System, method and computer program product for network anomaly detection

Abstract

The present invention provides a system, method and computer program product for network anomaly detection. The method includes receiving event data associated with multiple events in a computer network. The method also includes determining a nested group of event data representing a hierarchy of operation levels. The method also includes generating display data to display a graphical representation of the event, the graphical representation including multiple nested graphical nodes and at least one spline. Each graphical node is associated with a group or a computer node, each graphical node covers another graphical node and / or is covered by another graphical node, the size of each graphical node is proportional to the aggregate parameter value of the event associated with it, each spline connects at least two graphical nodes and includes a curve passing through a common graphical node, and each spline is associated with communication between at least two computer nodes.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. patent application No. 17 / 230,166, filed on April 14, 2021, the disclosure of which is hereby incorporated by reference in its entirety. Technical Field

[0003] The present disclosure relates generally to computer network security and, in non-limiting embodiments or aspects, to systems, methods, and computer program products for computer network communication anomaly detection and response. Background Art

[0004] As the complexity of computer networks increases, the complexity of identifying abnormal activity therein also increases. For example, if a network failure or malicious activity generates abnormal communication activity for one or more groups of nodes in a large-scale network, it may be difficult to identify and correct the potential problem in a timely manner. Every second required to identify abnormal activity in a network may waste computer resources. Processing power, computer memory, and communication bandwidth can be consumed by abnormal activity within the network. In addition, the device relationships within a large-scale network can be huge and challenging for technicians and / or management systems to detect abnormal activity.

[0005] There is a need in the art for a solution that prominently represents computer networks and the activities therein, such that relationships within the network and local characteristics of network components can be displayed and analyzed. There is also a need for a tool that accurately and intuitively represents network activity so that anomalous activity can be easily detected and corrected by users and / or monitoring systems. Summary of the invention

[0006] Accordingly, improved systems, methods, and computer program products for network anomaly detection are provided.

[0007] According to non-limiting embodiments or aspects, a method for network anomaly detection is provided. The method may include receiving, with at least one processor, event data associated with a plurality of events in a computer network during a sampling period. The event data may include an aggregatable parameter, and each of the plurality of events may include communications between at least two network computer nodes in a plurality of computer nodes in the computer network. The method may also include determining, with at least one processor, a plurality of nested groups of the event data. The lowest-order group in the plurality of nested groups may include a group of at least one computer node in the plurality of computer nodes. Each group in the plurality of nested groups having a higher order than the lowest-order group may include at least one other group in the plurality of nested groups nested therein. The method may also include generating, with at least one processor, display data configured to cause a display of a computing device to display a first graphical representation of the event data. The first graphical representation may include a plurality of nested graphical nodes and at least one spline. Each of the plurality of nested graphical nodes may be associated with a group in the plurality of nested groups or a computer node in the plurality of computer nodes. Each of the plurality of nested graphical nodes may encompass another graphical node in the plurality of nested graphical nodes and / or may be encompassed by another graphical node in the plurality of nested graphical nodes. The size of each of the plurality of nested graph nodes may be proportional to the aggregate value of the aggregatable parameter of each event associated with the computer node associated with the graph node or associated with a plurality of computer nodes included in the group associated with the graph node. Each of the at least one spline may have endpoints including a pair of graph nodes in the plurality of nested graph nodes and may include a curve generated by a path passing through a common graph node encompassing each of the pair of graph nodes. Each of the at least one spline may be associated with a communication between at least two of the plurality of computer nodes.

[0008] In some non-limiting embodiments or aspects, the plurality of events may include a plurality of transactions, the computer network may include an electronic payment processing network, the event data may include transaction data associated with the plurality of transactions, and the aggregatable parameter may include a transaction value. Each of the plurality of computer nodes may include a computing device configured to manage transactions to and from at least one transaction account.

[0009] In some non-limiting embodiments or aspects, the method may include receiving, with at least one processor, an identification of an anomalous graph node in the plurality of nested graph nodes from a user interface of the computing device. The method may also include rejecting, with at least one processor, at least one transaction between computer nodes in one of a plurality of nested groups associated with the anomalous graph node or associated with a graph node encompassing the anomalous graph node during a time period after the sampling time period.

[0010] In some non-limiting embodiments or aspects, the method may include rejecting all ongoing transactions between computer nodes in a set of a plurality of nested groups associated with the anomalous graph node or associated with a graph node encompassing the anomalous graph node.

[0011] In some non-limiting embodiments or aspects, the method may include determining, with at least one processor, the identification of an abnormal graph node based on a size of the abnormal graph node satisfying a threshold relative to an average size of graph nodes associated with the same group associated with the abnormal graph node.

[0012] In some non-limiting embodiments or aspects, the method may include using at least one processor to determine the identification of an abnormal graph node based on the size of the abnormal graph node generated by the event data within the sampling time period satisfying a threshold relative to an average size of the abnormal graph node generated by event data within multiple previous time periods.

[0013] In some non-limiting embodiments or aspects, the method may include receiving, with at least one processor, new event data associated with a plurality of new events in the computer network in a subsequent time period after the sampling time period. The method may also include generating, with at least one processor, new display data configured to cause a display of the computing device to display a new graphical representation of the new event data. The new graphical representation may be displayed using the same set of graphical parameters as the first graphical representation. The new graphical representation may be displayed in chronological order relative to the first graphical representation. The method may also include receiving, with at least one processor, an identification of an abnormal graphical node in the new graphical representation from a user interface of the computing device, wherein the identification is determined based on an increase in the size of the abnormal graphical node in the new graphical representation relative to the first graphical representation. The method may also include rejecting, with at least one processor, at least one transaction between computer nodes in a group of a plurality of nested groups associated with the abnormal graphical node or associated with a graphical node covering the abnormal graphical node.

[0014] According to non-limiting embodiments or aspects, a system for network anomaly detection is provided. The system may include a server, the server including at least one processor. The server may be programmed and / or configured to receive event data associated with multiple events in a computer network within a sampling time period. The event data may include aggregatable parameters, and each of the multiple events may include communications between at least two network computer nodes in a plurality of computer nodes in the computer network. The server may also be programmed and / or configured to determine multiple nested groups of the event data. The lowest order group in the multiple nested groups may include a group of at least one computer node in the multiple computer nodes. Each group in the multiple nested groups having a higher order than the lowest order group may include at least one other group in the multiple nested groups nested therein. The server may also be programmed and / or configured to generate display data, the display data being configured to cause a display of a computing device to display a first graphical representation of the event data. The first graphical representation may include multiple nested graphical nodes and at least one spline. Each graphical node in the multiple nested graphical nodes may be associated with a group in the multiple nested groups or a computer node in the multiple computer nodes. Each of the plurality of nested graph nodes may encompass another graph node in the plurality of nested graph nodes and / or may be encompassed by another graph node in the plurality of nested graph nodes. The size of each of the plurality of nested graph nodes may be proportional to the aggregated value of the aggregatable parameter of each event, each event being associated with a computer node associated with the graph node or associated with a plurality of computer nodes included in a group associated with the graph node. Each of the at least one spline may have endpoints including a pair of graph nodes in the plurality of nested graph nodes, and may include a curve generated by a path passing through a common graph node encompassing each of the pair of graph nodes. Each of the at least one spline may be associated with a communication between at least two of the plurality of computer nodes.

[0015] In some non-limiting embodiments or aspects, the plurality of events may include a plurality of transactions, the computer network may include an electronic payment processing network, the event data may include transaction data associated with the plurality of transactions, and the aggregatable parameters may include transaction values.

[0016] In some non-limiting embodiments or aspects, the server may also be programmed and / or configured to receive an identification of an abnormal graph node in the plurality of nested graph nodes from a user interface of the computing device. The server may also be programmed and / or configured to reject at least one transaction between computer nodes in a group of a plurality of nested groups associated with the abnormal graph node or associated with a graph node covering the abnormal graph node within a time period after the sampling time period.

[0017] In some non-limiting embodiments or aspects, the server may also be programmed and / or configured to determine the identification of the abnormal graph node based on the size of the abnormal graph node satisfying a threshold relative to an average size of graph nodes associated with the same group associated with the abnormal graph node.

[0018] In some non-limiting embodiments or aspects, the server is also programmed and / or configured to determine the identification of the abnormal graph node based on the size of the abnormal graph node generated by the event data within the sampling time period relative to the average size of the abnormal graph nodes generated by the event data within multiple previous time periods satisfying a threshold.

[0019] In some non-limiting embodiments or aspects, the server is also programmed and / or configured to receive new event data associated with a plurality of new events in the computer network in a subsequent time period after the sampling time period. The server may also be programmed and / or configured to generate new display data, which is configured to cause the display of the computing device to display a new graphical representation of the new event data. The new graphical representation may be displayed using the same set of graphical parameters as the first graphical representation. The new graphical representation may be displayed in chronological order relative to the first graphical representation. The server may also be programmed and / or configured to receive an identification of an abnormal graphical node in the new graphical representation from a user interface of the computing device. The identification may be determined based on an increase in the size of the abnormal graphical node in the new graphical representation relative to the first graphical representation. The server may also be programmed and / or configured to reject at least one transaction between computer nodes in a group of a plurality of nested groups associated with the abnormal graphical node or associated with a graphical node covering the abnormal graphical node.

