Detecting anomalous network activity

Abstract

Systems and methods for (generalized) random dot product graph (RDPG)-based time-domain link prediction, and applications of such time-domain link prediction to network anomaly detection, are disclosed. In various embodiments, starting from a time series of adjacency matrices characterizing the evolution of a network, spectral embeddings and time series models are used to predict estimated link probabilities for future time points, and the predicted link probabilities are compared to observed links to identify anomalous behavior. In some embodiments, element-wise independent models are used in the prediction to account for network dynamics at the granularity of individual nodes or edges.

Description

Background Technology

[0001] Link prediction is defined as the task of predicting the existence of an edge between two nodes in a network based on the latent properties of edges and nodes. The problem of link prediction has been extensively studied in the literature and has relevant applications in various fields. The ability to accurately predict anomaly scores and correlate these scores with connections in, for example, computer or telecommunications networks is useful in network defense for enterprises and other organizations. In a network environment, adversaries may alter the network structure during their attacks. Therefore, predicting links to identify significant deviations from expected behavior can lead to the detection of breaches that are otherwise highly destructive to the enterprise. Specifically, such deviations may include new links representing previously unobserved connections, which are often associated with malicious activity.

[0002] Computer networks within an organization are often very large and exhibit complex time-dependent characteristics, thus requiring computationally efficient methods to detect and evaluate anomalous network behavior. Attached Figure Description

[0003] Figure 1 This is an overview diagram of an enterprise network within a communications ecosystem according to one or more disclosed embodiments.

[0004] Figure 2 This is a flowchart of an anomaly detection process in a communication network according to one or more disclosed embodiments.

[0005] Figure 3 This is a flowchart of a link prediction process based on the average value of an edge over a time series adjacency matrix, according to one or more disclosed embodiments.

[0006] Figure 4 This is a flowchart of a link prediction process based on the average value of an edge over a time series of link score matrices, according to one or more disclosed embodiments.

[0007] Figure 5 It is a flowchart of a link prediction process based on the average value of the spectral embedding calculated from the time series of the adjacency matrix, according to one or more disclosed embodiments.

[0008] Figure 6 This is a flowchart of a link prediction process based on the COSIE model according to one or more disclosed embodiments.

[0009] Figures 7A-7D This is a graph illustrating example results of various link prediction processes based on simulated seasonal data according to the disclosed embodiments.

[0010] Figure 8This is a block diagram of an example machine that can execute any one or more of the processes discussed in this article. Detailed Implementation

[0011] This disclosure provides various processes for temporal link prediction based on random dot product graphs (RDPGs) or generalized random dot product graphs (GRDPGs) or related concepts, and describes the application of such temporal link prediction to network anomaly detection. While the disclosed embodiments for link prediction are generally applicable to networks of any kind of nodes and edges, regardless of what those nodes and edges represent, the various embodiments specifically relate to detecting anomalous network traffic in (e.g., enterprise) computer or other communication networks. To this end, communication data indicating network communications of network components within the enterprise network is collected. Network communications can occur between two devices within the enterprise network, or alternatively, between a device within the enterprise network and another external device. The term “network communications” is broadly understood herein to refer to any kind of message or packet sent between devices over a network, whether they convey artificially generated messages (e.g., emails), transmit user input (e.g., during a user’s login to the network), or are program-generated (e.g., API calls), etc. Communication data can be represented as a network graph, where nodes represent devices or network components involved in the communication, and edges represent communication between network components. In some embodiments, the network graph is a directed graph, where edges represent traffic between devices in one direction. Multiple network graphs are used to track the temporal behavior of a network, providing "snapshots" of network communication occurring over different time periods. In general, these multiple network graphs can also be viewed as "time-dependent network graphs." A time-dependent network graph represents a time series of recorded network activities involving network devices (e.g., computers), from which subsequent network activity can be predicted. Comparing predicted network activity with actually observed subsequent network activity allows for anomaly detection.

[0012] Link prediction according to the disclosed embodiments involves generating a time series of an adjacency matrix representing a time-dependent network graph during a first time period (which includes a time series of the first time interval), and calculating an estimated link probability for a connection in the network graph based on the time series of the adjacency matrix during a second time period (which may include one or more second time intervals). For any given pair of nodes, the link probability (also referred to herein as a “link score”) indicates the probability that the two nodes are connected (e.g., for a given pair of network devices, it represents the probability that the devices communicate during a specified time interval).

[0013] An adjacency matrix is ​​a binary matrix whose rows and columns correspond to nodes in a graph, with entries equal to 1 only when two associated nodes (i.e., one node corresponds to a row of a cell and the other to a column of a cell) are connected. The binary representation of network connections in adjacency matrix form can be converted into a probabilistic representation. For symmetric adjacency matrices representing undirected graphs, this representation can take the form of a GRDPG. In a GRDPG, nodes correspond to "latent positions" (as understood in the art) within a "latent vector space." Latent positions can be computed using a suitable spectral embedding of the adjacency matrix (e.g., adjacency spectral embedding (ASE) or Laplacian spectral embedding (LSE)). To embed a directed graph on the spectrum, each node can be represented by two latent positions corresponding to nodes that act as the source or destination of a network link (e.g., network devices acting as transmitters or receivers in network communications), which is equivalent to an extension of the GRDPG. The vectors in the latent space representing potential locations (computed by embedding the adjacency matrix on the spectrum) are also referred to separately as “spectral embedding vectors” in this paper, and collectively as the “spectral embedding” of the adjacency matrix (which is itself a matrix).

[0014] GRDPG (or its extension for directed graphs) allows, for example, the computation of link probabilities between pairs of nodes by measuring the mutual proximity of their potential locations using the inner product (also known as the "dot product") (or generalized inner product) of corresponding vectors in the latent vector space. In this way, a single binary adjacency matrix can be transformed into a non-binary probability "link score matrix." To predict link probabilities for a second time period (time interval within the first time period) based on the time series of the adjacency matrix representing network links during a first time period, a joint GRDPG for the second time period can be computed by somehow aggregating information from the time series of the adjacency matrix associated with the first time period. This aggregation can be implemented in various ways.

[0015] In one approach, the adjacency matrix associated with a first time interval is averaged (e.g., in a weighted manner). In the weighted average, weighting coefficients can be applied globally to the adjacency matrix or applied to individual matrix elements for edge-specific weighting. If the latter, the time series of the weighted matrix can be computed based on the time series of the adjacency matrix associated with the first time interval (e.g., using an autoregressive integrated moving average (ARIMA) model or a seasonal ARIMA (SARIMA) model). In either case, the average adjacency matrix computed based on the individual adjacency matrices associated with the first time interval is embedded spectrally to generate an estimated spectral embedding vector for each node, representing the potential location of that node during the second time interval. The estimated link probabilities associated with the second time interval can then be computed for pairs of nodes based on the associated spectral embedding vectors (e.g., by forming a (generalized) inner product). In summary, the estimated link probabilities form a link score matrix probabilistically representing the network graph during the second time interval.

[0016] In another approach, the adjacency matrix associated with a first time interval is first processed separately via spectral embedding, and then the inner product (or otherwise scored) of paired spectral embedding vectors is computed to calculate a separate link score matrix for each time interval within the first time interval. The link score matrices associated with the first time interval are then averaged (e.g., in a weighted manner). In the weighted average, weighting coefficients can be applied globally to the link score matrix or to individual matrix elements for edge-specific weighting. If the latter, the time series of the weighted matrix can be computed (e.g., using an ARIMA or SARIMA model) based on the time series of the link score matrices associated with the first time interval. The averaged link score matrix represents the estimated link probabilities associated with paired nodes within the network graph.

[0017] In the third approach, the adjacency matrices associated with the first time interval are each individually embedded spectrally, resulting in a time series of spectral embeddings associated with the first time interval, each of which includes a spectral embedding vector (representing a potential location) for all nodes within the network. The spectral embedding vectors associated with any given node are then averaged over the time intervals, or otherwise processed, to compute the predicted spectral embedding vector associated with that node for the second time interval. Since spectral embeddings are unique only under (uncertain) orthogonal transformations, and thus their constituent spectral embedding vectors are not directly comparable between different embeddings associated with different time intervals, computing the predicted spectral embedding vectors typically involves first aligning the spectral embedding vectors between the embeddings. In some embodiments, alignment is achieved via a (generalized) Pluck transformation. After Pluck (or other) alignment, the predicted spectral embedding vector for a given node can be computed (e.g., by simply averaging or using an ARIMA or SARIMA model). Based on the predicted spectral embedding vectors, the estimated link probabilities can then be computed by forming an inner product or otherwise scoring the pairs of predicted embedding vectors.

[0018] Another approach employs a common subspace independent-edge (COSIE) network model. In a COSIE network, it is assumed that potential locations are common across multiple snapshots of the network graph, but link probabilities are scaled using a time-varying weighted matrix (referred to in this paper as the “COSIE correction matrix”, or simply the “COSIE matrix”). Therefore, in this approach, the time series of the adjacency matrix associated with a first time period is processed to compute a joint spectral embedding representing the potential locations of network nodes, as well as a time series of the COSIE correction matrix. Based on the time series of the COSIE correction matrix for the first time period, a COSIE correction matrix for a second time period can be predicted. In some embodiments, each element of the predicted COSIE correction matrix is ​​based on an independent model of the corresponding element of the time series of the COSIE correction matrix; in this way, the edge-specific dynamics of the time-dependent network graph are considered. The predicted COSIE correction matrix for the second time period can then be left-multiplied and right-multiplied with the spectral embedding to compute a link score matrix of estimated link probabilities.

[0019] Regardless of the method used to calculate the link score matrix associated with the second time interval within the second time period, the estimated link probabilities of the link score matrix can be compared with the network links actually observed during the second time interval (as reflected in the adjacency matrix of the network captured during the second time interval) to detect anomalies. In some embodiments, this comparison is based on anomaly criteria, such as a specified probability threshold. For example, if the corresponding estimated link probability is below a certain threshold, a link in the observed network (represented by 1 in the adjacency matrix for the second time interval) can be considered an anomaly. Similarly, if the corresponding estimated link probability exceeds a certain threshold, the absence of a link in the observed network (represented by 0 in the adjacency matrix for the second time interval) can be considered an anomalous interruption. Instead of comparing scores at the link level, nodes can be scored, with scores aggregated for each node on its incoming and outgoing links, and the aggregated node scores compared with a specified threshold.

[0020] In some embodiments, the second time interval occurs after the time series of the first time interval, and the estimated link probability is predicted based on the time series of the first time interval. Therefore, the comparison can be made between predictions based on historical profiles of network activity and actual network activity observed (e.g., during the current or most recent time interval). However, in principle, it is also possible for the second time interval to occur before the first time interval, allowing for the detection of past anomalies based on a time-backward "prediction." Furthermore, in some embodiments, predictions are made for multiple second time intervals within the second time period by varying the time length to extrapolate beyond the first time period (e.g., using different weighting factors in calculations for different second time intervals). Typically, network behavior predicted based on observations during the time series of the first time interval within the first time period is compared with network behavior observed during second time intervals outside the first time period; in other words, the second time interval typically does not overlap with the first time period on which the prediction is based.

