) because the connected components are disjoint and can be created during the connected component calculation process (i.e., there may be as many connected components as nodes, at maximum). The auxiliary dictionary includes data describing, for each connected component, a set of nodes belonging to the connected component and the tracked feature(s) of the connected component. As described in further detail below, data describing the evolution of the tracked feature(s) of connected component through time is later constructed from the data in the auxiliary dictionary. 
     In the case where the time t is the first time being processed by system  100  for the monitored system  10 , processing at this point may proceed to  306  as described below, with a newly-instantiated auxiliary dictionary. Otherwise, at  406 , system  100  can proceed with update processing by creating a matrix M t . In some embodiments, this matrix has the following dimensions: ((number of connected components at time frame t−1)+1, number of connected components at time frame t). 
     At  408 , system  100  can add connected component intersections. In some embodiments, for every cell M t (i,j), system  100  fills in the intersection between the sets of connected component i at time t−1 and connected component j at time t using the auxiliary dictionaries for time t−1 and time t. This is computationally efficient, as i and j are keys in the dictionaries. M t (i,j) contains the attributes of the connected component i from time t−1 (from the dictionary) and the size of the intersection. 
     At  410 , system  100  can add node originations. In some embodiments, for each connected component j at time frame t, system  100  saves (size of connected component j−sum(M t [:,j])) in M t [−1,j]. This denotes the number of nodes which are part of j and not part of any connected component at time frame t−1. 
     An example of what can be identified by this processing can be seen by continuing the example of  FIGS. 5A-5C . Specifically,  FIG. 5B  shows graph  500  at time t=1, and  FIG. 5A  shows graph  500  at time t=0. In terms of the processing done at time t=1, the graph of  FIG. 5B  is the set of connected components at time t, and the graph of  FIG. 5A  is the set of connected components at time t−1. At time t (t=1), red  502  and blue  504  have merged into blue-red  510  with 24 nodes, green  506  has added one node, orange  508  remains unchanged, and purple  512 , with three nodes, has appeared. This information is stored in the auxiliary dictionary after processing at  410 . 
     An example matrix  700  that can serve as an auxiliary dictionary is illustrated in  FIG. 7 . As shown in  FIG. 7 , each column contains connected components at time t, and each row contains connected components at time t−1 and/or new components not present at t−1 but that appeared by t. Thus, each intersection indicates an intersection size between connected components at the two times. 
     At  412 , system  100  can delete auxiliary dictionary t−1, leaving the current auxiliary dictionary for time t which, as described above, encodes the changes in the connected components over time. 
     Returning to  FIGS. 3A-3B , at  306 , system  100  can track connected component evolution over time.  FIG. 8  shows an example component tracking process performed at  306  according to some embodiments of the disclosure. 
     At  802 , system  100  can accumulate matrices over time. For some embodiments, this may be a set of matrices for a time period of interest. For example, system  100  can accumulate the matrices M 0 , . . . , M t . This allows system  100  to easily track the changes in attributes for each of the connected components from time  0  until time t. Due to the processing performed as described above to build each matrix, no other data may be required in order to track the changes in attributes. 
     At  804 , system  100  can check matrix column cells for component sources. As the matrices encode relationships between cells over time, system  100  needs only to check the matrices to determine connected component histories. For example, to track connected component k from time t over time until time  0 , system  100  can proceed as follows. For each connected component i at time t, check column i in matrix M t  and locate all the non-zero cells in this column (including the last row). Non-zero cells are denoted as “sources” of the connected component at time t−1. For example, if row j (M t [j,i]) is non-zero, this means that connected component j from time t−1 is one of the sources of connected component i from time t. If the last row is non-zero, it means that there are nodes in connected component i which are new and therefore sourceless. 
     At  806 , system  100  can recursively repeat checking matrix column cells for component sources until t=0 or all sources are checked. In other words, the processing at  804  can be performed between any two consecutive time frames until time  0  or until there are no sources (the sum of the column excluding the last row is 0). 