[0020] According to some non-limiting embodiments or aspects, a computer program product for network anomaly detection is provided. The computer program product may include at least one non-transitory computer-readable medium, the at least one non-transitory computer-readable medium including program instructions, the program instructions when executed by at least one processor causing the at least one processor to receive event data associated with a plurality of events in a computer network within a sampling time period. The event data may include aggregatable parameters, and each of the plurality of events may include communications between at least two network computer nodes in a plurality of computer nodes in the computer network. The program instructions may also cause the at least one processor to determine a plurality of nested groups of the event data. The lowest-order group in the plurality of nested groups may include a group of at least one computer node in the plurality of computer nodes. Each group in the plurality of nested groups having a higher order than the lowest-order group may include at least one other group in the plurality of nested groups nested therein. The program instructions may also cause the at least one processor to generate display data, the display data being configured to cause a display of a computing device to display a first graphical representation of the event data. The first graphical representation may include a plurality of nested graphical nodes and at least one spline. Each of the plurality of nested graphical nodes may be associated with a group in the plurality of nested groups or a computer node in the plurality of computer nodes. Each of the plurality of nested graph nodes may encompass another graph node in the plurality of nested graph nodes and / or may be encompassed by another graph node in the plurality of nested graph nodes. The size of each of the plurality of nested graph nodes may be proportional to the aggregated value of the aggregatable parameter of each event, each event being associated with a computer node associated with the graph node or associated with a plurality of computer nodes included in a group associated with the graph node. Each of the at least one spline may have endpoints including a pair of graph nodes in the plurality of nested graph nodes, and may include a curve generated by a path passing through a common graph node encompassing each of the pair of graph nodes. Each of the at least one spline may be associated with a communication between at least two of the plurality of computer nodes.

[0021] In some non-limiting embodiments or aspects, the plurality of events may include a plurality of transactions, the computer network may include an electronic payment processing network, the event data may include transaction data associated with the plurality of transactions, and the aggregatable parameters may include transaction values.

[0022] In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to receive, from a user interface of the computing device, an identification of an abnormal graph node in the plurality of nested graph nodes. The program instructions may further cause the at least one processor to reject, within a time period after the sampling time period, at least one transaction between computer nodes in a group of a plurality of nested groups associated with the abnormal graph node or associated with a graph node encompassing the abnormal graph node.

[0023] In some non-limiting embodiments or aspects, the program instructions may also cause the at least one processor to determine the identification of an abnormal graph node based on a size of the abnormal graph node satisfying a threshold relative to an average size of graph nodes associated with the same group associated with the abnormal graph node.

[0024] In some non-limiting embodiments or aspects, the program instructions may also cause the at least one processor to determine the identification of an abnormal graph node based on the size of the abnormal graph node generated by the event data within the sampling time period relative to the average size of the abnormal graph node generated by the event data within multiple previous time periods satisfying a threshold.

[0025] In some non-limiting embodiments or aspects, the program instructions may also cause the at least one processor to receive new event data associated with a plurality of new events in the computer network in a subsequent time period after the sampling time period. The program instructions may also cause the at least one processor to generate new display data, the new display data being configured to cause the display of the computing device to display a new graphical representation of the new event data. The new graphical representation may be displayed using the same set of graphical parameters as the first graphical representation. The new graphical representation may be displayed in chronological order relative to the first graphical representation. The program instructions may also cause the at least one processor to receive an identification of an abnormal graphical node in the new graphical representation from a user interface of the computing device. The identification may be determined based on an increase in the size of the abnormal graphical node in the new graphical representation relative to the first graphical representation. The program instructions may also cause the at least one processor to reject at least one transaction between computer nodes in a group of a plurality of nested groups associated with the abnormal graphical node or associated with a graphical node covering the abnormal graphical node.

[0026] Other non-limiting embodiments or aspects are set forth in the following numbered clauses:

[0027] Clause 1: A computer-implemented method comprising: receiving, with at least one processor, event data associated with a plurality of events in a computer network during a sampling time period, the event data comprising aggregatable parameters, and each of the plurality of events comprising communications between at least two of a plurality of computer nodes in the computer network; determining, with at least one processor, a plurality of nested groups of the event data, wherein a lowest-order group in the plurality of nested groups comprises a group of at least one of the plurality of computer nodes, and wherein each group in the plurality of nested groups having a higher order than the lowest-order group comprises at least one other group of the plurality of nested groups nested therein; and generating, with at least one processor, display data configured to cause a display of a computing device to show a first graphical representation of the event data, the first graphical representation comprising a plurality of nested graphical nodes and at least one spline; wherein the plurality of nested graphical nodes Each graph node in is associated with a group of the plurality of nested groups or a computer node of the plurality of computer nodes, each graph node in the plurality of nested graph nodes encompasses another graph node in the plurality of nested graph nodes and / or is encompassed by another graph node in the plurality of nested graph nodes, the size of each graph node in the plurality of nested graph nodes is proportional to the aggregate value of an aggregatable parameter of each event, each event is associated with a computer node associated with the graph node or with a plurality of computer nodes consisting of a group associated with the graph nodes, each spline in the at least one spline has endpoints including a pair of graph nodes in the plurality of nested graph nodes and includes a curve generated by a path passing through a common graph node encompassing each graph node in the pair of graph nodes, and wherein each spline in the at least one spline is associated with communication between at least two computer nodes in the plurality of computer nodes.

[0028] Clause 2: The method of clause 1, wherein the plurality of events comprises a plurality of transactions, the computer network comprises an electronic payment processing network, the event data comprises transaction data associated with the plurality of transactions, and the aggregatable parameters comprise transaction values.

[0029] Clause 3: The method of clause 1 or 2, wherein each computer node of the plurality of computer nodes comprises a computing device configured to manage transactions to and from at least one transaction account.

[0030] Clause 4: The method according to any one of clauses 1-3 further includes: receiving, with at least one processor, an identification of an abnormal graph node among the multiple nested graph nodes from a user interface of the computing device; and rejecting, with at least one processor, at least one transaction between computer nodes in one of the multiple nested groups associated with the abnormal graph node or associated with graph nodes covering the abnormal graph node within a time period after the sampling time period.

[0031] Clause 5: The method of any one of clauses 1-4, further comprising rejecting all ongoing transactions between computer nodes in a set of a plurality of nested groups associated with the anomalous graph node or associated with a graph node encompassing the anomalous graph node.

[0032] Clause 6: The method according to any one of clauses 1-5 further includes using at least one processor to determine the identification of the abnormal graph node based on the size of the abnormal graph node satisfying a threshold relative to the average size of graph nodes associated with the same group associated with the abnormal graph node.

[0033] Clause 7: The method of any one of clauses 1-6 also includes using at least one processor to determine the identification of the abnormal graph node based on the size of the abnormal graph node generated by the event data within the sampling time period relative to the average size of the abnormal graph node generated by the event data within multiple previous time periods satisfying a threshold.

[0034] Clause 8: The method according to any one of clauses 1-7 further includes: receiving, with at least one processor, new event data associated with multiple new events in the computer network in a subsequent time period after the sampling time period; generating, with at least one processor, new display data, wherein the new display data is configured to cause the display of the computing device to show a new graphical representation of the new event data, wherein the new graphical representation is displayed using the same set of graphical parameters as the first graphical representation, and wherein the new graphical representation is displayed in chronological order relative to the first graphical representation; receiving, with at least one processor, an identification of an abnormal graphical node in the new graphical representation from a user interface of the computing device, wherein the identification is determined based on an increase in the size of the abnormal graphical node in the new graphical representation relative to the first graphical representation; and rejecting, with at least one processor, at least one transaction between computer nodes in a group of multiple nested groups associated with the abnormal graphical node or associated with graphical nodes covering the abnormal graphical node.

[0035] Clause 9: A system comprising a server, the server comprising at least one processor, the server being programmed and / or configured to: receive event data associated with a plurality of events in a computer network during a sampling time period, the event data comprising aggregatable parameters, and each of the plurality of events comprising communications between at least two of a plurality of computer nodes in the computer network; determine a plurality of nested groups of the event data, wherein a lowest-order group of the plurality of nested groups comprises a group of at least one of the plurality of computer nodes, and wherein each group of the plurality of nested groups having a higher order than the lowest-order group comprises at least one other group of the plurality of nested groups nested therein; and generate display data, the display data being configured to cause a display of a computing device to show a first graphical representation of the event data, the first graphical representation comprising a plurality of nested graphical nodes and at least one spline; wherein the plurality of nested graphical nodes are nested in a plurality of nested graphical nodes; Each of the graph nodes is associated with a group of the plurality of nested groups or a computer node of the plurality of computer nodes, each of the plurality of nested graph nodes encompasses another graph node of the plurality of nested graph nodes and / or is encompassed by another graph node of the plurality of nested graph nodes, the size of each of the plurality of nested graph nodes is proportional to the aggregate value of an aggregatable parameter of each event, each event is associated with a computer node associated with the graph node or with a plurality of computer nodes consisting of a group associated with the graph nodes, each of the at least one spline has endpoints including a pair of graph nodes of the plurality of nested graph nodes and includes a curve generated by a path passing through a common graph node encompassing each of the pair of graph nodes, and each of the at least one spline is associated with communication between at least two computer nodes of the plurality of computer nodes.

[0036] Clause 10: The system of clause 9, wherein the plurality of events comprises a plurality of transactions, the computer network comprises an electronic payment processing network, the event data comprises transaction data associated with the plurality of transactions, and the aggregatable parameters comprise transaction values.

[0037] Clause 11: A system according to clause 9 or 10, wherein the server is further programmed and / or configured to: receive an identification of an abnormal graph node among the multiple nested graph nodes from a user interface of the computing device; and reject at least one transaction between computer nodes in a group of multiple nested groups associated with the abnormal graph node or associated with graph nodes covering the abnormal graph node within a time period after the sampling time period.

[0038] Clause 12: A system according to any one of clauses 9-11, wherein the server is further programmed and / or configured to determine the identification of the abnormal graph node based on the size of the abnormal graph node satisfying a threshold relative to the average size of graph nodes associated with the same group associated with the abnormal graph node.