[0021] Once anomalous network behavior has been detected, the nodes associated with the anomaly and the network components they represent can be identified. In some embodiments, a subset of nodes is represented in a subgraph and provided as output. For example, a subset of network devices within an enterprise network involved in anomalous communication can be displayed to the network administrator as a subgraph. Furthermore, certain risk mitigation measures can be taken to thwart network attacks. For example, some embodiments automate the modification of access control policies for one or more suspicious network components. Network components identified as suspicious may be subject to more restrictive network access policies than those not identified as suspicious, for example, by blocking them from communicating with devices outside the enterprise network or blocking them from all network communication with any device. Alternatively, less drastic mitigation measures may involve enhancing transaction or communication logging for subsequent analysis should the anomaly prove to be malicious. As another example, if anomalous behavior is found to be associated with a specific user account, leading to suspicion that the account may have been hacked, the user may be notified, the account suspended, or credentials revoked entirely. Note that anomalous network behavior is not necessarily caused by malicious activity. In the case of benign but anomalous network behavior, the response may also include, for example, allocating more computing resources to network components experiencing high traffic, stopping erroneous out-of-control operations, etc.

[0022] Compared to other link prediction methods, as described in this paper, the method using GRDPG-related approaches can provide more efficient predictions and a better understanding of the temporal evolution of networks. As a result, GRDPG-based methods allow for consideration of a larger volume of network data and / or more frequent temporal samples. Furthermore, independently applying edge-specific weights and / or otherwise modeling link probabilities for different pairs of nodes provides greater flexibility in capturing complex network dynamics. The computational efficiency of complex network dynamics and edge-specific modeling can, in turn, provide higher accuracy and reduced latency in anomaly detection.

[0023] The foregoing will be more readily understood from the following more detailed description of various embodiments, especially when taken in conjunction with the accompanying drawings.

[0024] Figure 1 This is a general overview of an enterprise network within a communications ecosystem 100 according to one or more disclosed embodiments. As shown, the enterprise network 101 includes multiple network components 102A-102F. Figure 1 Devices 104A-104C outside enterprise network 101 are also shown, but they are part of a larger communications ecosystem 100. Devices 102A-102F within enterprise network 101 and external devices 104A-104C outside enterprise network 101 can communicate with each other. Examples of this communication are shown in... Figure 1Arrows 106A-106G are shown in the diagram (not all arrows are labeled for clarity).

[0025] Access to corporate network 101 is controlled by firewall 108. Figure 1 A network security system 110 is also illustrated. The network security system 110 collects information about communications between network components 102A-102F and / or external devices 104A-104C, indicated by arrows 106A-106G. As will be discussed in more detail below, based on the information indicating the communications, the disclosed embodiments provide an improved method for detecting anomalous communications between network components 102A-102F and / or external devices 104A-104C. In some embodiments, the network security system 110 sends one or more control signals 112 to a firewall 118. The control signals 112 configure one or more network access policies for one or more devices among devices 102A-102G.

[0026] Figure 2 This is a flowchart of a process 200 for anomaly detection in a communication network according to one or more disclosed embodiments. For example, process 200 may be used to detect anomalous network activity on an enterprise network 101, which may include pairs of devices within the enterprise network 101 (e.g., Figure 1 Abnormal communication between any of devices 102A-102F, and between devices within the enterprise network 101 and devices outside the enterprise network (e.g., Figure 1 Abnormal communication between external devices 104a-104c. In some embodiments, one or more functions of process 200 are handled by hardware processing circuitry (e.g., reference...). Figure 8 The hardware processor (802) executes the process. In some embodiments, instructions (e.g., 824) stored in memory (e.g., 804, 806) configure the hardware processing circuitry (802) to perform one or more functions discussed below. One or more functions of process 200 may be performed by the above-described hardware processor (802). Figure 1 The security system 110 will be used for implementation.

[0027] Once process 200 begins at 210, network activity within the communication network is monitored in operation 220. The monitored activity specifically includes network communication between pairs of devices within the communication network. Conceptually, this communication can be represented as a time-dependent network graph, where nodes represent devices within the communication network (e.g., devices 102A-102F within enterprise network 101 and any external devices 104a-104c with which devices in enterprise network 101 communicate), and edges represent communication between pairs of devices.

[0028] In operation 230, multiple adjacency matrices corresponding to a time-dependent network graph are generated based on monitored network communications. The rows and columns of each adjacency matrix correspond to nodes (and thus devices within the communication network), and matrix entries indicate whether any two nodes are connected (corresponding to edges in the network graph). Each adjacency matrix is ​​generated based on network communications during a time interval specific to the corresponding adjacency matrix and represents a snapshot of the network graph during that time interval. For example, in some embodiments, each adjacency matrix represents network communications occurring within a 24-hour time interval. In other embodiments, each adjacency matrix represents communications occurring within 30 minutes, 1 hour, 2 hours, 5 hours, 12 hours, or any past time interval. Whenever communication occurs between two devices during one time interval in a series of time intervals, the entries in the associated rows and columns of the adjacency matrix representing the communication within that time interval can be set to 1. All matrix entries corresponding to pairs of devices that do not communicate with each other during that time interval can be set to 0. Thus, multiple adjacency matrices represent a time series of network activity within the enterprise network. In various embodiments, the time series includes an adjacency matrix for a series of first (e.g., past) time intervals and second (e.g., current) time intervals.

[0029] In operation 240, link scores corresponding to the pairwise probabilities of network communication between devices during the second time interval are estimated based on the time series of the adjacency matrix for the first time interval. Therefore, for example, network communication at the current time can be predicted based on network communication at past times (as reflected in the links between nodes in the network graph). See below for reference. Figures 3-6 This describes the various processes involved in predicting such links.

[0030] In operation 250, the estimated probability reflecting the likelihood of any two devices communicating during the second time interval is then compared with the actual observed network communication reflected in the adjacency matrix for the second time interval. The comparison is performed according to some criterion defining anomalous network behavior. For example, anomalous behavior could include network communication between two devices whose estimated probability of communication is very low (e.g., less than 1% or less than 0.1%), or the absence of communication between two devices whose estimated probability of communication is very high (e.g., 90% or 99%). More complex definitions of anomalous behavior involving groups of more than two devices are also possible. For example, if the estimated probability of communication between a group of devices is relatively low, then the network behavior of that group as a whole can be considered anomalous if more than a specified fraction of pairs of devices within that group communicate with each other.

[0031] In operation 260, a subset of nodes(s) associated with anomalous behavior is identified based on a comparison between estimated probabilities calculated according to adjacency matrices for a series of first time intervals and links in the network graph represented by adjacency matrices for second time intervals. When identifying anomalous nodes, the link scores associated with a given node corresponding to a single device can be aggregated across multiple links originating from or pointing to that node; in some embodiments, the aggregation of scores is done via Fisher scores. The aggregated score for each node is then compared to a threshold designated as an indication of anomalous network communication. Alternatively, the comparison can occur at the link level, and nodes associated with any link deemed anomalous based on the link-based comparison of link scores against the threshold inherit the anomalous classification.

[0032] In operation 270, the identified subset of nodes is used to determine the corresponding subset of network devices. In some embodiments, operation 270 generates a subgraph representing network communications occurring between the subsets of devices.

[0033] In operation 280, output indicating or based on the identified subset of devices is generated. This output may take the form of, for example, a written report, a visual display of a subgraph, or other human-readable output indicating the subset of devices involved in anomalous network activity, such as being displayed on a computer screen or other electronic display or transmitted via a message such as email or text. The network administrator may examine such output and take appropriate remedial action. Alternatively or additionally, operation 280 may include automated actions, such as remediating potential network threats or actions in response to benign anomalous network behavior. Remedial actions taken in response to anomalies indicating a network attack may include, for example, modifying one or more access control policies for devices included in the identified subset of devices. For example, in some embodiments, operation 280 configures one or more firewalls or other access control devices, for example, via commands or updates to a policy catalog, to isolate portions of the network by excluding or restricting network communication by any one or more devices in the anomalous subset of devices. Other remedial actions may include triggering enhanced monitoring and logging patterns that store more details about network communications for later analysis, and revoking user login credentials or suspending user accounts (and / or notifying the relevant users of the suspicion via separate channels, such as SMS messages to archived mobile device numbers) if anomalous activity is linked to one or more accounts that may have been compromised. In response to benign anomalies (such as unusually high levels of communication with a subset of network devices), appropriate responses may include adding computing resources to those devices or rerouting the communication, further analyzing the communication to detect and halt out-of-control operations, or logging data associated with the communication (e.g., search requests, downloaded documents, etc.) to facilitate later analysis of network usage patterns and / or the correlation between anomalous activity and certain events, etc. Other examples of outputs that may occur based on the identified subset of devices will be apparent to those skilled in the art. Following the output in operation 280, process 200 completes at 290.

[0034] In the disclosed embodiments, a GRDPG-based technique is used to perform link prediction in operation 240 for calculating the estimated probabilities of network communication. To introduce this mathematical framework, a sequence of network graphs is considered. This represents a snapshot of a dynamic network observed over a time interval ending at a discrete time point (t = 1, ..., T). Set V represents the set of nodes that does not change over time. On the other hand, set E... t Let E represent the time-dependent set of edges, where (i,j)∈E if i is connected to j at least once during the time interval (t-1,t]. t For i, j ∈ V, each snapshot of the graph can be represented by the adjacency matrix A. t∈{0,1} n×n Let A be the number of nodes in V, and let A be the number of nodes in V. If there is a link between nodes i and j in (t-1,t], then A is a definite link between them. ijt =1, otherwise A ijt =0. If A t If a graph is symmetric, then it is said to be undirected, thus reflecting that (i,j)∈E t This means (j,i)∈E t Otherwise, the graph is said to be directed. For the purposes of certain embodiments, assume A t It is hollow, meaning the graph has no self-edges. While the description below pertains to a graph for a single set of nodes V, the concepts and principles illustrated can be similarly applied to graphs composed of rectangular adjacency matrices. The bipartite graph represented by the two node sets V1 and V2. Where n1 and n2 are the number of nodes in V1 and V2, respectively, and if node i∈V1 in (t-1,t] is connected to j∈V2, then A ijt =1; Those skilled in the art will know how to apply the techniques described below to the more general case of bipartite graphs.

