Patent Document ID: 9202052
Application ID: 14038514
Patent Status: 1

Claim One:
1. A method for identifying communities which have an anomaly, comprising: receiving machine generated event log data which includes one or more events occurring over a window of time, wherein each event includes one or more events having a first node, a second node, and a timestamp; aggregating the events into a plurality of aggregated graph snapshots; identifying one or more communities within the plurality of aggregated graph snapshots; determining one or more community tracking links between communities in the plurality of aggregated graph snapshots, including by determining a modified Jaccard coefficient ( A ⋂ B min ⁡ ( A , B ) ) , where A∩B, is the number of first node or second node in common between community A and community B and min(A, B) is the smaller of the size of community A and the size of community B; and using a processor to identify communities in the plurality of aggregated graph snapshot which are anomalous based on one or more of the following: a community level anomaly or an evolutionary path level anomaly.