[0039] Clause 13: A system according to any one of clauses 9-12, wherein the server is further programmed and / or configured to determine the identification of the abnormal graph node based on the size of the abnormal graph node generated by the event data within the sampling time period relative to the average size of the abnormal graph node generated by the event data within multiple previous time periods satisfying a threshold.

[0040] Clause 14: A system according to any one of clauses 9-13, wherein the server is further programmed and / or configured to: receive new event data associated with multiple new events in the computer network in a subsequent time period after the sampling time period; generate new display data, wherein the new display data is configured to cause the display of the computing device to display a new graphical representation of the new event data, wherein the new graphical representation is displayed using the same set of graphical parameters as the first graphical representation, and wherein the new graphical representation is displayed in chronological order relative to the first graphical representation; receive an identification of an abnormal graphical node in the new graphical representation from a user interface of the computing device, wherein the identification is determined based on an increase in the size of the abnormal graphical node in the new graphical representation relative to the first graphical representation; and reject at least one transaction between computer nodes in a group of multiple nested groups associated with the abnormal graphical node or with graphical nodes covering the abnormal graphical node.

[0041] Clause 15: A computer program product comprising at least one non-transitory computer-readable medium, the at least one non-transitory computer-readable medium comprising program instructions, the program instructions, when executed by at least one processor, causing the at least one processor to: receive event data associated with a plurality of events in a computer network over a sampling time period, the event data comprising aggregatable parameters, and each event in the plurality of events comprising communications between at least two network computer nodes in a plurality of computer nodes in the computer network; determine a plurality of nested groups of the event data, wherein a lowest-order group in the plurality of nested groups comprises a group of at least one computer node in the plurality of computer nodes, and wherein each group in the plurality of nested groups having a higher order than the lowest-order group comprises at least one other group in the plurality of nested groups nested therein; and generate display data, the display data being configured to cause a display of a computing device to display a first graphical representation of the event data, the first graphical representation comprising a plurality of nested graphics a node and at least one spline; wherein each of the plurality of nested graph nodes is associated with a group of the plurality of nested groups or a computer node of the plurality of computer nodes, each of the plurality of nested graph nodes encompasses another graph node of the plurality of nested graph nodes and / or is encompassed by another graph node of the plurality of nested graph nodes, the size of each of the plurality of nested graph nodes is proportional to the aggregate value of an aggregatable parameter of each event, each event is associated with a computer node associated with the graph node or with a plurality of computer nodes consisting of a group associated with the graph nodes, each of the at least one spline has endpoints including a pair of graph nodes of the plurality of nested graph nodes, and includes a curve generated by a path passing through a common graph node encompassing each of the pair of graph nodes, and each of the at least one spline is associated with communication between at least two of the plurality of computer nodes.

[0042] Clause 16: A computer program product according to clause 15, wherein the plurality of events comprises a plurality of transactions, the computer network comprises an electronic payment processing network, the event data comprises transaction data associated with the plurality of transactions, and the aggregatable parameters comprise transaction values.

[0043] Clause 17: A computer program product according to clause 15 or 16, wherein the program instructions further cause the at least one processor to: receive an identification of an abnormal graph node among the multiple nested graph nodes from a user interface of the computing device; and reject at least one transaction between computer nodes in a group of multiple nested groups associated with the abnormal graph node or associated with graph nodes covering the abnormal graph node within a time period after the sampling time period.

[0044] Clause 18: A computer program product according to any one of clauses 15-17, wherein the program instructions further cause the at least one processor to determine the identification of the abnormal graph node based on the size of the abnormal graph node satisfying a threshold relative to the average size of graph nodes associated with the same group associated with the abnormal graph node.

[0045] Clause 19: A computer program product according to any one of clauses 15-18, wherein the program instructions further cause the at least one processor to determine the identification of the abnormal graph node based on the size of the abnormal graph node generated by the event data within the sampling time period satisfying a threshold relative to the average size of the abnormal graph node generated by the event data within multiple previous time periods.

[0046] Clause 20: A computer program product according to any one of clauses 15-19, wherein the program instructions further cause the at least one processor to: receive new event data associated with multiple new events in the computer network in a subsequent time period after the sampling time period; generate new display data, wherein the new display data is configured to cause the display of the computing device to display a new graphical representation of the new event data, wherein the new graphical representation is displayed using the same set of graphical parameters as the first graphical representation, and wherein the new graphical representation is displayed in chronological order relative to the first graphical representation; receive an identification of an abnormal graphical node in the new graphical representation from a user interface of the computing device, wherein the identification is determined based on an increase in the size of the abnormal graphical node in the new graphical representation relative to the first graphical representation; and reject at least one transaction between computer nodes in a group of multiple nested groups associated with the abnormal graphical node or with graphical nodes covering the abnormal graphical node.

[0047] These and other features and characteristics of the present disclosure, as well as methods of operation and functions of combinations of related structural elements and parts, and economies of manufacturing will become more apparent when considering the following description and the appended claims with reference to the accompanying drawings, all of which form a part of this specification, wherein like reference numerals indicate corresponding parts in the various figures. However, it is to be expressly understood that the drawings are for illustration and description purposes only and are not intended to be used as definitions of limitations of the present disclosure. Unless the context clearly dictates otherwise, when used in this specification and claims, the singular forms "a", "an", and "the" include plural referents. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Additional advantages and details of the present disclosure are explained in more detail below with reference to exemplary embodiments or aspects shown in the attached schematic drawings, in which:

[0049] Figure 1 are diagrams of non-limiting embodiments or aspects of networks on which the systems, devices, and / or methods described herein may be implemented;

[0050] Figure 2 are diagrams of non-limiting embodiments or aspects of environments in which the systems, devices, and / or methods described herein may be implemented;

[0051] Figure 3 is used in Figure 2 Figures of non-limiting embodiments or aspects of computing devices deployed in an environment;

[0052] Figure 4 is a flow chart illustrating a non-limiting embodiment or aspect of a method for network anomaly detection according to the principles of the present disclosure;

[0053] Figure 5 is a flow chart illustrating a non-limiting embodiment or aspect of a method for network anomaly detection according to the principles of the present disclosure;

[0054] Figure 6 is a step-by-step diagram illustrating generation of a graphical representation of event data according to a non-limiting embodiment or aspect of a method for network anomaly detection according to the principles of the present disclosure;

[0055] Figure 7 is a diagram illustrating generation of a graphical representation of event data (including splines) according to a non-limiting embodiment or aspect of a method for network anomaly detection according to the principles of the present disclosure;

[0056] Figure 8 is a diagram illustrating generation of a graphical representation of event data (including a plurality of splines) according to a non-limiting embodiment or aspect of a method for network anomaly detection according to the principles of the present disclosure;

[0057] Fig. 9 is an exemplary illustration of a graphical representation of event data for a large-scale network without abnormal activity according to a non-limiting embodiment or aspect of a method for network anomaly detection in accordance with the principles of the present disclosure;

[0058] Fig.10 is an exemplary illustration of a graphical representation of event data of a large-scale network with abnormal activity according to a non-limiting embodiment or aspect of a method for network anomaly detection in accordance with the principles of the present disclosure; and

[0059] Fig.11 is an exemplary illustration of a user interface for displaying a graphical representation of event data according to a non-limiting embodiment or aspect of a method for network anomaly detection in accordance with the principles of the present disclosure. DETAILED DESCRIPTION

[0060] For the purpose of description below, the terms "end", "upper", "lower", "right", "left", "vertical", "horizontal", "top", "bottom", "lateral", "longitudinal" and their derivatives shall refer to the present disclosure as it is oriented in the accompanying drawings. However, it should be understood that the present disclosure may adopt various alternative variations and step sequences, unless expressly specified to the contrary. It should also be understood that the specific devices and processes illustrated in the drawings and described in the following description are merely exemplary embodiments or aspects of the present disclosure. Therefore, unless otherwise indicated, specific dimensions and other physical characteristics associated with the embodiments or aspects of the embodiments disclosed herein should not be considered as limiting.

[0061] The aspects, parts, elements, structures, actions, steps, functions, instructions, etc. used herein should not be understood as critical or necessary unless explicitly described as such. Also, as used herein, the article "one" is intended to include one or more items, and can be used interchangeably with "one or more" and "at least one". In addition, as used herein, the term "set" is intended to include one or more items (e.g., related items, unrelated items, a combination of related items and unrelated items, etc.), and can be used interchangeably with "one or more" or "at least one". In the case of wishing only one item, the term "one" or similar language is used. Also, as used herein, the term "having" etc. is intended to be an open term. In addition, unless otherwise explicitly stated, the phrase "based on" is intended to mean "based at least in part on".

[0062] As used herein, the terms "communication" and "communication" may refer to the reception, admission, transmission, transfer, provisioning, etc. of information (e.g., data, signals, messages, instructions, commands, etc.). A unit (e.g., a device, a system, a component of a device or system, a combination thereof, etc.) communicating with another unit means that the unit is able to directly or indirectly receive information from the other unit and / or pass (e.g., send) information to the other unit. This may refer to a direct or indirect connection that is wired and / or wireless in nature. In addition, the two units may communicate with each other even if the information sent may be modified, processed, relayed, and / or routed between the first unit and the second unit. For example, even if the first unit passively receives information and does not actively send information to the second unit, the first unit may communicate with the second unit. As another example, if at least one intermediate unit (e.g., a third unit located between the first unit and the second unit) processes the information received from the first unit and sends the processed information to the second unit, the first unit may communicate with the second unit. In some non-limiting embodiments or aspects, a message may refer to a network packet (e.g., a data packet, etc.) including data.