[0035] In RDPG, node i of the network graph is assigned a d-dimensional latent space. The corresponding potential position x in i , making x T x′∈[0,1] (Where T indicates transpose). Edges between pairs of nodes are generated independently, where they are connected via... The inner product <·,·> on the matrix yields the probability of a link between nodes i and j. In matrix representation, potential locations can be grouped into an n×d matrix. In this context, the expected value of a single adjacency matrix A can be expressed as... Therefore, RDPG allows the computation of probabilistic representations of network links based on the binary adjacency matrix A.

[0036] In GRDPG, a generalized version of the inner product is used to determine link probabilities based on the potential locations of nodes in an undirected graph. Let d + and d - Are non-negative integers such that d = d + +d - And set It is the potential space that makes 0≤x T I(d + ,d - x′≤1, where

[0037]

[0038] Furthermore, let F be... On the probability measurement, yes A is a set of n potential locations in the array, where A∈{0,1} n×n It is a symmetric matrix. If x1,…,x n If the set (A,X) is independently and identically distributed according to F and holds the following formula for i < j, then the set (A,X) forms a set with respect to F and d. + and d - GRDPG, i.e.

[0039]

[0040] For a given symmetric adjacency matrix A, a consistent estimate of the latent positions in the GRDPG can be obtained using appropriate spectral embedding techniques, such as adjacency spectral embedding (ASE) or Laplace spectral embedding. For the ASE of a symmetric adjacency matrix A, consider spectral decomposition.

[0041]

[0042] in It is a d×d diagonal matrix (d∈{1,...,n}) containing the first d eigenvalues ​​arranged in descending order of size. It is an n×d matrix containing the corresponding orthogonal eigenvectors, and the matrix... and It contains the remaining (nd) eigenvalues ​​and eigenvectors. A in yes:

[0043]

[0044] The operator |·| applied to a matrix returns the absolute value of its entries.

[0045] For LSE, consider the eigenvalues ​​of the Laplace matrix L = D. -1 / 2 AD -1 / 2 ,in And replace the adjacency matrix A in the spectral decomposition with the Laplace matrix L:

[0046]

[0047] Like ASE, LSE is given by the following formula:

[0048]

[0049] But of course, among them and The values ​​are different.

[0050] For directed graphs reflected in asymmetric adjacency matrices, the generative model can be assumed to be an inner product. x i , (This corresponds to the generalized inner product defined above, where d) + =d and d - (Special case of = 0). Directed adjacency spectral embedding (DASE) can be estimated using singular value decomposition (SVD). Given an adjacency matrix A ∈ {0, 1} n×n For a directed graph with positive integers d (1≤d≤n), consider singular value decomposition:

[0051]

[0052] in It is a diagonal matrix containing the first d singular values ​​arranged in descending order. and It contains corresponding left singular value vectors and right singular value vectors, and the matrix and It contains the remaining (nd) singular values ​​and vectors. A d-dimensional directed adjacency embedding of A is defined as a pair:

[0053]

[0054] Therefore, each node has two distinct potential locations to represent the behavior of a node acting as the source or destination of a link. Note that DASE can also be extended to bipartite graphs.

[0055] To date, various spectral embedding techniques have been described for estimating the potential locations of nodes in a network graph (whose (generalized) inner product provides link probabilities) based on individual adjacency matrices. A method is now described that adapts these techniques to estimating the link probabilities of a network graph at a specific time point based on a series of network graphs and corresponding adjacency matrices associated with other (e.g., previous) time points. The general idea is to somehow average or extrapolate the network dynamics captured in the time series of the adjacency matrices to predict the network link configuration at a specific time point.

[0056] In some embodiments, link prediction involves directly in the adjacency matrix (A1, A2, ..., A... T Average the time series data to obtain the adjacency matrix A at the next time point T+1. T+1Make predictions. In simple cases, a folded version of the adjacency matrix can be used. Take an average:

[0057]

[0058] Where ψ1, ..., ψ T Is it from A T The sequence of scalar weights associated with the backward sequence of the adjacency matrix to A1. For example, let... Folded version The arithmetic mean of the time series of adjacency matrices. Used as a folded adjacency matrix for estimation or prediction over T+1. It can then be embedded in the spectrum (e.g., using ASE, LSE, or DASE as described above) to compute the spectral embedding. Vector x inside i Correspondingly, this pertains to the potential location of the node. Based on the spectral embedding, the link score matrix containing the estimated link probabilities at time T+1 can be computed using the (generalized) inner product of the spectral embedding vectors. For example, for simplicity, assume d + =d and d - =0, the link score matrix is ​​given by the following formula:

[0059]

[0060] The limitation of this simple model for predicting link probabilities is the implicit assumption that the graphs are independently sampled from the same distribution without any temporal evolution of the network. This limitation can be mitigated by using a series of weights ψ1, ..., ψ2 that differ in value at different times, based on some assumptions about network dynamics. T This can be addressed by assigning greater weight to adjacency matrices closer to time T+1 (for predictions at time T+1) compared to adjacency matrices further back in time. Alternatively, as another example, if network behavior is expected to be periodic, the weights themselves can reflect that periodicity (e.g., such that for predictions of network behavior on weekends, behavior observed on previous weekends is given greater weight than behavior observed on previous weekdays).

[0061] The second limitation of the above model is that all possible edges of the adjacency matrix follow the order defined by parameters ψ1, ..., ψ2. T The implicit assumption is that the control operates on the same dynamics. This assumption is particularly limiting in many real-world applications where different behaviors may be associated with different nodes or links. According to some embodiments, to provide a more flexible framework for capturing edge-specific dynamics, scalar weights are composed of a series of weighting matrices. Instead, the matrix entries of these weighted matrices provide edge-specific weighting parameters. Using these weighted matrices, an extended folded matrix can be obtained. as follows:

[0062]

[0063] Where ⊙ represents the Hadamard element-wise product. The last (Tp) matrices Ψ... t A matrix set to zero This transforms into an autoregressive function of order p. The weighting matrix itself can (e.g., using an ARIMA or SARIMA model as further explained below) be based on the adjacency matrices A1, A2, ..., A T The time series data is used for computation. In some embodiments, for each pair of nodes, the corresponding time series of the matrix entries in the adjacency matrix is ​​modeled independently to obtain the corresponding time series of the weighted matrix entries. Alternatively, in joint or correlated models, the correlation between the temporal behaviors of different pairs of nodes can be considered.

[0064] Figure 3 The flowchart illustrates a process 300 for link prediction based on edge-specific averages over a time series adjacency matrix according to one or more embodiments. The starting point 310 of process 300 is an adjacency matrix associated with multiple first time intervals. (For example, generated based on monitored network communications) Figure 2 The time series of operation 230 is used. In operation 320, the weighting matrix is ​​calculated based on the time series of the adjacency matrix. The time series. In operation 330, these weighting matrices are used to calculate (e.g., according to...) A weighted average of multiple adjacency matrices. In operation 340, the average adjacency matrix is ​​calculated. (For example, using ASE, LSE, or DASE techniques as described above) it is embedded in the spectrum. In operation 350, according to From spectral embedding The link score matrix S is calculated, which includes estimated probabilities of links between nodes during the second time interval (e.g., reflecting network communication between pairs of devices). With the link score matrix determined, link prediction ends at 360 degrees. For example, this is achieved by comparing the estimated link probabilities with the adjacency matrix observed for that time interval and identifying nodes exhibiting anomalous behavior and their corresponding devices. Figure 2 Operations 250-280 in the code can then be used to perform anomaly detection using the predicted links.

[0065] In some embodiments, instead of in the adjacency matrix A1, A2, ..., AT The link prediction involves averaging at the beginning of the time series data. This process involves separately processing the adjacency matrix to obtain the corresponding individual GRDPG-based link score matrices S1, S2, ..., S... T The time series, the link score matrix is ​​based on From standard spectrum embedding The link score matrix is ​​calculated in (t=1,...T), and then predicted as S at time T+1. The prediction can be a simple average:

[0066]

[0067] Weighted average with scalar weights:

[0068]

[0069] Or a weighted average with a weighted matrix that allows for edge-specific weighting:

[0070]

[0071] The last (Tp) matrices Ψ t Setting the matrix to zero transforms S into a p-order autoregressive. The weighting matrix itself can be computed, for example, using an ARIMA or SARIMA model as further explained below, based on the time series of the (generalized) inner product of the spectral embedding vectors (or equivalently, the time series of the link score matrix). In some embodiments, for each pair of nodes, the associated time series of the (generalized) inner product of the corresponding vectors in the spectral embeddings are modeled independently to obtain the corresponding time series of the weighting matrix entries. Alternatively, the correlation between the temporal behaviors of different pairs of nodes can be considered in joint or cross-correlation models. Note that while the weighting matrix used when averaging the binary adjacency matrix is ​​computed based on the binary time series of those adjacency matrices, the weighting matrix used when averaging the real-valued link score matrix is ​​computed based on the real-valued time series.

[0072] Figure 4 The flowchart illustrates a process 400 for link prediction based on the average value of edges over a time series of link score matrices, according to one or more embodiments. The starting point 410 of process 400 is also an adjacency matrix associated with multiple first time intervals. (For example, generated based on monitored network communications) Figure 2 The time series of operation 230). In operation 420, the adjacency matrix... Each is processed individually (e.g., by ASE, LSE, or DASE as described above) to obtain the spectral embedding. The time series. In operation 430, the time series of the link score matrix is ​​based on... Calculated from the time series of spectral embeddings. In operation 440, the weighting matrix... The time series is calculated based on the time series of the link score matrix. In operation 450, these weighting matrices are used (e.g., based on...) The weighted average of the link score matrix is ​​calculated. The resulting average link score matrix S contains the estimated probabilities of links between nodes during the second time interval (e.g., reflecting network communication between pairs of devices). With these estimated link probabilities determined, link prediction ends at 460. For example, by comparing the estimated link probabilities with the adjacency matrix observed for that time interval and identifying nodes exhibiting anomalous behavior and their corresponding devices (…). Figure 2 Operations 250-280 in the code can then be used to perform anomaly detection using the predicted links.

[0073] In another approach, link prediction based on adjacency matrices for time series involves first embedding individual adjacency matrices A1, A2, ..., A on the spectrum. T To obtain spectral embedding time series, and then based on To calculate the average or otherwise predicted embeddings And use embedding According to Calculate the link score matrix. This process is particularly complex because embeddings cannot be directly compared. In a GRDPG setting, in It has a signature (d) + ,d - The indefinite orthogonal group of ) . In other words, the spectral embedding is unique only at rotation. To make individual embedding vectors comparable over the time series of embeddings, the embedding vectors are first aligned, and then the predicted embedding is computed based on the aligned embedding vectors. Furthermore, the same d is used for each embedding. + value and d - The value is used to make the process meaningful, which means that ASE is modified to look at the first d at both ends of the spectrum. + The first d - Each feature value.