     To visualize the recursive repetition of the aforementioned processing, the example of  FIGS. 5A-5C  is further extended.  FIG. 5C  shows graph  500  at time t=2,  FIG. 5B  shows graph  500  at time t=1, and  FIG. 5A  shows graph  500  at time t=0. As discussed above, in terms of the processing done at time t=1, the graph of  FIG. 5B  is the set of connected components at time t, and the graph of  FIG. 5A  is the set of connected components at time t−1. After another recursion, in terms of the processing done at time t=2, the graph of  FIG. 5C  is the set of connected components at time t, and the graph of  FIG. 5B  is the set of connected components at time t−1. At time t (t=2), green  506  and blue-red  510  are unchanged, while orange  508  and purple  512  have merged into orange-purple with six nodes. These changes over time are tracked by system  100  by processing at  306  over time using only the matrices. 
       FIG. 6  reframes the graph  500  of  FIGS. 5A-5C  into a chart  600 , visually illustrating the changes to the connected components over time. As seen in the chart, components appear after an earliest time in some cases (e.g., purple, with 0 nodes at time t=0), grow in some cases, and merge (e.g., where lines overlap such as blue-red and orange-purple). This is a visual representation useful to a human to understand monitored system  10 . However, this representation is not useful for time series analysis. In contrast, the above processing performed by system  100  encodes all of the same information in chart  600  (including, in some cases, further information). The information is encoded efficiently compared with maintaining full sets of graphs  500 . Moreover, the information is ready for further processing, described below, to prepare it for use in time series algorithms (e.g., for anomaly detection). 
     Returning to  FIGS. 3A-3B , at  308 , system  100  can extract paths from the accumulated matrices and convert the paths to numerical vectors.  FIG. 9  shows an example vector creation process performed at  308  according to some embodiments of the disclosure. 
     At  902 , system  100  can recursively build a tree from the data generated at  306 . In some embodiments, recursively building a tree starts with system  100  associating one or more features from t−1 in the matrix for time t with a root node of the tree being built. System  100  can then identify all connected components from t−1 that were merged to create the root node from the outcome of processing at  306 . Then, for each of the identified connected components, system  100  creates a tree node and attaches the tree node to the root node as a child. System  100  recursively performs the associating, identifying, and creating steps until the first time (t=0) is reached or all identified connected components for the path are of size 0. 
     This process identifies all connected components from the previous time frame which were merged to create the connected component. For each one of the connected components from the previous time, system  100  creates a tree node and attach it to the root as a child (including the features). System  100  recursively expands the root&#39;s children (going back one time frame in each step) until one of two things occur—the first time frame (time=0) is reached, or the connected component is of size 0 (different connected components can be created at different times). The final product of this process is a tree, where every level represents a time frame. The root represents the connected component in its final state, and tracking all the paths from the root shows how it was created over the course of time. 
     At  904 , system  100  can extract paths from the tree created at  902 , where a path is a traversal of the tree from the root to one of the leaves. System  100  extracts paths by traversing the tree from the root node to one of the leaf nodes and generating the path such that the path contains data describing an evolution of a connected component through time as indicated by evolution of one or more features of the connected component. For example, this can be accomplished by system  100  executing a depth first search (DFS) algorithm or similar algorithm on the tree. A DFS algorithm will extract all the different paths in the tree. 
     At  906 , system  100  can add features regarding the tree structure to the extracted paths from  904 . For example, system  100  can add data to each path indicating whether there was a merge event, whether a component emerged at a given time, whether the component grew and by what degree, etc. 
     At  908 , system  100  can create and output vectors of the paths extracted at  904  and enriched at  906 . System  100  can convert each of the plurality of paths into a respective numerical vector of a plurality of numerical vectors representing the total set of paths for the tree. Each path creates a numerical vector tracking the change over time of a single connected component. These features include attributes of the connected component and attributes of the tree, which were obtained as described above. For example, each of the respective numerical vectors includes the features of the connected component to which it pertains and data describing each node in the path and how the nodes are interconnected. These vectors can be used for time-series processing as described in the following examples. 
     Returning to  FIGS. 3A-3B , at  310 , system  100  can perform time series analysis on the numerical vectors obtained at  308 .  FIG. 10  shows an example time series analysis and output process performed at  310  according to some embodiments of the disclosure. 
     At  1002 , system  100  can provide the plurality of numerical vectors from  308  as inputs to a time series processing algorithm, such as an anomaly detection algorithm. While the following example presumes system  100  executes the time-series anomaly detection algorithm, in other embodiments, system  100  may output the plurality of numerical vectors to another processor or computer for processing. The data generated at  308  is in suitable condition for time-series processing by system  100  internally or externally by another system. 