[0063] As used herein, the terms "issuer," "issuer institution," "issuer bank," or "payment device issuer" may refer to one or more entities that provide an individual (e.g., a user, customer, etc.) with an account for conducting payment transactions, such as credit payment transactions and / or debit payment transactions. For example, an issuer institution may provide a customer with an account identifier, such as a primary account number (PAN), that uniquely identifies one or more accounts associated with the customer. In some non-limiting embodiments or aspects, an issuer may be associated with a bank identification number (BIN) that uniquely identifies the issuer institution. As used herein, an "issuer system" may refer to one or more computer systems operated by or on behalf of an issuer, such as a server that executes one or more software applications. For example, an issuer system may include one or more authorization servers for authorizing transactions.

[0064] As used herein, the term "account identifier" may include one or more types of identifiers associated with an account (e.g., a PAN associated with an account, a card number associated with an account, a payment card number associated with an account, a token associated with an account, etc.). In some non-limiting embodiments or aspects, an issuer may provide an account identifier (e.g., a PAN, a token, etc.) to a user (e.g., an account holder), the account identifier uniquely identifying one or more accounts associated with the user. The account identifier may be embodied on a payment device (e.g., a physical instrument used to conduct a payment transaction, such as a payment card, a credit card, a debit card, a gift card, etc.), and / or may be electronic information transmitted to a user, which the user may use for an electronic payment transaction. In some non-limiting embodiments or aspects, the account identifier may be an original account identifier, which is provided to the user when the account associated with the account identifier is created. In some non-limiting embodiments or aspects, the account identifier may be a supplemental account identifier, which may include an account identifier provided to the user after the original account identifier is provided to the user. For example, if the original account identifier is forgotten, stolen, etc., the supplemental account identifier may be provided to the user. In some non-limiting embodiments or aspects, the account identifier may be directly or indirectly associated with an issuer organization, such that the account identifier may be a token mapped to a PAN or other type of account identifier. The account identifier may be any combination of alphanumeric characters, characters, and / or symbols, etc.

[0065] As used herein, the term "merchant" may refer to one or more entities (e.g., operators of retail businesses) that provide goods, services, and / or access to goods and / or services to users (e.g., clients, customers, etc.) based on transactions such as payment transactions. As used herein, the term "merchant system" may refer to one or more computer systems operated by or on behalf of a merchant, such as a server executing one or more software applications. As used herein, the term "product" may refer to one or more goods and / or services provided by a merchant.

[0066] As used herein, the term "point of sale (POS) device" may refer to one or more electronic devices, such as a transaction terminal, that can be used by a merchant to initiate a transaction (e.g., a payment transaction). POS devices may include peripheral devices, card readers, scanning devices (e.g., code scanners, etc.), Communication receiver, near field communication (NFC) receiver, radio frequency identification (RFID) receiver and / or other contactless transceiver or receiver, contact-based receiver, payment terminal, etc. As used herein, the term "point of sale (POS) system" may refer to one or more client devices and / or peripheral devices used by merchants to conduct transactions. For example, a POS system may include one or more POS devices, and / or other similar devices that can be used to conduct payment transactions. In some non-limiting embodiments or aspects, a POS system (e.g., a merchant POS system) may include one or more server computers programmed or configured to process online payment transactions through web pages, mobile applications, etc.

[0067] As used herein, the term "transaction service provider" may refer to an entity that receives transaction authorization requests from merchants or other entities and, in some cases, provides payment assurance through an agreement between the transaction service provider and an issuer organization. In some non-limiting embodiments or aspects, the transaction service provider may include a credit card company, a debit card company, e.g. , or any other entity that processes transactions. As used herein, the term "transaction processing system" may refer to one or more computer systems operated by or on behalf of a transaction service provider, such as a transaction processing system that executes one or more software applications. A transaction processing system may include one or more processors, and in some non-limiting embodiments or aspects may be operated by or on behalf of a transaction service provider. A transaction processing system may process transactions in a payment transaction processing network, which may include one or more merchant systems, acquirer systems, issuer systems, payment gateways, and the like.

[0068] As used herein, the term "computing device" may refer to one or more electronic devices configured to process data. In some examples, a computing device may include the necessary components to receive, process, and output data, such as a processor, a display, a memory, an input device, a network interface, etc. A computing device may be a mobile device. As an example, a mobile device may include a cellular phone (e.g., a smartphone or a standard cellular phone), a portable computer, a wearable device (e.g., a watch, glasses, lenses, clothing, etc.), a personal digital assistant (PDA), and / or other similar devices. A computing device may also be a desktop computer or other form of non-mobile computer.

[0069] As used herein, the term "server" may refer to or include one or more computing devices operated by or facilitating communications and processing by multiple parties in a network environment such as the Internet, but it should be understood that communications may be facilitated through one or more public or private network environments, and that there may be various other arrangements. In addition, multiple computing devices (e.g., servers, POS devices, mobile devices, etc.) that communicate directly or indirectly in a network environment may constitute a "system." As used herein, references to "servers" or "processors" may refer to previously described servers and / or processors, different servers and / or processors, and / or combinations of servers and / or processors that are stated to implement previous steps or functions. For example, as used in the specification and claims, a first server and / or first processor stated to perform a first step or function may refer to the same or different servers and / or processors stated to perform a second step or function.

[0070] As used herein, the term "acquirer" may refer to an entity that is licensed by a transaction service provider and approved by a transaction service provider to initiate a transaction (e.g., a payment transaction) involving a payment device associated with a transaction service provider. As used herein, the term "acquirer system" may also refer to one or more computer systems, computer devices, etc. operated by or on behalf of an acquirer. Transactions that an acquirer may initiate may include payment transactions (e.g., purchases, original credit transactions (OCTs), account funds transactions (AFTs), etc.). In some non-limiting embodiments or aspects, an acquirer may be authorized by a transaction service provider to sign a contract with a merchant or service provider to initiate a transaction involving a payment device associated with a transaction service provider. An acquirer may sign a contract with a payment service provider to enable the payment service provider to provide sponsorship to merchants. An acquirer may monitor the compliance of a payment service provider according to transaction service provider regulations. An acquirer may perform due diligence on a payment service provider and ensure that appropriate due diligence occurs before signing a contract with a sponsored merchant. An acquirer may be responsible for all transaction service provider programs operated or sponsored by an acquirer. An acquirer may be responsible for the actions of an acquirer payment facilitator, merchants sponsored by the acquirer payment facilitator, etc. In some non-limiting embodiments or aspects, the acquirer may be a financial institution, such as a bank.

[0071] As used herein, the terms "client" and "client device" may refer to one or more computing devices, such as processors, storage devices, and / or similar computer components that access services provided by a server. In some non-limiting embodiments or aspects, a "client device" may refer to one or more devices that facilitate payment transactions, such as a point of sale (POS) device and / or POS system used by a merchant. In some non-limiting embodiments or aspects, a client device may include an electronic device configured to communicate with one or more networks and / or facilitate payment transactions, such as but not limited to one or more desktop computers, one or more portable computers (e.g., tablet computers), one or more mobile devices (e.g., cellular phones, smart phones, PDAs, wearable devices, such as watches, glasses, lenses, and / or clothing, etc.), and the like. In addition, a "client" may also refer to an entity that owns, utilizes, and / or operates a client device to facilitate payment transactions with a transaction service provider, such as a merchant.

[0072] As used herein, the terms "electronic wallet," "electronic wallet mobile application," and "digital wallet" may refer to one or more electronic devices, including one or more software applications, configured to initiate and / or conduct transactions (e.g., payment transactions, electronic payment transactions, etc.). For example, an electronic wallet may include a user device (e.g., a mobile device) that executes an application and server-side software and / or databases for maintaining and providing data to the user device to be used during payment transactions. As used herein, the term "electronic wallet provider" may include an entity that provides and / or maintains an electronic wallet and / or electronic wallet mobile application for a user (e.g., a customer). Examples of electronic wallet providers include, but are not limited to and In some non-limiting examples, a financial institution (e.g., an issuer institution) may be an e-wallet provider. As used herein, the term "e-wallet provider system" may refer to one or more computer systems, computer devices, servers, server groups, etc. operated by or on behalf of an e-wallet provider.

[0073] As used herein, the term "payment device" may refer to an electronic payment device, a portable financial device, a payment card (e.g., a credit or debit card), a gift card, a smart card, smart media, a payroll card, a healthcare card, a wristband, a machine-readable medium containing account information, a key chain device or pendant, an RFID transponder, a retailer discount or membership card, etc. A payment device may include volatile or non-volatile memory to store information (e.g., an account identifier, the name of the account holder, etc.).

[0074] As used herein, the term "payment gateway" may refer to an entity and / or a payment processing system operated by or on behalf of such an entity (e.g., a merchant service provider, a payment service provider, a payment facilitator, a payment facilitator with a contract with an acquirer, a payment aggregator, etc.) that provides payment services (e.g., a transaction service provider payment service, a payment processing service, etc.) to one or more merchants. The payment service may be associated with the use of a portable financial device managed by a transaction service provider. As used herein, the term "payment gateway system" may refer to one or more computer systems, computer devices, servers, server groups, etc. operated by or on behalf of a payment gateway.

[0075] As used herein, the term "system" may refer to one or more computing devices or combinations of computing devices, such as, but not limited to, processors, servers, client devices, software applications, and / or other similar components. In addition, as used herein, references to "servers" or "processors" may refer to previously described servers and / or processors stated as performing a previous step or function, different servers and / or processors, and / or combinations of servers and / or processors. For example, as used in the specification and claims, a first server and / or first processor stated as performing a first step or function may refer to the same or different servers and / or processors stated as performing a second step or function.