[0074] joint alignment The appropriate technology (assuming the same d) + value and d -The value is based on Procrustes analysis, a technique known to those skilled in the art from other contexts, but applicable here to the alignment of spectral embeddings as follows. For simplicity, it is assumed that d in the GRDPG setting... - =0, which means d = d + Given two spectral embeddings (or, for the purposes of discussion, "shapes") Pruk analysis aims to find based on the following minimization criterion exist Optimal rotation on

[0075]

[0076] in It is an orthogonal matrix (Ω) T Ω=ΩΩ T =I(d,0)), and ||·|| F Describing the Frobenius norm Where tr(·) represents the trace. The solution to the minimization problem is based on... SVD: The solution is: And it follows exist The optimal rotation on is:

[0077]

[0078] The same method can be used to stack a set of T shapes. Select reference shape However, improved results can be obtained through generalized Procrustes analysis (GPA). The GPA algorithm uses the following minimization criterion:

[0079]

[0080] Make Among them, similar to the above, It is a shape-specific orthogonal matrix. Furthermore, It is a reference shape shared among T shapes, and S(·) is the centroid size. After properly initializing the reference shape through the following steps, the GPA algorithm solves the minimization problem through iterative standard Prouk analysis:

[0081] (1) Update shape right Each of the above Implement standard Pruk overlay: in

[0082] (2) Update the reference shape: as well as

[0083] (3) Repeat steps (1) and (2) until... The difference between two consecutive values ​​is within the tolerance η.

[0084] When d - When ≠0, the problem (called the indeterminate Prouk problem) has no closed-form solution. In this setting, the criterion...

[0085]

[0086] Numerical optimization is possible. Optimization routines can be iteratively applied to the GPA algorithm (which is essentially a pairwise Pluk-aligned sequence) to obtain an indeterminate GPA.

[0087] On the other hand, for directed and bipartite graphs, a joint optimization minimization criterion is used for the two embeddings obtained using DASE. This is used to optimize the minimization criterion for the two embeddings. and To achieve an approximate fast process for joint iterative optimization

[0088] and Involves:

[0089] (1) Initialize the identity matrix Ω * =I(d,0), and

[0090] (2) Repeat until convergence to Ω. * :

[0091] (a)

[0092] (b) Alternatively, the joint criterion can be optimized numerically. Note that this process can also be iterated over the joint generalized Prouk algorithm.

[0093] Figure 5 The flowchart illustrates a process 500 for link prediction based on the average value of the spectral embedding calculated according to the time series of the adjacency matrix, according to one or more embodiments. The starting point 510 of process 500 is also the adjacency matrix associated with multiple first time intervals. (For example, generated based on monitored network communications) Figure 2 The time series of operation 230). In operation 520, the adjacency matrix... Each is processed individually (e.g., by ASE, LSE, or DASE as described above) to obtain the spectral embedding. The time series. Based on these spectral embeddings, the predicted spectral embeddings associated with the second time interval are calculated in two steps. In operation 530, the spectral embedding is aligned. For example, using the (e.g., generalized) Pruk analysis as described above, and in operation 540, using a suitable model of the time series with aligned spectral embeddings, based on the aligned spectral embeddings... The predicted spectral embeddings are computed. This model can be, for example, an ARIMA or SARIMA model as further described below, and / or a weighted average over aligned spectral embeddings. Since each spectral embedding comprises n d-dimensional spectral embedding vectors for n nodes in the network graph, the time series of aligned spectral embeddings contains n×d element-wise time series, which, in some embodiments, are modeled independently for maximum flexibility. Alternatively, different models can be used for time series of different nodes and their associated spectral embedding vectors, while the same model is shared for all elements within the spectral embedding vector associated with a given node. In operation 550, the link score matrix S, containing the estimated probabilities of network communication between pairs of devices, is calculated based on the predicted spectral embeddings. (For example, using the (generalized) inner product makes) The calculation is performed using these estimated link probabilities. Link prediction ends at 560. For example, this is achieved by comparing the estimated link probabilities with the adjacency matrix observed for that time interval and identifying nodes exhibiting anomalous behavior and their corresponding devices. Figure 2 Operations 250-280 in the code can then be used for anomaly detection using the predicted links.

[0094] Another technique for link prediction uses the COSIE model, which can be viewed as an extension of RDPG for dynamic networks. In a COSIE network, it is assumed that potential locations are common across T snapshots of the graph, but the link probabilities are determined by a time-varying matrix. Scaling is performed using the (COSIE matrix), where the expected value for the adjacency matrix is ​​calculated according to the following formula:

[0095]

[0096] Common potential locations X and weighting matrices R1, ..., R T Time series data can be estimated using multipleadjacency spectral embedding (MASE), which is defined as follows: given a set of network adjacency matrices... Given an integer d∈{1,...,n}, obtain a separate ASE. Then, construct the n×Td matrix.

[0097]

[0098] And consider its singular value decomposition.

[0099]

[0100] in It is a diagonal matrix containing the first d singular values ​​arranged in descending order. and It contains corresponding left singular value vectors and right singular value vectors, and the matrix and It contains the remaining singular values ​​and vectors. A1, A2, ..., A T d-dimensional multi-adjacency embedding by Give, Provides spectral embeddings X and sequences The estimate, of which

[0101]

[0102] According to estimates From the time series, the predicted COSIE matrix can be obtained. For example, modeling can be performed using ARIMA or SARIMA, as further described below. In some embodiments, an independent model is fitted to a d×d time series corresponding to each entry of the COSIE matrix. The predicted COSIE matrix is ​​then... With spectral embedding The combination yielded the following link score matrix:

[0103]

[0104] Alternatively, it can be based on the estimated link probability. The link score matrix can be obtained from the time series data, for example, by simply averaging the data as follows:

[0105]

[0106] Alternatively, the link score matrix can be obtained by using scalar weights or a weighted average.

[0107] Note that the COSIE model has been described for undirected graphs, but it is assumed that... In this case, it can be directly extended to directed graphs and bipartite graphs, which leads to estimation in From The estimate of Y obtained from MASE.

[0108] Figure 6 The flowchart illustrates link prediction process 600 based on the COSIE model. The starting point 610 of process 600 is also an adjacency matrix associated with multiple first time intervals. (For example, generated based on monitored network communications) Figure 2 The time series of operation 230). In operation 620, the adjacency matrix is ​​processed by MASE. Joint processing is performed to compute the estimated common spectral embedding X and the COSIE matrix. The time series. In operation 630, the sequence is modeled (e.g., using ARIMA or SARIMA) to predict the COSIE matrix for the second time interval. To account for edge-specific dynamics, the elements of the predicted COSIE matrix can be computed based on independent corresponding models of the corresponding elements of the time series of the COSIE matrix. In operation 640, according to According to public spectrum embedding The link score matrix is ​​calculated by combining the predicted COSIE matrix. With these estimated link probabilities determined in the link score matrix, link prediction ends at 660. For example, this is achieved by comparing the estimated link probabilities with the adjacency matrix observed for that time interval and identifying nodes exhibiting anomalous behavior and their corresponding devices. Figure 2 Operations 250-280 in the code can then be used for anomaly detection using the predicted links.

[0109] In various embodiments, when averaging or otherwise modeling over time series (such as, for example, adjacency matrices, link scores, or spectral embeddings), the aforementioned processes 300, 400, 500, 600 for link prediction consider network dynamics at the granularity of individual edges by using edge-specific weights or model parameters. In some embodiments, seasonal ARIMA models are used for time series modeling, which is advantageous due to their flexible modeling assumptions. Typically, if the difference series... (where L is the lag operator L) k Z t =Z t-k ) is from the equation Defined causal ARMA process (where φ(v) = 1 - φ1v - ... - φ) p v p Φ(v)=1-Φ1v-…-Φ P v Pθ(v)=1+θ1v+…+θ q v q , and Θ(v)=1+Θ1v+…+Θ Q v Q If the time series Z1,…,Z is given, then… T It is a seasonal ARIMA(p,b,q)(P,B,Q) with time period s. s Note that the process is causal if and only if φ(v) ≠ 0 and Φ(v) ≠ 0 for |v| ≤ 1. The value of s typically depends on the application domain. In a computer network with daily network snapshots, s = 7, which represents a weekly periodicity. The remaining parameters p, b, q, P, B, and Q can be estimated using the Akaike information criterion (AIC) or the Bayesian information criterion (BIC). For smaller T values, the corrected AIC criterion (AICc) is preferred. If s is unknown, the information criterion can also be used for estimation. The corresponding coefficients of the polynomials φ(v), Φ(v), θ(v), and Θ(v) and the variance σ of the process are also given. 2 The parameters can be estimated using standard techniques in time series analysis via maximum likelihood. Algorithms for the automatic selection of parameters in seasonal ARIMA models are known to those skilled in the art.

[0110] For the future value Z t+1 The prediction is made by using the relationship Solve for Z t+1 and ε t+1 Set to its expected value Thus, an estimate can be obtained from the known terms of the equation. According to The general prediction equation can be obtained; similarly, Z can be obtained. t+k k-step advance prediction.

[0111] Note that the average value can be found on the adjacency matrix used in process 300. And the average value on the link score matrix that can be used in process 400. It uses autoregressive coefficients for explicit modeling, which is more efficient than the above. The general form is more restrictive. In this more restrictive setting, it is possible to assume seasonality AR(p)(P). s The model estimates the parameters using the maximum likelihood estimation with AIC or BIC penalties, corresponding to the following equation.

[0112]

[0113] The AR form is useful in this context because it provides interpretability for models that include moving average terms.

[0114] In order to improve the average adjacency matrix For modeling, as is known in the art, one of several models specifically designed for binary time series can be used instead of the SARIMA model. A common approach to modeling binary time series is to assume... Then, for example, a probability unit transformation or a logarithmic transformation is used to transform the parameter π. t Mapped to The underlying process z t Then assume process z t The changes are dynamically based on the underlying process, which can be, for example, a SARIMA model. Example models are dynamic binary response models (e.g., described in the following references: H. Kauppi et al., “Predicting U.S. reductions with dynamic binary response models,” *The Review of Economics and Statistics*, vol. 90, no. 4, pp. 777-791, 2008) and GARMA models (e.g., described in the following references: MA Benjamin et al., “Generalized autoregressive moving average models,” *Journal of the American Statistical Association*, vol. 98, no. 461, pp. 214-223, 2003).