     At  1004 , system  100  can perform time-series analysis processing, for example by executing the time-series anomaly detection algorithm. The time-series algorithm, whether used for anomaly detection or to perform other analysis, can be a supervised or unsupervised machine learning algorithm. Example anomaly detection algorithms include, but are not limited to, autoregressive integrated moving average (ARIMA), vector autoregressive moving average model with exogenous variables (VARMAX), and long short-term memory (LSTM). In some embodiments, system  100  can feed a large data set into the algorithm to train the algorithm and, subsequently, use the algorithm on future time snapshots processed as described above to detect anomalies based on deviations from the normal behavior as understood by the trained model in ways that are understood by those of ordinary skill in the art. In other embodiments, the model may already be trained, and system  100  can execute the time series anomaly detection algorithm on the plurality of numerical vectors to detect at least one security anomaly or other anomaly in the monitored system  10 . In any case, and for any algorithm chosen, the fact that graph data has been converted to numerical vectors makes the processing at  1004  possible. 
     At  1006 , system  100  can provide feedback and/or directly control monitored system  10  according to the outcome of time-series analysis processing at  1004 . For example, if one or more anomalies are detected at  1004 , system  100  can alert a user to a potential fraud or other issue, shut down or block access to monitored system  10  to prevent an attack or other failure, cause a setting of monitored system  10  to be adjusted to attempt to revert its behavior to a normal state, etc. 
       FIG. 11  shows a computing device  1100  according to some embodiments of the disclosure. For example, computing device  1100  may function as system  100  or any portion(s) thereof, or multiple computing devices  1100  may function as system  100 . 
     Computing device  1100  may be implemented on any electronic device that runs software applications derived from compiled instructions, including without limitation personal computers, servers, smart phones, media players, electronic tablets, game consoles, email devices, etc. In some implementations, computing device  1100  may include one or more processors  1102 , one or more input devices  1104 , one or more display devices  1106 , one or more network interfaces  1108 , and one or more computer-readable mediums  1110 . Each of these components may be coupled by bus  1112 , and in some embodiments, these components may be distributed among multiple physical locations and coupled by a network. 
     Display device  1106  may be any known display technology, including but not limited to display devices using Liquid Crystal Display (LCD) or Light Emitting Diode (LED) technology. Processor(s)  1102  may use any known processor technology, including but not limited to graphics processors and multi-core processors. Input device  1104  may be any known input device technology, including but not limited to a keyboard (including a virtual keyboard), mouse, track ball, and touch-sensitive pad or display. Bus  1112  may be any known internal or external bus technology, including but not limited to ISA, EISA, PCI, PCI Express, NuBus, USB, Serial ATA or FireWire. In some embodiments, some or all devices shown as coupled by bus  1112  may not be coupled to one another by a physical bus, but by a network connection, for example. Computer-readable medium  1110  may be any medium that participates in providing instructions to processor(s)  1102  for execution, including without limitation, non-volatile storage media (e.g., optical disks, magnetic disks, flash drives, etc.), or volatile media (e.g., SDRAM, ROM, etc.). 
     Computer-readable medium  1110  may include various instructions  1114  for implementing an operating system (e.g., Mac OS®, Windows®, Linux). The operating system may be multi-user, multiprocessing, multitasking, multithreading, real-time, and the like. The operating system may perform basic tasks, including but not limited to: recognizing input from input device  1104 ; sending output to display device  1106 ; keeping track of files and directories on computer-readable medium  1110 ; controlling peripheral devices (e.g., disk drives, printers, etc.) which can be controlled directly or through an I/O controller; and managing traffic on bus  1112 . Network communications instructions  1116  may establish and maintain network connections (e.g., software for implementing communication protocols, such as TCP/IP, HTTP, Ethernet, telephony, etc.). 
     Feature extraction instructions  1118  may enable computing device  1100  to perform one or more of connected component processing  110 , tree building processing  120 , path extraction processing  130 , vector conversion processing  140 , or any portion or combination thereof. Time series analysis instructions  1120  may enable computing device  1100  to perform time series analysis processing  150  and/or control or otherwise affect monitored system  10  in accordance with the results of time series analysis processing  150 . Application(s)  1122  may be an application that uses or implements the processes described herein and/or other processes. In some embodiments, the various processes may also be implemented in operating system  1114 . 