[0076] As used herein, the term "token" may refer to an account identifier that is used as a substitute for or replaces another account identifier (e.g., PAN). A token may be associated with a PAN or another original account identifier in one or more data structures (e.g., one or more databases, etc.) so that the token can be used to conduct payment transactions without directly using the original account identifier. In some non-limiting embodiments or aspects, an original account identifier such as PAN may be associated with multiple tokens for different individuals or purposes. In some non-limiting embodiments or aspects, a token may be associated with a PAN or other account identifier in one or more data structures so that the token can be used to conduct transactions without directly using a PAN or other account identifier. In some examples, an account identifier such as PAN may be associated with multiple tokens for different uses or purposes.

[0077] Non-limiting embodiments or aspects of the present disclosure relate to systems, methods, and computer program products for network anomaly detection. The described systems and methods provide technical improvements for representing network devices and communication relationships, so that local characteristics can be easily determined even under high-level graphical representations of the network. By highlighting and improving aggregation of event data in a computer network, abnormal activities can be detected earlier and with greater accuracy. Abnormal activities (e.g., anomalies) can be situations that deviate from expected or historical network activities, so that system communications can be significantly changed compared to control. Anomalies may include, but are not limited to, network failures (e.g., hardware failures, software failures, etc.), malicious activities (e.g., fraudulent transactions, network attacks), or other violent coordinations beyond expectations between network devices. Anomalies associated with sudden increases in network activity can limit and consume processing power, computer memory, and communication bandwidth until they are corrected. In addition, network failures may be associated with loss of connectivity in certain areas of the network before full communication is restored. Because network resources can be managed based on expected network activities (e.g., number of servers, server uptime, bandwidth, open ports, etc.), abnormal activities can lead to reduced network operation efficiency before the anomaly is identified and resolved. The proposed system and method allow for more efficient network operations.

[0078] Reference Figure 1 , a diagram of a network 100 is shown according to a non-limiting embodiment or aspect of the present disclosure. The network 100 may include multiple computer nodes 102. Each computer node 102 may represent a computing device or multiple computing devices that are programmed and / or configured to communicate with one or more other computer nodes 102 in the network 100. As described herein, the network 100 and event data for events occurring in the network 100 may be grouped into multiple nested groups 104, 106, 108. As shown, one or more computer nodes 102 may be associated with each lowest order group 104. One or more lowest order groups 104 may be associated with each mid-order group 106. One or more mid-order groups 106 may be associated with each highest order group 108. It should be understood that the nested groups may have more than one nested group. Figure 1 . As used herein, "lowest order" may refer to a group that contains computer node 102 but not another group. As used herein, "mid-order" may refer to a group that contains one or more other groups (e.g., lowest order group 104) and is contained by one or more other groups (e.g., highest order group 108). As used herein, "highest order" may refer to a group that contains one or more other groups (e.g., mid-order group 106 containing lowest order group 104) but is not contained by another group. As used herein, "higher order" may refer to a group that is higher in level or grouping than another group, such as mid-order group 106 relative to lowest order group 104, or such as highest order group 108 relative to mid-order group 106 or lowest order group 104.

[0079] Each group 104, 106, 108 can be associated with a level of the operational hierarchy of the computer network. For example, the computer nodes 102 can be computing devices operated by users, the lowest order group 104 can include a local area network (LAN), the mid-order group 106 can include routers associated with multiple LANs, and the highest order group 108 can be associated with an Internet Service Provider (ISP) associated with multiple routers. It should be appreciated that the computer network can be modeled in various ways with various numbers of groups 104, 106, 108 depending on the operational paths and network layering hardware.

[0080] Additionally or alternatively, each group may be defined based on common characteristics between the groups 104, 106, 108 and / or the computer nodes 102 therein. For example, the computer nodes 102 or the groups 104, 106 grouped together may be associated with each other based on geographic location (e.g., grouped by country / region, city, etc.), function (e.g., grouped by type of network communication handled), entity (e.g., grouped by enterprise, financial institution, government, etc.), communication process flow (e.g., computing device, router, ISP, network provider (NSP)), etc.), etc.

[0081] In a non-limiting embodiment or aspect of an electronic payment processing network, each computer node 102 may represent a transaction account controlled by a computing device (e.g., an issuer system, an acquirer system, a financial institution system, etc.). Each transaction account may participate in one or more transactions, which may represent an event in the network 100. Multiple transaction accounts may be associated with a bank identification number (BIN). The lowest order group 104 may be associated with the BINs of multiple financial institutions. Multiple BINs may be associated with a bank identifier (BID). The mid-order group 106 may be associated with a BID in an automated teller machine (ATM) network. The highest order group 108 may be associated with an ATM network.

[0082] The same set of event data may be grouped according to different sets of parameters. For example, event data for an ATM network may be categorized from the perspective of the ATM device rather than from the perspective of a financial institution transaction account. The highest order groups 108 may be associated by ATM network, the mid-order groups 106 may be associated by country, the lowest order groups 104 may be associated by city, and each computer node 102 may be an ATM device that facilitates multiple transactions. Thus, a common set of event data (e.g., transaction data for transactions between transaction accounts and ATM devices) may be grouped according to one or more sets of groups. One or more sets of groups may be graphically represented individually or together, as further described below.

[0083] Reference Figure 2 , a schematic diagram of an environment 200 according to a non-limiting embodiment or aspect of the present disclosure is shown. The environment 200 may include one or more of the following: a payment device 202, a POS device 204, a merchant system 206, an acquirer system 211, a transaction processing system 208, an issuer system 212, an ATM 214, a computer node 102, a third-party payment device 216, a monitoring computing device 218, and a communication network 210.

[0084] The communication network 210 may include one or more wired and / or wireless networks. For example, the communication network 210 may include a cellular network (e.g., a long term evolution (LTE) network, a third generation (3G) network, a fourth generation (4G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), a private network, an ad hoc network, a mesh network, a beacon network, an intranet, the Internet, a fiber-optic-based network, a cloud computing network, etc., and / or a combination of these or other types of networks.

[0085] The payment device 202 may include one or more devices capable of communicating with the POS device 204, the ATM 214, the transaction processing system 208, the issuer system 212, and / or the third-party payment device 216 to complete a transaction (e.g., a purchase transaction, a withdrawal transaction, an account-to-account (A2A) payment transaction, etc.). The third-party payment device 216 may include one or more devices capable of communicating with the payment device 202, the ATM 214, the issuer system 212, the transaction processing system 208, and / or other third-party payment devices 216 to complete a transaction. The ATM 214 may include one or more devices capable of communicating with the payment device 202, the third-party payment device 216, and the transaction processing system 208 via a user interface to facilitate transaction account activities (e.g., balance inquiries, withdrawals, deposits, etc.).

[0086] POS device 204 may include one or more devices capable of communicating with payment device 202, third-party payment device 216, merchant system 206, acquirer system 211, transaction processing system 208, and / or other computing devices such as payment gateways. POS device 204 may be included in merchant system 206 and / or associated with merchant system. Merchant system 206 may include one or more devices capable of communicating with POS device 204, transaction processing system 208, issuer system 212, etc. Merchant system 206 may include one or more computing devices, such as servers, server groups, and / or similar devices. The computing device may include a data storage device.

[0087] The transaction processing system 208 may include one or more computing devices capable of communicating with the merchant system 206, the acquirer system 211, the issuer system 212, the ATM 214, the payment device 202, and / or other computing devices such as payment gateways. The issuer system 212 may include one or more devices capable of communicating with the payment device 202, the transaction processing system 208, etc. The acquirer system 211 may include one or more devices capable of communicating with the POS device 204, the merchant system 206, the transaction processing system 208, etc., including the payment gateway. The acquirer system 211, the issuer system 212, and the transaction processing system 208 may include one or more computing devices, such as servers, server groups, and / or similar devices. The computing device may include a data storage device.

[0088] A non-transaction based computer network may include any number of computer nodes 102 connected and configured in a communication network 210 , and may include one or more devices capable of communicating with other computer nodes 102 .

[0089] The monitoring computing device 218 may include one or more devices capable of communicating with other computer devices in the environment 200 so that event data of events occurring in the networked system can be received, analyzed, and executed. The monitoring computing device 218 may include one or more computing devices, such as servers, server groups, and / or similar devices. The monitoring computing device 218 may include one or more data storage devices for storing the received event data. The monitoring computing device 218 may include a display for displaying a graphical representation of the event data. The monitoring computing device 218 may include a user interface to facilitate user interaction with the graphical representation of the event data. The monitoring computing device 218 may receive event data, generate multiple nested groups of event data, generate display data to display a graphical representation of the event data, and receive or determine identification of abnormal activities in the event data. The monitoring computing device 218 may provide a trigger response action to correct anomalies in the network.

[0090] supply Figure 2 The number and arrangement of devices and networks shown in are examples. Figure 2 Additional devices and / or networks, fewer devices and / or networks, different devices and / or networks, or differently arranged devices and / or networks than those shown in . In addition, Figure 2 Two or more of the devices shown in may be implemented in a single device, or Figure 2 A single device shown in the environment 200 may be implemented as multiple distributed devices. Additionally or alternatively, a group of devices (eg, one or more devices) of the environment 200 may perform one or more functions described as being performed by another group of devices of the environment 200.

[0091] Reference now Figure 3 , a diagram showing exemplary components of device 300. Device 300 may correspond to one or more devices of environment 200, including payment device 202, POS device 204, merchant system 206, acquirer system 211, issuer system 212, transaction processing system 208, computer node 102, third-party payment device 216, ATM 214, and communication network 210. In some non-limiting embodiments or aspects, one or more of the foregoing devices may include at least one device 300 and / or at least one component of device 300. Figure 3 As shown, apparatus 300 may include a bus 302 , a processor 304 , a memory 306 , a storage component 308 , an input component 310 , an output component 312 , and a communication interface 314 .