[0115] Figures 7A-7D Example results for various link prediction processes on simulated seasonal data are shown, with each result comparing performance achieved with and without considering edge-specific dynamics. Performance is measured using the well-known area under the curve (AUC) metric. Simulated data is obtained from a stochastic block model, which can be interpreted as a special case of GRDPG: each node is assigned a potential location. Furthermore, the probability (i,j) of the link depends only on the communication allocation between the two nodes:

[0116]

[0117] In the simulation, the community probability matrix B = {B} is generated from the β distribution Beta(1.2,1.2). ij}∈[0,1] K×K Let B be the probability of a link between two nodes i and j in a community, and K be the number of communities. This parameter choice allows for fairly heterogeneous link probabilities in B. The matrix has full rank with a probability of 1, therefore K = d. Community assignments are chosen to be time-dependent seasonality over a week. For each node, the community assignment z is S = 7. i,s s = 1, ..., S are randomly sampled from {1, ..., K}. Then, the adjacency matrix is ​​obtained as:

[0118]

[0119] For a total of T = 100 network snapshots, the link probabilities change over time with a 7-day periodicity. The model is fitted using the first T' = 80 snapshots of the graph as the training set, with the aim of predicting the estimated link probabilities corresponding to the remaining (T-T') adjacency matrices.

[0120] Figure 7A The diagram shows that, based on the folded adjacency matrix, the values ​​are calculated as simple arithmetic means. Link prediction and edge-specific weighting based on process 300 Link prediction. Figure 7B Link predictions based on aligned spectral embeddings are shown, respectively, using simple arithmetic averaging or predictions based on the element-wise prediction model according to process 500. Figure 7C The results show the results obtained by simple arithmetic mean. Alternatively, based on process 400, edge-specific weighting can be used. Link prediction based on the average time series of the link score matrix. Figure 7D Link predictions using a COSIE model are shown, either using the predicted COSIE matrix derived from the simple arithmetic mean of the time series calculated as the COSIE matrix, or the COSIE matrix predicted from the time series using an element-wise prediction model according to procedure 600. In all cases, the number of parameters is estimated using the corrected AIC criterion by fitting the model to the training dataset using the auto_arima function in the statistical Python library pmdarima, thereby obtaining the time series model for calculating the edge-specific weighted matrix or otherwise obtaining the element-wise predictions.

[0121] As in Figures 7A-7DAs can be seen, link prediction using time series models generally outperforms simple averaging that does not consider edge-specific dynamics. This improvement is particularly significant in embodiments that utilize the time series of the folded adjacency matrix or the link probabilities calculated from the link score matrix; these two methods also achieve the best overall performance among all the methods compared. While this data illustrates the benefits of using edge-specific or element-wise weights and models in link prediction according to various embodiments, those skilled in the art will understand that the performance data depicted are merely examples, and the quantitative performance and performance improvements associated with the various methods described herein can generally vary depending on, for example, the datasets to which they are applied and the implementation details.

[0122] Figure 8 A block diagram of an example machine 800 on which any one or more of the techniques (e.g., methodologies) discussed herein can be performed is shown. In alternative embodiments, machine 800 may operate as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, machine 800 may operate as a server machine, a client machine, or both in a server-client network environment. In one example, machine 800 may act as a peer-to-peer (P2P) (or other distributed) network environment. Machine 800 may be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, smartphone, web device, network router, switch or bridge, server computer, database, conference room equipment, or any machine capable of executing instructions (sequentially or otherwise) specifying the actions to be taken by the machine. In various embodiments, machine 800 may perform the above-mentioned... Figures 2-6 One or more processes are described. For example, in some embodiments, machine 800 represents... Figure 1 Security system 110. Furthermore, although only a single machine is shown, the term "machine" should also be understood to include any collection of machines, such as cloud computing, Software as a Service (SaaS), and other computer cluster configurations, that individually or jointly execute one or more sets of instructions to perform any one or more of the methodologies discussed herein.

[0123] Machine (e.g., computer system) 800 may include a hardware processor 802 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), main memory 804, and static memory 806, some or all of which may communicate with each other via interconnect (e.g., bus) 808. Machine 800 may also include a display unit 810, an alphanumeric input device 812 (e.g., a keyboard), and a user interface (UI) navigation device 814 (e.g., a mouse). In one example, display unit 810, input device 812, and UI navigation device 814 may be a touchscreen display. Machine 800 may additionally include a storage device (e.g., a drive unit) 816, a signal generation device 818 (e.g., a speaker), a network interface device 820, and one or more sensors 821 (such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensors). Machine 800 may include an output controller 828 (such as a serial (e.g., Universal Serial Bus (USB)), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection) connection) for communicating or controlling one or more peripheral devices (e.g., printers, card readers, etc.).

[0124] Storage device 816 may include a machine-readable medium 822 on which one or more data structures or instructions 824 (e.g., software) are stored, which embody or be utilized by any one or more of the techniques or functions described herein. During execution of the instructions 824 by machine 800, the instructions 824 may also reside wholly or at least partially in main memory 804, static memory 806, or hardware processor 802. In one example, one or any combination of hardware processor 802, main memory 804, static memory 806, or storage device 816 may constitute a machine-readable medium.

[0125] Although machine-readable medium 822 is shown as a single medium, the term "machine-readable medium" can include a single medium or multiple media (e.g., a centralized or distributed database and / or associated caches and servers) configured to store one or more instructions 824.

[0126] The term "machine-readable medium" can include any medium capable of storing, encoding, or carrying instructions for execution by machine 800 and causing machine 800 to perform any or more of the technologies disclosed herein, or any medium capable of storing, encoding, or carrying data structures used by or associated with such instructions. Non-limiting examples of machine-readable media can include solid-state memory, as well as optical and magnetic media. Specific examples of machine-readable media can include: non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; disks, such as internal hard disks and removable hard disks; magneto-optical disks; random access memory (RAM); solid-state drives (SSDs); and CD-ROMs and DVD-ROMs. In some examples, machine-readable media can include non-transitory machine-readable media. In some examples, machine-readable media can include machine-readable media that are not transient propagating signals.

[0127] The machine 800 can also send or receive instructions 824 on the communication network 826 via a transmission medium using the network interface device 820. The machine 800 can communicate with one or more other machines using any of a variety of transmission protocols (e.g., Frame Relay, Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), etc.). Example communication networks may include local area networks (LANs), wide area networks (WANs), packet data networks (e.g., the Internet), mobile phone networks (e.g., cellular networks), conventional telephone (POTS) networks, and wireless data networks (e.g., referred to as…). The Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards, known as The network interface device 820 may include the IEEE 802.16 family of standards, the IEEE 802.15.4 family of standards, the Long Term Evolution (LTE) family of standards, the Universal Mobile Telecommunications System (UMTS) family of standards, peer-to-peer (P2P) networks, etc. In one example, the network interface device 820 may include one or more physical jacks (e.g., Ethernet jacks, coaxial jacks, or telephone jacks) or one or more antennas to connect to the communication network 826. In one example, the network interface device 820 may include multiple antennas to perform wireless communication using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technologies. In some examples, the network interface device 820 may use multi-user MIMO technology for wireless communication.

[0128] As described herein, examples may include logic or multiple components, modules, or mechanisms (hereinafter referred to as "modules") or on which operations can be performed. A module is a tangible entity (e.g., hardware) capable of performing a specified operation and may be configured or arranged in a certain manner. In one example, circuitry may be arranged as a module in a specified manner (e.g., internally or with respect to an external entity such as other circuitry). In one example, all or part of one or more computer systems (e.g., a standalone computer system, a client or server computer system) or one or more hardware processors may be configured by firmware or software (e.g., instructions, application portions, or applications) to operate to perform a specified operation. In one example, the software may reside on a machine-readable medium. In one example, when executed by the underlying hardware of the module, the software causes the hardware to perform the specified operation.

[0129] Accordingly, the term "module" is understood to encompass tangible entities that can be physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., provisionally) configured (e.g., programmable) entities, in order to operate in a particular manner or perform part or all of the operations described herein. Consider the example of modules being provisionally configured, where each module in the module does not need to be instantiated at any given time. For example, in the case where the module includes a general-purpose hardware processor configured using software, the general-purpose hardware processor can be configured as different modules at different times. The software can accordingly configure the hardware processor, for example, to constitute a particular module at one time and different modules at different times.

[0130] The examples numbered below are illustrative embodiments.

[0131] 1. A computer-implemented method comprising: monitoring network communication between devices within a network; generating a time series of an adjacency matrix corresponding to a time-dependent network graph, the time-dependent network graph representing the network communication being monitored during a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices during one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; calculating a time series of spectral embeddings based on the adjacency matrix associated with the first time intervals, each spectral embedding including a plurality of spectral embedding vectors associated with nodes of the network graph; calculating predicted spectral embeddings based on the time series of spectral embeddings, the predicted spectral embeddings including a plurality of predicted spectral embedding vectors associated with nodes; calculating corresponding estimated probabilities of network communication between pairs of devices represented by corresponding pairs of nodes associated with the paired predicted spectral embedding vectors based on the paired predicted spectral embedding vectors; comparing the estimated probabilities with the adjacency matrix associated with the second time interval according to an anomalous criterion defining anomalous network behavior; identifying a subset of nodes associated with anomalous network behavior based on the comparison; identifying a subset of devices represented by the node subsets based on the node subsets; and generating an output based on the identified subset of devices.

[0132] 2. The method according to Example 1, wherein generating output based on the identified subset of devices includes reconfiguring network access control devices to constrain network communication of the identified subset of devices.

[0133] 3. The method described in Example 2, wherein the access control device is a firewall.

[0134] 4. The method according to any one of Examples 1-3, wherein generating output based on the identified subset of devices includes at least one of the following: enhancing communication logging, revoking or suspending user accounts, or notifying users associated with communications originating from devices in the identified subset of devices.

[0135] 5. The method according to Example 1, wherein the identified subset of devices experiences an unusually high level of network communication, and wherein generating output includes allocating additional computing resources to the identified subset of devices.

[0136] 6. The method according to any one of Examples 1-5, wherein computing the predicted spectral embedding includes aligning the spectral embedding vector on the time series of the spectral embedding, and computing the predicted spectral embedding vector based on the aligned spectral embedding vector.

[0137] 7. The method according to Example 6, wherein the spectral embedding vector is aligned by generalized Pruk alignment.

[0138] 8. The method according to Example 6 or Example 7, wherein computing the predicted spectral embedding vector includes averaging the aligned spectral embedding vector over a time series of spectral embeddings.

[0139] 9. The method according to Example 6 or Example 7, wherein the predicted spectral embedding vector is computed using an element-wise prediction model.

[0140] 10. The method described in Example 9, wherein the element-wise prediction model is a seasonal autoregressive integrated moving average (SARIMA) model.

[0141] 11. The method according to any one of Examples 1-10, wherein each spectral embedding in the spectral embedding of the time series of spectral embeddings is computed by means of adjacent spectral embeddings.

[0142] 12. The method according to any one of Examples 1-10, wherein the network graph is directed, and wherein each spectral embedding in the time series of spectral embeddings is computed using directed adjacency spectral embeddings obtained by singular value decomposition.

