Patent Document ID: 9189623
Application ID: 13956091
Patent Flag: 1

Claim One:
1. A method for detecting an anomaly, comprising: running, on a first production segment included in a massively parallel processing (MPP) system, a first anomaly detection process, including: generating a first bipartite graph based on first log data, wherein the first bipartite graph includes one or more first source vertices and one or more first destination vertices; generating, for a first source vertex of the one or more first source vertices where the first source vertex is associated with the first production segment, a first temporal behavioral matrix using the first bipartite graph, wherein: a first dimension of the first temporal behavioral matrix is associated with time; a second dimension of the first temporal behavioral matrix is associated with at least one of the one or more first destination vertices; and the first production segment exclusively generates the first log data which includes first source vertex log data, such that the first source vertex log data is confined to the first production segment in the MPP system; and generating, for the first source vertex, a first model using at least some portion of the first temporal behavioral matrix; and running, on a second production segment included in the MPP system, a second anomaly detection process, including: generating a second bipartite graph based on second log data, wherein the second bipartite graph includes one or more second source vertices and one or more second destination vertices; generating, for a second source vertex of the one or more second source vertices, the second source vertex being associated with the second production segment, a second temporal behavioral matrix using the second bipartite graph, wherein: a first dimension of the second temporal behavioral matrix is associated with time; a second dimension of the second temporal behavioral matrix is associated with at least one of the one or more second destination vertices; and the second production segment exclusively generates the second log data which includes second source vertex log data, such that the second source vertex log data for the second source vertex is confined to the second production segment in the MPP system; and generating, for the second source vertex, a second model using at least some portion of the second temporal behavioral matrix.