[0092] The bus 302 may include components that permit communication between components of the device 300. In some non-limiting embodiments or aspects, the processor 304 may be implemented in hardware, software, or a combination of hardware and software. For example, the processor 304 may include a processor (e.g., a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), etc.), a microprocessor, a digital signal processor (DSP), and / or any processing component that can be programmed to perform a function (e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc.). The memory 306 may include a random access memory (RAM), a read-only memory (ROM), and / or another type of dynamic or static storage device (e.g., flash memory, magnetic memory, optical memory, etc.) that stores information and / or instructions for use by the processor 304.

[0093] The storage component 308 may store information and / or software related to the operation and use of the device 300. For example, the storage component 308 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optical disk, a solid-state disk, etc.), a compact disk (CD), a digital versatile disk (DVD), a floppy disk, a cassette, a magnetic tape, and / or another type of computer-readable medium and a corresponding drive.

[0094] Input components 310 may include components that permit device 300 to receive information, for example, via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, buttons, switches, a microphone, a camera, etc.). Additionally or alternatively, input components 310 may include sensors for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, an actuator, etc.). Output components 312 may include components that provide output information from device 300 (e.g., a display, a speaker, one or more light emitting diodes (LEDs), etc.).

[0095] The communication interface 314 may include a transceiver-type component (e.g., a transceiver, a separate receiver and transmitter, etc.) that enables the device 300 to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of a wired connection and a wireless connection. The communication interface 314 may permit the device 300 to receive information from another device and / or provide information to another device. For example, the communication interface 314 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, Interface, cellular network interface, etc.

[0096] The device 300 can perform one or more processes described herein. The device 300 can perform these processes based on the processor 304 executing software instructions stored by a computer-readable medium such as a memory 306 and / or a storage component 308. A computer-readable medium (e.g., a non-transitory computer-readable medium) is defined herein as a non-transitory memory device. A non-transitory memory device includes a memory space located within a single physical storage device or a memory space spread across multiple physical storage devices.

[0097] The software instructions may be read into the memory 306 and / or storage component 308 from another computer-readable medium or from another device via the communication interface 314. When executed, the software instructions stored in the memory 306 and / or storage component 308 may cause the processor 304 to perform one or more processes described herein. Additionally or alternatively, hard-wired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Therefore, the embodiments or aspects described herein are not limited to any specific combination of hardware circuitry and software.

[0098] The memory 306 and / or storage component 308 may include a data storage device or one or more data structures (e.g., a database, etc.). The device 300 can receive information from, store information in, transmit information to, or search for information stored in the data storage device or one or more data structures in the memory 306 and / or storage component 308. For example, the information may include encrypted data, input data, output data, transaction data, account data, or any combination thereof.

[0099] Provided as an example Figure 3 In some non-limiting embodiments or aspects, the number and arrangement of components shown in Figure 3Compared to those shown in , the device 300 may include additional components, fewer components, different components, or components arranged in a different manner. Additionally or alternatively, a group of components (e.g., one or more components) of the device 300 may perform one or more functions described as being performed by another group of components of the device 300.

[0100] Reference now Figure 4 , a flow chart of a method 400 for network anomaly detection according to some non-limiting embodiments or aspects of the present disclosure is shown. One or more steps of the method 400 may be performed by one or more computing devices, including the transaction processing system 208, the monitoring computing device 218, the computer node 102, and / or another computing device. One or more steps of the method 400 may be performed by the same or different devices.

[0101] In step 402, event data may be received. For example, the monitoring computing device 218 may receive event data associated with a plurality of events in a computer network during a sampling period of time. Events may include, but are not limited to, network communications, such as transactions, messages, transmitted / requested data packets, and the like. An event may include communications between at least two of a plurality of computer nodes 102 in a computer network 100. The event data may include at least an aggregatable (e.g., capable of being aggregated) parameter. In the context of an electronic payment processing network, an event may include a transaction, event data may include transaction data, and aggregatable parameters may include transaction values, transaction counts, and the like. In the context of a computer network, typically, aggregatable parameters may include packet size, ping size, communication length, communication counts, and the like.

[0102] In step 404, a plurality of nested groups of event data may be determined. For example, the monitoring computing device 218 may determine a plurality of nested (e.g., contained within each other) groups of event data. The groups may be determined based on an operational hierarchy within a computer network. Additionally or alternatively, the groups may be determined based on common characteristics of the events in the groups (e.g., location, time, device, etc.). The lowest order group in the plurality of nested groups may include one or more computer nodes 102 in the plurality of computer nodes 102. Each group having a higher order than the lowest order group may include one or more other groups nested within each group.

[0103] In step 406, display data may be generated. For example, the monitoring computing device 218 may generate display data configured to cause the display of the computing device 218 to display a first graphical representation of event data. The first graphical representation may include multiple nested graphical nodes and at least one spline. Multiple nested graphical nodes may have a one-to-one correspondence with multiple computer nodes and multiple nested groups. In a non-limiting embodiment or aspect, each graphical node in the multiple nested graphical nodes may be associated with a computer node 102 in one or more computer nodes in the multiple nested groups (e.g., a graphical node may be provided for each computer node and each subgroup). Each graphical node in the multiple nested graphical nodes may encompass another graphical node in the multiple nested graphical nodes or be encompassed by another graphical node in the multiple nested graphical nodes (e.g., a graphical node associated with a computer node 102 may be encompassed by a graphical node associated with a lowest order group, and a graphical node associated with a highest order group may encompass one or more lower order groups).

[0104] With further reference to the graphical representation of event data, the size of each of the plurality of nested graph nodes may be proportional to the aggregated value of an aggregatable parameter for each event associated with the computer node 102 associated with the graph node or the plurality of computer nodes 102 included in the group associated with the graph node. For example, if the graph node is associated with a computer node 102, the aggregatable parameter of all events associated with the computer node 102 may be aggregated (e.g., for transactions, the transaction values ​​of all transactions associated with the computer node 102 may be aggregated). If the graph node is associated with a group, all events associated with the computer nodes 102 therein may be considered (e.g., for transactions, the transaction values ​​may be aggregated for all transactions associated with all computer nodes 102 included in the group (including any subgroups therein). By further example, if the aggregatable parameter is a communication count (e.g., the number of unique communications), and a first computer node received ten communications and a second computer node received one communication, the graph node associated with the first computer node may be represented as ten times as large as the second computer node (e.g., ten times as large according to a linear scale, a logarithmic scale, etc.). For a graph node associated with a group that includes each of a first computer node and a second computer node, the graph node may be represented as at least 1.1 times the size of the first node and at least 11 times the size of the second node (e.g., according to a linear scale, a logarithmic scale, etc.). The size of the graph node that encompasses other graph nodes may be additionally increased to allow for prominent representation of nested nodes.

[0105] With further reference to the graphical representation of the event data, each of the at least one spline may have endpoints comprising a pair of graph nodes in the plurality of nested graph nodes. Each spline may also include a curve generated by a path through a common graph node encompassing each of the endpoint graph nodes. Figure 7 and 8 and related discussion of further description of generating splines. Each spline may also be associated with a communication between at least two of the plurality of computer nodes. For example, for a communication from a first computer node to a second computer node, the spline may represent a communication path between the first computer node and the second computer node (e.g., node to LAN, to router, to ISP, to NSP, etc., and back to a receiving node). As another example, the communication may be a transaction communication in an electronic payment processing network, such as between two computing devices associated with an ATM and a payment device and configured to manage respective transaction accounts, and the like.

[0106] In step 408, an identification of an abnormal graph node may be received. For example, the monitoring computing device 218 may receive an identification of an abnormal graph node among a plurality of nested graph nodes from a user interface. A user may interact with the graphical representation on the user interface to select a node and submit the identification of the node for further action.

[0107] Alternatively or additionally, in step 410, the identification of an abnormal graph node may be determined. For example, the monitoring computing device 218 may determine the identification of an abnormal graph node based on the size of the abnormal graph node (in step 411) and / or the number of splines passed to or through the abnormal graph node. With respect to node size, an abnormal graph node may be detected when the size of the abnormal graph node meets a threshold relative to the average size of the graph nodes associated with the same group of associated abnormal graph nodes. For example, the monitoring computing device 218 may average the size and / or average the aggregate values ​​of other nodes covered by a common node with an abnormal graph node, and may compare the average size and / or average aggregate value with the size and / or aggregate value of the abnormal graph node. Thresholds may include percentages (e.g., greater than 100%), ratios (e.g., 2:1), differences, etc. Meeting a threshold may include reaching and / or exceeding a threshold in a positive or negative direction (e.g., significantly greater than or less than an average value). Additionally or alternatively, an abnormal graph node may be detected when the size of the abnormal graph node meets a threshold relative to the average size of the abnormal graph node generated by event data in multiple previous time periods. For example, monitoring computing device 218 may average the size and / or aggregate value of each node over multiple time periods and determine when a given node meets a threshold relative to the average size and / or aggregate value of that node.

[0108] In step 412, one or more response actions to the network anomaly may be triggered. For example, in response to the identification of an abnormal graph node, the monitoring computing device 218 may take one or more response actions to the network anomaly. The response action may include, but is not limited to, sending a communication alarm to a network administrator, activating a disabled portion of the network, disabling an active portion of the network, rerouting network communications, preventing communication through network components or between network components. In the context of an electronic payment processing network, the monitoring computing device 218 may reject one or more transactions in a time period after the sampling time period (e.g., between computer nodes associated with an abnormal graph node, associated with a graph node covered by the abnormal graph node, associated with a graph node covering the abnormal graph node, etc.). The response action may also include rejecting all ongoing transactions between computer nodes in a group associated with an abnormal graph node, associated with a graph node covering the abnormal graph node, or associated with a graph node covered by the abnormal graph node.