[0143] 13. The method according to any one of Examples 1-10, wherein each spectral embedding in the spectral embedding of the time series of spectral embeddings is computed by Laplace spectral embedding.

[0144] 14. The method according to any one of Examples 1-13, wherein the anomaly criterion is based on a threshold, and identifying a subset of nodes associated with anomalous network behavior includes applying the threshold to an estimated probability of network communication.

[0145] 15. The method according to any one of Examples 1-13 further includes determining a subgraph comprising a subset of the identified nodes, wherein generating the output includes the output subgraph.

[0146] 16. A system comprising: hardware processing circuitry; one or more hardware memories storing instructions that, when executed, configure the hardware processing circuitry to perform operations including: generating a time series of an adjacency matrix corresponding to a time-dependent network graph, the time-dependent network graph representing monitored network communication between devices within a network over a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices during one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; and calculating a time series of spectral embeddings based on the adjacency matrix associated with the first time intervals. Each spectral embedding includes multiple spectral embedding vectors associated with nodes in the network graph; a predicted spectral embedding is computed based on the time series of the spectral embeddings, the predicted spectral embedding including multiple predicted spectral embedding vectors associated with nodes; an estimated probability of network communication between pairs of devices represented by corresponding pairs of nodes associated with the pairwise average spectral embedding vectors is computed based on the pairwise predicted spectral embedding vectors; the estimated probability is compared with an adjacency matrix associated with a second time interval according to an anomalous criteria defining anomalous network behavior; a subset of nodes associated with anomalous network behavior is identified based on the comparison; a subset of devices represented by the node subsets is identified based on the node subsets; and an output is generated based on the identified device subsets.

[0147] 17. The system according to Example 16, wherein generating output based on an identified subset of devices includes reconfiguring network access control devices to constrain network communication of the identified subset of devices.

[0148] 18. The system according to Example 17, wherein the access control device is a firewall.

[0149] 19. The system according to any one of Examples 16-18, wherein generating output based on the identified subset of devices includes at least one of the following: enhancing communication logging, revoking or suspending user accounts, or notifying users associated with communications originating from devices in the identified subset of devices.

[0150] 20. The system according to any one of Examples 16-18, wherein the identified subset of devices experiences an unusually high level of network communication, and wherein generating output includes allocating additional computing resources to the identified subset of devices.

[0151] 21. The system according to any one of Examples 16-20, wherein computing the predicted spectral embedding includes aligning the spectral embedding vector on the time series of the spectral embedding, and computing the predicted spectral embedding vector based on the aligned spectral embedding vector.

[0152] 22. The system according to Example 21, wherein the spectral embedding vector is aligned by generalized Prouk alignment.

[0153] 23. The system according to Example 21 or Example 22, wherein computing the predicted spectral embedding vector includes averaging the aligned spectral embedding vector over a time series of spectral embeddings.

[0154] 24. The method according to Example 21 or Example 22, wherein the predicted spectral embedding vector is computed using an element-wise prediction model.

[0155] 25. The system according to Example 24, wherein the element-wise prediction model is an autoregressive composite moving average (ARIMA) model or a seasonal ARIMA (SARIMA) model.

[0156] 26. The system according to any one of Examples 16-25, wherein each spectral embedding in the time series of spectral embeddings is computed by means of adjacent spectral embeddings.

[0157] 27. The system according to any one of Examples 16-25, wherein the network graph is directed, and wherein each spectral embedding in the time series of spectral embeddings is computed using directed adjacency spectral embeddings obtained by singular value decomposition.

[0158] 28. The system according to any one of Examples 16-25, wherein each spectral embedding in the time series of spectral embeddings is computed by Laplace spectral embedding.

[0159] 29. The system according to any one of Examples 16-25, wherein the anomaly criterion is based on a threshold, and identifying a subset of nodes associated with anomalous network behavior includes applying the threshold to an estimated probability of network communication.

[0160] 30. The system according to any one of Examples 16-25, the operation further includes determining a subgraph comprising a subset of the identified nodes, wherein generating the output includes the output subgraph.

[0161] 31. A non-transitory computer-readable storage medium comprising instructions that, when executed, configure hardware processing circuitry to perform operations, the operations including: generating a time series of adjacency matrices corresponding to a time-dependent network graph, the time-dependent network graph representing monitored network communication between devices within a network over a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices within the network over one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; calculating a time series of spectral embeddings based on the adjacency matrix associated with the first time intervals, each spectrum... The embedding includes multiple spectral embedding vectors associated with nodes in the network graph; a predicted spectral embedding is computed based on the time series of the spectral embeddings, the predicted spectral embeddings including multiple predicted spectral embedding vectors associated with nodes; an estimated probability of network communication between pairs of devices represented by corresponding pairs of nodes associated with the pairwise average spectral embedding vectors is computed based on the pairwise predicted spectral embedding vectors; the estimated probability is compared with an adjacency matrix associated with a second time interval according to an anomalous criteria defining anomalous network behavior; a subset of nodes associated with anomalous network behavior is identified based on the comparison; a subset of devices represented by the node subsets is identified based on the node subsets; and an output is generated based on the identified device subsets.

[0162] 32. A computer-implemented method comprising: monitoring network communication between devices within a network; generating a time series of an adjacency matrix corresponding to a time-dependent network graph representing network communication monitored over multiple time intervals, the nodes of the network graph representing devices, and the edges of the network graph each representing network communication between two devices during one of the time intervals, the time intervals including a second time interval and a plurality of first time intervals; calculating a time series of a weighted matrix based on an adjacency matrix associated with the first time intervals; calculating a weighted average of the adjacency matrix associated with the first time intervals based on the time series of the weighted matrix; calculating a plurality of spectral embedding vectors based on the weighted average, each spectral embedding vector being associated with a node in the network graph; calculating a corresponding estimated probability of network communication between pairs of devices represented by pairs of nodes associated with corresponding pair of spectral embedding vectors based on pairwise spectral embedding vectors; comparing the estimated probabilities with an adjacency matrix associated with the second time intervals according to an anomalous criteria defining anomalous network behavior; identifying a subset of nodes associated with anomalous network behavior based on the comparison; identifying a subset of devices represented by the node subsets based on the node subsets; and generating an output based on the identified subset of devices.

[0163] 33. The method according to Example 32, wherein the time series of the weighted matrix is ​​calculated using an autoregressive integrated moving average (ARIMA) model or a seasonal ARIMA (SARIMA) model.

[0164] 34. The method according to Example 32 or Example 33, wherein the spectral embedding vector is computed via adjacent spectral embedding.

[0165] 35. The method according to Example 32 or Example 33, wherein the network graph is directed, and wherein the spectral embedding vector is computed using directed adjacency spectral embedding by singular value decomposition.

[0166] 36. The method according to Example 32 or Example 33, wherein the spectral embedding vector is computed via Laplacian spectral embedding.

[0167] 37. The method according to any one of Examples 32-36, wherein the anomaly criterion is based on a threshold, and determining the vertex portion representing anomalous network behavior includes applying the threshold to an estimated probability of network communication.

[0168] 38. The method according to any one of Examples 32-36 further includes determining a subgraph comprising a subset of the identified nodes, wherein generating the output includes the output subgraph.

[0169] 39. The method according to any one of Examples 32-36, wherein generating output based on the identified subset of devices includes at least one of the following: reconfiguring network access control devices to restrict network communication of the identified subset of devices, enhancing communication logging, revoking or suspending user accounts or notifying users associated with communication originating from devices within the identified subset of devices, or allocating additional computing resources to the identified subset of devices.

[0170] 40. A system comprising: hardware processing circuitry; one or more hardware memories storing instructions that, when executed, configure the hardware processing circuitry to perform operations including: generating a time series of an adjacency matrix corresponding to a time-dependent network graph, the time-dependent network graph representing monitored network communication between devices within a network over a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices during one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; and calculating a time series of a weighted matrix based on the adjacency matrix associated with the first time intervals. The algorithm calculates a weighted average of the adjacency matrix associated with a first time interval based on the time series of the weighted matrix; calculates multiple spectral embedding vectors based on the weighted average, each spectral embedding vector being associated with one node in the network graph; calculates the estimated probability of network communication between pairs of devices represented by pairs of nodes associated with the corresponding pair of spectral embedding vectors based on the pairwise spectral embedding vectors; compares the estimated probability with the adjacency matrix associated with a second time interval according to anomaly criteria defining anomalous network behavior; identifies a subset of nodes associated with anomalous network behavior based on the comparison; identifies a subset of devices represented by the node subsets based on the node subsets; and generates an output based on the identified subset of devices.

[0171] 41. The system according to Example 40, wherein the time series of the weighted matrix is ​​calculated using an autoregressive integrated moving average (ARIMA) model or a seasonal ARIMA (SARIMA) model.

[0172] 42. The system according to Example 40 or Example 41, wherein the spectral embedding vector is computed via adjacent spectral embedding.

[0173] 43. The system according to Example 40 or Example 41, wherein the network graph is directed, and wherein the spectral embedding vector is computed using directed adjacency spectral embedding by singular value decomposition.

[0174] 44. The system according to Example 40 or Example 41, wherein the spectral embedding vector is computed via Laplacian spectral embedding.

[0175] 45. The system according to any one of Examples 40-44, wherein the anomaly criterion is based on a threshold, and identifying a subset of nodes associated with anomalous network behavior includes applying the threshold to an estimated probability of network communication.

[0176] 46. ​​The system according to any one of Examples 40-45, the operation further includes determining a subgraph comprising a subset of the identified nodes, wherein generating the output includes the output subgraph.

[0177] 47. The system according to any one of Examples 40-46, wherein generating output based on the identified subset of devices includes at least one of the following: reconfiguring network access control devices to restrict network communication of the identified subset of devices, enhancing communication logging, revoking or suspending user accounts or notifying users associated with communication originating from devices within the identified subset of devices, or allocating additional computing resources to the identified subset of devices.

[0178] 48. A non-transitory computer-readable storage medium comprising instructions that, when executed, configure hardware processing circuitry to perform operations including: generating a time series of an adjacency matrix corresponding to a time-dependent network graph, the time-dependent network graph representing monitored network communication between devices within a network over a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices during one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; calculating a time series of a weighted matrix based on an adjacency matrix associated with the first time intervals; and based on... The time series of the weighted matrix is ​​used to calculate a weighted average of the adjacency matrix associated with a first time interval; multiple spectral embedding vectors are calculated based on the weighted average, each spectral embedding vector being associated with one node in the network graph; the estimated probabilities of network communication between pairs of devices represented by pairs of nodes associated with the corresponding pair spectral embedding vectors are calculated based on the pair spectral embedding vectors; the estimated probabilities are compared with the adjacency matrix associated with a second time interval according to anomaly criteria defining anomalous network behavior; a subset of nodes associated with anomalous network behavior is identified based on the comparison; a subset of devices represented by the node subsets is identified based on the node subsets; and an output is generated based on the identified device subsets.