     The described features may be implemented in one or more computer programs that may be executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and to transmit data and instructions to, a data storage system, at least one input device, and at least one output device. A computer program is a set of instructions that can be used, directly or indirectly, in a computer to perform a certain activity or bring about a certain result. A computer program may be written in any form of programming language (e.g., Objective-C, Java), including compiled or interpreted languages, and it may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. 
     Suitable processors for the execution of a program of instructions may include, by way of example, both general and special purpose microprocessors, and the sole processor or one of multiple processors or cores, of any kind of computer. Generally, a processor may receive instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer may include a processor for executing instructions and one or more memories for storing instructions and data. Generally, a computer may also include, or be operatively coupled to communicate with, one or more mass storage devices for storing data files; such devices include magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and optical disks. Storage devices suitable for tangibly embodying computer program instructions and data may include all forms of non-volatile memory, including by way of example semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory may be supplemented by, or incorporated in, ASICs (application-specific integrated circuits). 
     To provide for interaction with a user, the features may be implemented on a computer having a display device such as an LED or LCD monitor for displaying information to the user and a keyboard and a pointing device such as a mouse or a trackball by which the user can provide input to the computer. 
     The features may be implemented in a computer system that includes a back-end component, such as a data server, or that includes a middleware component, such as an application server or an Internet server, or that includes a front-end component, such as a client computer having a graphical user interface or an Internet browser, or any combination thereof. The components of the system may be connected by any form or medium of digital data communication such as a communication network. Examples of communication networks include, e.g., a telephone network, a LAN, a WAN, and the computers and networks forming the Internet. 
     The computer system may include clients and servers. A client and server may generally be remote from each other and may typically interact through a network. The relationship of client and server may arise by virtue of computer programs running on the respective computers and having a client-server relationship to each other. 
     One or more features or steps of the disclosed embodiments may be implemented using an API and/or SDK, in addition to those functions specifically described above as being implemented using an API and/or SDK. An API may define one or more parameters that are passed between a calling application and other software code (e.g., an operating system, library routine, function) that provides a service, that provides data, or that performs an operation or a computation. SDKs can include APIs (or multiple APIs), integrated development environments (IDEs), documentation, libraries, code samples, and other utilities. 
     The API and/or SDK may be implemented as one or more calls in program code that send or receive one or more parameters through a parameter list or other structure based on a call convention defined in an API and/or SDK specification document. A parameter may be a constant, a key, a data structure, an object, an object class, a variable, a data type, a pointer, an array, a list, or another call. API and/or SDK calls and parameters may be implemented in any programming language. The programming language may define the vocabulary and calling convention that a programmer will employ to access functions supporting the API and/or SDK. 
     In some implementations, an API and/or SDK call may report to an application the capabilities of a device running the application, such as input capability, output capability, processing capability, power capability, communications capability, etc. 
     While various embodiments have been described above, it should be understood that they have been presented by way of example and not limitation. It will be apparent to persons skilled in the relevant art(s) that various changes in form and detail can be made therein without departing from the spirit and scope. In fact, after reading the above description, it will be apparent to one skilled in the relevant art(s) how to implement alternative embodiments. For example, other steps may be provided, or steps may be eliminated, from the described flows, and other components may be added to, or removed from, the described systems. Accordingly, other implementations are within the scope of the following claims. 
     In addition, it should be understood that any figures which highlight the functionality and advantages are presented for example purposes only. The disclosed methodology and system are each sufficiently flexible and configurable such that they may be utilized in ways other than that shown. 
     Although the term “at least one” may often be used in the specification, claims and drawings, the terms “a”, “an”, “the”, “said”, etc. also signify “at least one” or “the at least one” in the specification, claims and drawings. 
     Finally, it is the applicant&#39;s intent that only claims that include the express language “means for” or “step for” be interpreted under 35 U.S.C. 112(f). Claims that do not expressly include the phrase “means for” or “step for” are not to be interpreted under 35 U.S.C. 112(f).