[0109] After step 406, and optionally after step 412, method 400 may proceed to Figure 5 The method shown in .

[0110] Reference now Figure 5 , a flow chart of a method 500 for network anomaly detection according to a non-limiting embodiment or aspect of the present disclosure is shown. One or more steps of the method 500 may be performed by one or more computing devices, including the transaction processing system 208, the monitoring computing device 218, the computer node 102, and / or another computing device. One or more steps of the method 500 may be performed by the same or different devices.

[0111] In step 502, new event data may be received. For example, monitoring computing device 218 may receive new event data associated with a plurality of new events in the computer network during a subsequent time period after the sampling time period.

[0112] In step 506, new display data may be generated. For example, monitoring computing device 218 may generate new display data configured to cause a display of computing device 218 to display a new graphical representation of the new event data. The new graphical representation may be displayed using the same set of graphical parameters as the first graphical representation, including, but not limited to, parameters for displaying nested graphical nodes and splines. The nested graphical nodes and splines may be associated with the same group that applies to the new event data. In this way, the same node in the first graphical representation and the new graphical representation may have different sizes because the aggregate value of the aggregatable parameter of the event data associated therewith may vary. In addition, the number of splines between graphical nodes may change. See Figure 9-11 , a comparison of its graph representations for large-scale networks.

[0113] In step 508, an identification of an abnormal graphical node may be received. For example, the monitoring computing device 218 may receive an identification of an abnormal graphical node among a plurality of nested graphical nodes from a user interface. A user may interact with a graphical representation on the user interface to select a node and submit the identification of the node for further action. The identification may be determined based on an increase or decrease in the size of the abnormal graphical node in the new graphical representation relative to the first graphical representation.

[0114] Alternatively or additionally, in step 510, identification of an anomalous graph node may be determined. For example, monitoring computing device 218 may determine identification of an anomalous graph node based on a size of the anomalous graph node and / or a number of splines in the new graphical representation that pass to or through the anomalous graph node relative to the first graphical representation. With respect to node size, an anomalous graph node may be detected when a size of the anomalous graph node meets a threshold relative to a size of the same node in the first graphical representation.

[0115] In step 512, one or more response actions to the network anomaly may be triggered. For example, in response to the identification of the abnormal graph node, the monitoring computing device 218 may take one or more response actions to the network anomaly. After taking one or more response actions, the method 500 may loop back to step 502 and repeat steps 506, 508, and / or 510. If no abnormal graph node is detected in a given graph representation relative to a previous graph representation, including the generated first graph representation or the second graph representation, the method 500 may also loop back to step 502 and repeat steps 506, 508, and / or 510.

[0116] Reference Figure 6 , a diagram illustrating a process 600 according to a non-limiting embodiment or aspect of the present disclosure. The process 600 may be performed by one or more computing devices, including a transaction processing system 208, a monitoring computing device 218, a computer node 102, and / or another computing device. The process 600 illustrates the bottom-up generation of a graphical representation.

[0117] In step 602, the graph nodes represent the computer nodes according to the aggregated values ​​of the parameters of the events associated with the computer nodes. For example, one of the graph nodes in step 602 is ten times larger than the other graph nodes. This may indicate that the aggregated value of the computer node associated with the graph node is ten times the value of the other computer nodes associated with the other graph nodes.

[0118] In step 604, the graph nodes in step 604 encompass the graph nodes from step 602. Each graph node added in step 604 is associated with a corresponding lowest-order group of computer nodes. The size of the graph nodes added in step 604 is also proportional to the aggregate value of all nodes contained therein. It should be understood that a graph node added in step 604 that encompasses a larger graph node from step 602 is also larger than other graph nodes added in step 604.

[0119] In step 606, the graph nodes in step 606 encompass the graph nodes from step 604. The graph nodes added in step 606 are associated with a higher order group that contains the computer node group from step 604. The single graph node added in step 606 represents that all graph nodes in step 604 are associated with and encompassed by a common group in step 606. The size of the graph nodes added in step 606 is also proportional to the aggregate value of all nodes contained therein.

[0120] In step 608, the graph node from step 606 is paired with another set of graph nodes in step 608. The highest-order graph node in step 608 can be considered to be the common ancestor of the lower-order graph nodes it contains. Although the graphical representation of the event data in step 608 does not include splines, see Figure 7 and Figure 8 , spline generation is discussed in detail.

[0121] Although for ease of understanding, the graph nodes are represented in relatively fixed positions in steps 602, 604, 606, and 608, it should be understood that generating a graphical representation of a computer network may involve moving the graph nodes during generation to accommodate its various groupings. In addition, the positioning of the nodes may be optimized so that larger nodes are generally positioned toward the center of the graphical representation, thereby further improving prominence.

[0122] Reference Figure 7 and 8 , a schematic diagram of a process 700, 800 for generating a spline according to a non-limiting embodiment or aspect of the present disclosure is shown. The process 700, 800 can be performed by one or more computing devices, including a transaction processing system 208, a monitoring computing device 218, a computer node 102, and / or another computing device.

[0123] Specific reference Figure 7, Process 700 shows the initial pathfinding steps for generating a spline that connects node N0 to node N8. Process 700 includes determining a path that connects node N0 to node N8 via the lowest common ancestor node through higher-order nodes in each of node N0 and node N8. Starting from node N0, a path including the next higher-order node that includes node N0 is identified, and this next higher-order node is node N1. The process is repeated until the lowest common ancestor node is identified (e.g., the lowest-order node that encompasses each of node N0 and node N8). As Figure 7 shown, the path is determined as follows: N0 < N1 < N2 < N3 < N4. Node N4 is the lowest common ancestor node of each of node N0 and node N8. Then, the path advances through subsequent lower-order graph nodes until node N8 is reached. Thus, the complete path is as follows: N0 < N1 < N2 < N3 <n4>N5>N6>N7>N8.

[0124] Specific reference Figure 8 , process 800 illustrates generating various splines by generating curves from the initial path produced by process 700. Although the generated path already provides increased prominence compared to a straight line path connecting node N0 directly to node N8, the path can be further optimized to form a spline. The formula for generating a spline curve from the initial path is as follows:

[0125] Formula 1

[0126]

[0127] Wherein N' represents the modified node, N represents the initial node, i represents the node index, and β represents the bundling strength set to be in the range of [0, 1]. For further guidance on generating splines according to the above formula, see Danny Holten, "Hierarchical Edge Bundles: Visualization of Adjacency Relations in Hierarchical Data" IEEE Transactions on Visualization and Computer Graphics, September 2006, pages 741-48, volume 12(5). Spline S1 has the lowest bundling strength, spline S2 has a higher bundling strength, and spline S3 has the highest bundling strength. The bundling strength can be selected so that the graphical data required to represent the spline is reduced while retaining the information contained therein about the underlying path. Multiple paths can be drawn according to process 700, and multiple splines can be generated from the multiple paths according to process 800. In a graphical representation including multiple nested graphical nodes and multiple splines, an increased communication rate can be identified by a cluster of splines passing through a common graphical node.

[0128] refer to Fig. 9 , shows an exemplary diagram of a first graphical representation 900 of event data from a large-scale network during a sampling time period according to a non-limiting embodiment or aspect of the present disclosure. The first graphical representation 900 includes a plurality of nested graphical nodes, wherein the largest graphical node including the highest order graphical node is generally located at the center of the first graphical representation 900. In addition, network events (e.g., communications) from the event data are shown in the first graphical representation 900 by splines that connect the lowest order graphical nodes via paths drawn through the lowest common ancestor. The first graphical representation 900 shows that the overall properties of some graphical nodes are greater than other nodes, indicating differences in aggregate values ​​associated therewith.

[0129] refer to Fig.10 , an exemplary diagram of a new graphical representation 1000 of new event data from a large-scale network characterized by multiple anomalies in a subsequent time period according to a non-limiting embodiment or aspect of the present disclosure is shown. The new graphical representation 1000 includes the same multiple nested graphical nodes, wherein the largest graphical node including the highest order graphical node is generally located at the center of the new graphical representation 1000. In addition, network events (e.g., communications) from the new event data are shown in the new graphical representation 1000 by splines, which connect the lowest order graphical nodes via paths drawn through the lowest common ancestor. The new graphical representation 1000 illustrates network anomalies through at least two abnormal graphical nodes. In particular, the center and two nodes to the left of the center of the new graphical representation 1000 are significantly larger (e.g., have significantly higher aggregation values) compared to the historical size of these graphical nodes, or compared to other graphical nodes generated from the same data period. In addition, the number and convergence of a large number of splines through abnormal graphical nodes can be used as an independent or additional basis for identifying abnormal graphical nodes.

[0130] refer to Fig.11 , shows an exemplary diagram of a user interface 1100 for displaying graphical representations 900, 1000 of event data generated according to non-limiting embodiments or aspects of the present disclosure. The user interface 1100 is configured to display event data from a sampled time period in a first graphical representation 900 and new event data from a subsequent time period in a new graphical representation 1000. The user interface also includes an interactive timeline 1102, which can allow a user to select a time period and view corresponding graphical representations 900, 1000 generated from event data acquired from the selected time period. As depicted, the user has selected two dates ("January 24" and "January 26") corresponding to two graphical representations 900, 1000. The exemplary user interface 1100 shows the graphical representations 900, 1000 being sorted by time period relative to each other. Alternatively, the user interface 1100 can allow a user to select and view a time period and a corresponding graphical representation at a time 900, 1000. The interactive timeline 1102 may be further color-coded so that each selectable time period may be identified by possible anomalous activity (e.g., "January 26," corresponding to the anomalous activity shown in the new graphical representation 1000, may be color-coded red to indicate to the user that anomalous activity was detected; in contrast, "January 24," may be color-coded blue to indicate to the user that no anomalous activity was detected). It should also be understood that the user interface may allow the user to zoom in on the graphical representations 900, 1000 to view and compare the graphical nodes.