[0179] 49. A computer-implemented method comprising: monitoring network communication between devices within a network; generating a time series of an adjacency matrix corresponding to a time-dependent network graph, the time-dependent network graph representing network communication monitored over multiple time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices during one time interval, the time intervals including a second time interval and a plurality of first time intervals; calculating a time series of spectral embeddings based on the adjacency matrix associated with the first time intervals, each spectral embedding including a plurality of spectral embedding vectors associated with nodes of the network graph; and calculating corresponding link values ​​based on the time series of spectral embeddings. The time series of the link score matrix is ​​divided, and each entry of the link score matrix is ​​based on the pairwise spectral embedding vector of the corresponding spectral embedding; the time series of the weighted matrix is ​​calculated based on the time series of the link score matrix; the weighted average of the link score matrix is ​​calculated based on the time series of the weighted matrix, and the entries in the weighted average correspond to the estimated probability of network communication between pairs of devices represented by the corresponding pairs of nodes; the estimated probability is compared with the adjacency matrix associated with the second time interval according to the anomaly criteria that define anomalous network behavior; the node subset associated with anomalous network behavior is identified based on the comparison; the device subset represented by the node subset is identified based on the node subset; and the output is generated based on the identified device subset.

[0180] 50. The method according to Example 49, wherein the time series of the weighted matrix is ​​calculated using an autoregressive integrated moving average (ARIMA) model or a seasonal ARIMA (SARIMA) model.

[0181] 51. The method according to Example 49 or Example 50, wherein the spectral embedding is computed via the adjacent spectral embedding.

[0182] 52. The method according to Example 49 or Example 50, wherein the network graph is directed, and wherein the spectral embedding is computed using a directed adjacency spectral embedding obtained by singular value decomposition.

[0183] 53. The method according to Example 49 or Example 50, wherein the spectral embedding is computed via Laplacian spectral embedding.

[0184] 54. The method according to any one of Examples 49-53, wherein the anomaly criterion is based on a threshold, and identifying a subset of nodes associated with anomalous network behavior includes applying the threshold to an estimated probability of network communication.

[0185] 55. The method according to any one of Examples 49-54 further includes determining a subgraph comprising a subset of the identified nodes, wherein generating the output includes the output subgraph.

[0186] 56. The method according to any one of Examples 49-55, wherein generating output based on the identified subset of devices includes at least one of the following: reconfiguring network access control devices to restrict network communication of the identified subset of devices, enhancing communication logging, revoking or suspending user accounts or notifying users associated with communication originating from devices within the identified subset of devices, or allocating additional computing resources to the identified subset of devices.

[0187] 57. A system comprising: hardware processing circuitry; one or more hardware memories storing instructions that, when executed, configure the hardware processing circuitry to perform operations including: generating a time series of adjacency matrices corresponding to a time-dependent network graph, the time-dependent network graph representing monitored network communication between devices within a network over a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices during one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; and calculating a time series of spectral embeddings based on the adjacency matrix associated with the first time intervals, each spectral embedding including a plurality of adjacency matrices associated with nodes of the network graph. The process involves: spectral embedding vectors; calculating the time series of the corresponding link score matrix based on the time series of the spectral embedding, with each entry in the link score matrix based on a pairwise spectral embedding vector of the corresponding spectral embedding; calculating the time series of the weighted matrix based on the time series of the link score matrix; calculating a weighted average of the link score matrix based on the time series of the weighted matrix, with entries in the weighted average corresponding to estimated probabilities of network communication between pairs of devices represented by corresponding pairs of nodes; comparing the estimated probabilities with an adjacency matrix associated with a second time interval based on anomaly criteria defining anomalous network behavior; identifying a subset of nodes associated with anomalous network behavior based on the comparison; identifying a subset of devices represented by the node subsets based on the node subsets; and generating an output based on the identified subset of devices.

[0188] 58. The system according to Example 57, wherein the time series of the weighted matrix is ​​calculated using an autoregressive integrated moving average (ARIMA) model or a seasonal ARIMA (SARIMA) model.

[0189] 59. The system according to Example 57 or Example 58, wherein the spectral embedding is computed via the adjacency spectral embedding.

[0190] 60. The system according to Example 57 or Example 58, wherein the network graph is directed, and wherein the spectral embedding is computed using the directed adjacency spectral embedding of singular value decomposition.

[0191] 61. The system according to Example 57 or Example 58, wherein the spectral embedding is calculated via Laplace spectral embedding.

[0192] 62. The system according to any one of Examples 57-61, wherein the anomaly criterion is based on a threshold, and determining the vertex portion representing anomalous network behavior includes applying the threshold to an estimated probability of network communication.

[0193] 63. The system according to any one of Examples 57-62, further comprising determining a subgraph including a subset of the identified nodes, wherein generating output includes an output subgraph.

[0194] 64. The system according to any one of Examples 57-63, wherein generating output based on the identified subset of devices includes at least one of the following: reconfiguring network access control devices to restrict network communication of the identified subset of devices, enhancing communication logging, revoking or suspending user accounts or notifying users associated with communication originating from devices within the identified subset of devices, or allocating additional computing resources to the identified subset of devices.

[0195] 65. A non-transitory computer-readable storage medium comprising instructions that, when executed, configure hardware processing circuitry to perform operations including: generating a time series of adjacency matrices corresponding to a time-dependent network graph, the time-dependent network graph representing monitored network communication between devices within a network over a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices during one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; and calculating a time series of spectral embeddings based on the adjacency matrix associated with the first time intervals, each spectral embedding including a plurality of spectral embeddings associated with nodes of the network graph. The process involves: calculating the time series of the corresponding link score matrix based on the time series of the spectral embeddings, with each entry in the link score matrix based on a pairwise spectral embedding vector of the corresponding spectral embedding; calculating the time series of the weighted matrix based on the time series of the link score matrix; calculating a weighted average of the link score matrix based on the time series of the weighted matrix, with entries in the weighted average corresponding to estimated probabilities of network communication between pairs of devices represented by corresponding pairs of nodes; comparing the estimated probabilities with an adjacency matrix associated with a second time interval based on anomaly criteria defining anomalous network behavior; identifying a subset of nodes associated with anomalous network behavior based on the comparison; identifying a subset of devices represented by the node subsets based on the node subsets; and generating an output based on the identified subset of devices.

[0196] 66. A computer-implemented method comprising: monitoring network communication between devices within a network; generating a time series of an adjacency matrix corresponding to a time-dependent network graph, the time-dependent network graph representing network communication monitored over multiple time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices within the network graph during one of the time intervals, the time intervals including a second time interval and a plurality of first time intervals; calculating a time series of multiple spectral embedding vectors associated with nodes of the network graph and a COSIE correction matrix based on the adjacency matrix associated with the first time intervals via multiple adjacency spectral embedding; and calculating a time series of the COSIE correction matrix based on the time series of the adjacency matrix. The sequence is used to compute the predicted COSIE correction matrix, where each element of the predicted COSIE correction matrix is ​​based on an independent model of the corresponding element of the time series of the COSIE correction matrix; the estimated probability of network communication between corresponding pairs of devices, represented by pairs of nodes associated with the corresponding pairs of spectral embedding vectors, is computed based on the predicted COSIE matrix and the pairwise spectral embedding vectors; the estimated probability is compared with an adjacency matrix associated with a second time interval according to an anomalous criteria defining anomalous network behavior; a subset of nodes associated with anomalous network behavior is identified based on the comparison; a subset of devices represented by the node subsets is identified based on the node subsets; and an output is generated based on the identified device subsets.

[0197] 67. The method according to Example 66, wherein the predicted COSIE correction matrix is ​​calculated using an autoregressive integrated moving average (ARIMA) model or a seasonal ARIMA (SARIMA) model.

[0198] 68. The method according to Example 66 or Example 67, wherein the spectral embedding vector is computed via adjacent spectral embedding.

[0199] 69. The method according to Example 66 or Example 67, wherein the network graph is directed, and wherein the spectral embedding vector is computed using directed adjacency spectral embeddings obtained by singular value decomposition.

[0200] 70. The method according to Example 66 or Example 67, wherein the spectral embedding vector is computed via Laplacian spectral embedding.

[0201] 71. The method according to any one of Examples 66-70, wherein the anomaly criterion is based on a threshold, and identifying a subset of nodes associated with anomalous network behavior includes applying the threshold to an estimated probability of network communication.

[0202] 72. The method according to any one of Examples 66-71 further includes determining a subgraph comprising a subset of the identified nodes, wherein generating the output includes the output subgraph.

[0203] 73. The method according to any one of Examples 66-72, wherein generating output based on the identified subset of devices includes at least one of the following: reconfiguring network access control devices to restrict network communication of the identified subset of devices, enhancing communication logging, revoking or suspending user accounts or notifying users associated with communication originating from devices within the identified subset of devices, or allocating additional computing resources to the identified subset of devices.

[0204] 74. A system comprising: hardware processing circuitry; one or more hardware memories storing instructions that, when executed, configure the hardware processing circuitry to perform operations including: generating a time series of adjacency matrices corresponding to a time-dependent network graph, the time-dependent network graph representing monitored network communication between devices within a network over a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices within the network graph over one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; and computing a plurality of spectral embedding vectors associated with nodes of the network graph and COSI based on the adjacency matrix associated with the first time intervals via multiple adjacency spectral embedding. The time series of the COSIE correction matrix is ​​used to calculate the predicted COSIE correction matrix, where each element of the predicted COSIE correction matrix is ​​based on an independent model of the corresponding element of the time series of the COSIE correction matrix; the estimated probability of network communication between corresponding pairs of devices, represented by pairs of nodes associated with the corresponding pairs of spectral embedding vectors, is calculated based on the predicted COSIE matrix and the pairwise spectral embedding vectors; the estimated probability is compared with the adjacency matrix associated with a second time interval according to the anomaly criteria defining anomalous network behavior; a subset of nodes associated with anomalous network behavior is identified based on the comparison; a subset of devices represented by the node subsets is identified based on the node subsets; and an output is generated based on the identified subset of devices.

[0205] 75. The system according to Example 74, wherein the time series of the COSIE correction matrix is ​​calculated using an autoregressive integrated moving average (ARIMA) model or a seasonal ARIMA (SARIMA) model.

[0206] 76. The system according to Example 74 or Example 75, wherein the spectral embedding is computed via the adjacency spectral embedding.

[0207] 77. A system according to Example 74 or Example 75, wherein the network graph is directed, and wherein the spectral embedding is computed using the directed adjacency spectral embedding of singular value decomposition.

[0208] 78. The system according to Example 74 or Example 75, wherein the spectral embedding is calculated via Laplace spectral embedding.

[0209] 79. The system according to any one of Examples 74-78, wherein the anomaly criterion is based on a threshold, and determining the vertex portion representing anomalous network behavior includes applying the threshold to an estimated probability of network communication.

[0210] 80. The system according to any one of Examples 74-79, further comprising determining a subgraph including a subset of the identified nodes, wherein generating output includes an output subgraph.

[0211] 81. The system according to any one of Examples 74-80, wherein generating output based on the identified subset of devices includes at least one of the following: reconfiguring network access control devices to restrict network communication of the identified subset of devices, enhancing communication logging, revoking or suspending user accounts or notifying users associated with communication originating from devices within the identified subset of devices, or allocating additional computing resources to the identified subset of devices.

[0212] 82. A non-transitory computer-readable storage medium comprising instructions that, when executed, configure hardware processing circuitry to perform operations including: generating a time series of adjacency matrices corresponding to a time-dependent network graph, the time-dependent network graph representing monitored network communication between devices within a network over a series of time intervals, nodes of the network graph representing devices, and edges of the network graph each representing network communication between two devices during one of the time intervals, the series of time intervals including a second time interval and a plurality of first time intervals; and calculating a plurality of spectral embedding vectors associated with nodes of the network graph and COSIE correction based on the adjacency matrix associated with the first time intervals via multiple adjacency spectral embedding. The time series of the COSIE correction matrix is ​​used to calculate the predicted COSIE correction matrix, where each element of the predicted COSIE correction matrix is ​​based on an independent model of the corresponding element of the time series of the COSIE correction matrix; the estimated probability of network communication between corresponding pairs of devices, represented by pairs of nodes associated with the corresponding pairs of spectral embedding vectors, is calculated based on the predicted COSIE matrix and the pairwise spectral embedding vectors; the estimated probability is compared with the adjacency matrix associated with a second time interval according to the anomaly criteria defining anomalous network behavior; a subset of nodes associated with anomalous network behavior is identified based on the comparison; a subset of devices represented by the node subsets is identified based on the node subsets; and an output is generated based on the identified device subsets.

[0213] Although embodiments have been described with reference to specific example examples, it will be apparent that various modifications and changes can be made to these embodiments without departing from the broader scope of the invention. Accordingly, the specification and drawings are to be considered illustrative rather than restrictive. The drawings, which form a part of this specification, illustrate specific embodiments in which the subject matter can be practiced by way of illustration rather than limitation. The illustrated embodiments have been described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments may be used and derived therefrom, such that structural and logical substitutions and changes may be made without departing from the scope of this disclosure. Therefore, this specification should not be construed as restrictive, and the scope of the various embodiments is defined only by the appended claims and the full scope of their equivalents.

Claims

1. A computer-implemented method, comprising: A time series of an adjacency matrix is ​​generated, which represents network communication between devices within a monitored network during multiple time intervals, including a second time interval and multiple first time intervals. Based on the adjacency matrix associated with the first time interval, a spectral embedding vector is calculated by spectral decomposition based on eigenvalues ​​and eigenvectors, and each spectral embedding vector is associated with one of the devices. Based on the paired spectral embedding vectors, the estimated probability of network communication between the corresponding pairs of devices is calculated; The estimated probability is compared with the adjacency matrix associated with the second time interval, according to the anomaly criteria that define abnormal network behavior. Based on the comparison, at least one device associated with the anomalous network behavior is identified; as well as The output is generated based on the identified at least one device.

2. The method of claim 1, wherein generating the output based on the identified at least one device comprises: Reconfigure the network's access control device to restrict network communication of the identified at least one device.

3. The method according to claim 2, wherein the access control device is a firewall.

4. The method of claim 1, wherein generating the output based on the identified at least one device includes at least one of the following: enhancing communication logging, revoking or suspending a user account, or notifying a user associated with communication originating from the at least one device.

5. The method of claim 1, wherein the identified at least one device experiences an unusually high level of network communication, and wherein generating the output includes allocating additional computing resources to the identified at least one device.

6. The method of claim 1, wherein calculating the spectral embedding vector based on the adjacency matrix associated with the first time interval comprises: The time series of the weighted matrix is ​​calculated based on the adjacency matrix associated with the first time interval; Based on the time series of the weighted matrix, calculate the weighted average of the adjacency matrix associated with the first time interval; and The spectral embedding vector is calculated based on the spectral decomposition of the eigenvalues ​​and eigenvectors of the adjacency matrix associated with the first time interval, which are weighted averages.

7. The method of claim 6, wherein the time series of the weighted matrix is ​​calculated using an autoregressive composite moving average (ARIMA) model or a seasonal autoregressive composite moving average (SARIMA) model.

8. The method according to claim 1, Calculating the spectral embedding vector based on the adjacency matrix associated with the first time interval includes calculating a time series of spectral embeddings, each spectral embedding including a spectral embedding vector associated with the device; and The calculation of the estimated probability includes: The time series of each link score matrix is ​​calculated based on the time series of the spectral embedding, and the entries of each link score matrix are based on the pairwise spectral embedding vectors of the respective spectral embedding. The time series of the weighted matrix is ​​calculated based on the time series of the link score matrix; and The link score matrix is ​​calculated as a weighted average based on the time series of the weighted matrix, wherein the entries in the weighted average correspond to the estimated probabilities of network communication between pairs of the devices.

9. The method of claim 8, wherein the time series of the weighted matrix is ​​calculated using an autoregressive composite moving average (ARIMA) model or a seasonal autoregressive composite moving average (SARIMA) model.

10. The method of claim 1, wherein the paired spectral embedding vectors are predicted spectral embedding vectors, the estimated probability is calculated based on the paired spectral embedding vectors, and wherein calculating the predicted spectral embedding vectors based on an adjacency matrix associated with the first time interval comprises: The time series of spectral embeddings are calculated based on the spectral decomposition of the adjacency matrix associated with the first time interval and the eigenvalues ​​and eigenvectors, each spectral embedding including a spectral embedding vector associated with the device. as well as The predicted spectral embedding is calculated based on the time series of the spectral embedding, the predicted spectral embedding including the predicted spectral embedding vector associated with the device.

11. The method according to claim 1, Calculating the spectral embedding vector based on the adjacency matrix associated with the first time interval includes: The COSIE correction matrix time series and multiple spectral embedding vectors associated with the device are calculated by multi-neighbor spectral embedding based on the adjacency matrix associated with the first time interval. and The calculation of the estimated probability includes: The predicted COSIE correction matrix is ​​calculated based on the time series of the COSIE correction matrix, and each element of the predicted COSIE correction matrix is ​​based on an independent model of the corresponding element of the time series of the COSIE correction matrix. as well as The estimated probability is calculated based on the pair of spectral embedding vectors, using the predicted COSIE correction matrix.

12. The method of claim 11, wherein the predicted COSIE correction matrix is ​​calculated using an autoregressive integrated moving average (ARIMA) model or a seasonal autoregressive integrated moving average (SARIMA) model.

13. The method of claim 1, wherein the spectral embedding vector is computed via adjacent spectral embedding.

14. The method of claim 1, wherein the communication has an associated direction, and wherein each of the spectral embedding vectors is computed using directed adjacency spectral embeddings obtained by singular value decomposition.

15. The method of claim 1, wherein the spectral embedding vector is computed using Laplacian spectral embedding.

16. A system comprising: Hardware processing circuitry; One or more hardware memories, the one or more hardware memories storing instructions, which, when executed, configure the hardware processing circuitry to perform operations, the operations including: A time series of adjacency matrices is generated, the time series of which corresponds to network communication between devices within a network monitored over multiple time intervals, the multiple time intervals including a second time interval and multiple first time intervals; Based on the adjacency matrix associated with the first time interval, a spectral embedding vector is calculated by spectral decomposition based on eigenvalues ​​and eigenvectors, and each spectral embedding vector is associated with one of the devices. Based on the paired spectral embedding vectors, the estimated probability of network communication between the corresponding pairs of devices is calculated; The estimated probability is compared with the adjacency matrix associated with the second time interval, according to the anomaly criteria that define abnormal network behavior. Based on the comparison, at least one device associated with the anomalous network behavior is identified; and The output is generated based on the identified at least one device.

17. The system of claim 16, wherein calculating the spectral embedding vector based on the adjacency matrix associated with the first time interval comprises: The time series of the weighted matrix is ​​calculated based on the adjacency matrix associated with the first time interval; Based on the time series of the weighted matrix, calculate the weighted average of the adjacency matrix associated with the first time interval; and The spectral embedding vector is calculated based on the spectral decomposition of the eigenvalues ​​and eigenvectors of the adjacency matrix associated with the first time interval, which are weighted averages.

18. The system according to claim 16, Calculating the spectral embedding vector based on the adjacency matrix associated with the first time interval includes calculating a time series of spectral embeddings, each spectral embedding including a spectral embedding vector associated with the device; and The calculation of the estimated probability includes: The time series of each link score matrix is ​​calculated based on the time series of the spectral embedding, and the entries of each link score matrix are based on the pairwise spectral embedding vectors of the respective spectral embedding. The time series of the weighted matrix is ​​calculated based on the time series of the link score matrix; and The link score matrix is ​​calculated as a weighted average based on the time series of the weighted matrix, wherein the entries in the weighted average correspond to the estimated probabilities of network communication between pairs of the devices.

19. The system according to claim 16, Calculating the spectral embedding vector based on the adjacency matrix associated with the first time interval includes: The time series of the COSIE correction matrix and multiple spectral embedding vectors associated with the device are calculated by multi-neighbor spectral embedding based on the adjacency matrix associated with the first time interval. and The calculation of the estimated probability includes: The predicted COSIE correction matrix is ​​calculated based on the time series of the COSIE correction matrix, and each element of the predicted COSIE correction matrix is ​​based on an independent model of the corresponding element of the time series of the COSIE correction matrix. as well as The estimated probability is calculated based on the pair of spectral embedding vectors, using the predicted COSIE correction matrix.

20. A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium comprising instructions, which, when executed, configure hardware processing circuitry to perform an operation, the operation comprising: A time series of adjacency matrices is generated, the time series of which corresponds to communication between multiple devices in a network monitored over multiple time intervals, the multiple time intervals including a second time interval and multiple first time intervals; Based on the adjacency matrix associated with the first time interval, a spectral embedding vector is calculated by spectral decomposition based on eigenvalues ​​and eigenvectors, and each spectral embedding vector is associated with one of the devices. Based on the paired spectral embedding vectors, the estimated probability of network communication between the corresponding pairs of devices is calculated; The estimated probability is compared with the adjacency matrix associated with the second time interval, according to the anomaly criteria that define abnormal network behavior. Based on the comparison, at least one device associated with the anomalous network behavior is identified; as well as The output is generated based on the identified at least one device.

Images