[0131] Further references Fig.11 , a graphical representation of event data may allow a user to select or hover over a graph node and receive information about the node, including its aggregate value. Graph nodes may be represented by nested data structures. In an example representing transaction event data, the highest-order graph node may be specified by a BID (e.g., "Bid103") and may have an aggregate value for all transaction accounts for all BINs associated with it (e.g., $15,497). The next lower-order graph node may be specified by a BID and a BIN (e.g., "Bid103.bin221") and may have an aggregate value for all transactions for all transaction accounts associated with it (e.g., $2,354). The next lower-order graph node may be specified by a BID, BIN, and account identifier (e.g., "Bid103.bin221.account762") and may have an aggregate value of all transactions associated with it (e.g., $110). Individual transactions into and out of the account may be specified by a BID, BIN, account identifier, and transaction identifier (e.g., "Bid103.bin221.acount762.transID123") and may be associated with individual aggregatable values ​​(e.g., $100).

[0132] In an example representing the same transaction event data from an ATM location perspective, the highest-order graph node may be specified by a country identifier (e.g., "United States") and may have an aggregatable value for all transactions for all ATMs in all cities associated with it (e.g., $5,673). The next lower-order graph node may be specified by a country identifier and a city identifier (e.g., "USA.Austin") and may have an aggregate value for all transactions for all ATMs associated with it (e.g., $254). The next lower-order graph node may be specified by a country identifier, a city identifier, and an ATM identifier (e.g., "USA.Austin.dev01") and may have an aggregate value for all transactions associated with it (e.g., $20). A single transaction (e.g., a withdrawal) conducted with an ATM may be specified by a country identifier, a city identifier, an ATM identifier, and a transaction identifier (e.g., "USA.Austin.dev01.transID03") and may be associated with a single aggregatable value (e.g., $10). It should be appreciated that similar techniques may be applied to create nested groups and data structures thereof for use in generating graphical representations of event data for various computer networks.

[0133] Although the present disclosure has been described in detail for illustrative purposes based on what are currently considered to be the most practical and preferred embodiments or aspects, it should be understood that such details are only for that purpose and that the present disclosure is not limited to the disclosed embodiments or aspects, but on the contrary is intended to cover modifications and equivalent arrangements within the spirit and scope of the appended claims. For example, it should be understood that the present disclosure contemplates that, to the extent possible, one or more features of any embodiment may be combined with one or more features of any other embodiment.

Claims

1. A computer-implemented method comprising: receiving, with at least one processor, event data associated with a plurality of events in a computer network over a sampling time period, the event data comprising an aggregatable parameter, and each event in the plurality of events comprising a communication between at least two network computer nodes of a plurality of computer nodes in the computer network; determining, with at least one processor, a plurality of nested groups of the event data, wherein a lowest order group in the plurality of nested groups includes a group of at least one computer node in the plurality of computer nodes, and wherein each group in the plurality of nested groups having a higher order than the lowest order group includes at least one other group in the plurality of nested groups nested therein; as well as generating display data with at least one processor, the display data being configured to cause a display of a computing device to show a first graphical representation of the event data, the first graphical representation comprising a plurality of nested graphical nodes and at least one spline; wherein, Each of the plurality of nested graph nodes is associated with a group of the plurality of nested groups or a computer node of the plurality of computer nodes, each graph node in the plurality of nested graph nodes encompasses and / or is encompassed by another graph node in the plurality of nested graph nodes, each of the plurality of nested graph nodes has a size proportional to an aggregate value of an aggregatable parameter of each event associated with a computer node associated with the graph node or with a plurality of computer nodes consisting of a group associated with the graph node, Each of the at least one spline has endpoints including a pair of graphical nodes of the plurality of nested graphical nodes and includes a curve generated by a path passing through a common graphical node encompassing each of the pair of graphical nodes, and Each spline of the at least one spline is associated with communications between at least two computer nodes of the plurality of computer nodes.

2. The method of claim 1, wherein the plurality of events comprises a plurality of transactions, the computer network comprises an electronic payment processing network, the event data comprises transaction data associated with the plurality of transactions, and the aggregatable parameters comprise transaction values.

3. The method of claim 2, wherein each of the plurality of computer nodes comprises a computing device configured to manage transactions to and from at least one transaction account.

4. The method according to claim 3, further comprising: receiving, with at least one processor, from a user interface of the computing device, an identification of an anomalous graph node among the plurality of nested graph nodes; as well as At least one transaction between computer nodes in a group of a plurality of nested groups associated with the anomalous graph node or with graph nodes encompassing the anomalous graph node is rejected with at least one processor during a time period following the sampling time period.

5. The method of claim 4, further comprising rejecting all ongoing transactions between computer nodes in a set of a plurality of nested groups associated with the anomalous graph node or associated with a graph node encompassing the anomalous graph node.

6. The method according to claim 2, further comprising: receiving, with at least one processor, new event data associated with a plurality of new events in the computer network during a subsequent time period after the sampling time period; generating, with at least one processor, new display data configured to cause a display of the computing device to show a new graphical representation of the new event data, wherein the new graphical representation is displayed using a same set of graphical parameters as the first graphical representation, and wherein the new graphical representation is displayed in chronological order relative to the first graphical representation; receiving, with at least one processor, from a user interface of the computing device, an identification of an anomalous graphical node in the new graphical representation, wherein the identification is determined based on an increase in size of the anomalous graphical node in the new graphical representation relative to the first graphical representation; as well as At least one transaction between computer nodes in a set of a plurality of nested groups associated with the anomalous graph node or associated with graph nodes encompassing the anomalous graph node is rejected with at least one processor.

7. The method of claim 1 further comprising determining, with at least one processor, the identification of the anomalous graph node based on a size of the anomalous graph node satisfying a threshold relative to an average size of graph nodes associated with the same group associated with the anomalous graph node.

8. The method according to claim 1 also includes using at least one processor to determine the identification of the abnormal graph node based on the size of the abnormal graph node generated by the event data in the sampling time period relative to the average size of the abnormal graph node generated by the event data in multiple previous time periods satisfying a threshold.

9. A system comprising a server, the server comprising at least one processor, the server being programmed and / or configured to: receiving event data associated with a plurality of events in a computer network over a sampling time period, the event data comprising an aggregatable parameter, and each event in the plurality of events comprising a communication between at least two network computer nodes of a plurality of computer nodes in the computer network; determining a plurality of nested groups of the event data, wherein a lowest order group in the plurality of nested groups includes a group of at least one computer node in the plurality of computer nodes, and wherein each group in the plurality of nested groups having a higher order than the lowest order group includes at least one other group in the plurality of nested groups nested therein; generating display data configured to cause a display of a computing device to show a first graphical representation of the event data, the first graphical representation comprising a plurality of nested graphical nodes and at least one spline; wherein, Each of the plurality of nested graph nodes is associated with a group of the plurality of nested groups or a computer node of the plurality of computer nodes, each graph node in the plurality of nested graph nodes encompasses and / or is encompassed by another graph node in the plurality of nested graph nodes, each of the plurality of nested graph nodes has a size proportional to an aggregate value of an aggregatable parameter of each event associated with a computer node associated with the graph node or with a plurality of computer nodes consisting of a group associated with the graph node, Each of the at least one spline has endpoints including a pair of graphical nodes of the plurality of nested graphical nodes and includes a curve generated by a path passing through a common graphical node encompassing each of the pair of graphical nodes, and Each spline of the at least one spline is associated with communications between at least two computer nodes of the plurality of computer nodes.

10. The system of claim 9, wherein the plurality of events comprises a plurality of transactions, the computer network comprises an electronic payment processing network, the event data comprises transaction data associated with the plurality of transactions, and the aggregatable parameters comprise transaction values.

11. The system of claim 10, wherein the server is further programmed and / or configured to: receiving, from a user interface of the computing device, an identification of an anomalous graph node among the plurality of nested graph nodes; and At least one transaction between computer nodes in a group of a plurality of nested groups associated with the abnormal graph node or with graph nodes encompassing the abnormal graph node during a time period after the sampling time period is rejected.

12. The system of claim 10, wherein the server is further programmed and / or configured to: receiving new event data associated with a plurality of new events in the computer network during a subsequent time period after the sampling time period; generating new display data configured to cause a display of the computing device to show a new graphical representation of the new event data, wherein the new graphical representation is displayed using the same set of graphical parameters as the first graphical representation, and wherein the new graphical representation is displayed in chronological order relative to the first graphical representation; receiving, from a user interface of the computing device, an identification of an anomalous graphical node in the new graphical representation, wherein the identification is determined based on an increase in size of the anomalous graphical node in the new graphical representation relative to the first graphical representation; and At least one transaction between computer nodes in a set of a plurality of nested groups associated with the anomalous graph node or associated with graph nodes encompassing the anomalous graph node is rejected.

13. The system of claim 9, wherein the server is further programmed and / or configured to determine the identification of the abnormal graph node based on a size of the abnormal graph node satisfying a threshold relative to an average size of graph nodes associated with the same group associated with the abnormal graph node.

14. A system according to claim 9, wherein the server is further programmed and / or configured to determine the identification of the abnormal graph node based on the size of the abnormal graph node generated by the event data within the sampling time period relative to the average size of the abnormal graph node generated by the event data within multiple previous time periods satisfying a threshold.

15. A computer program product comprising computer program instructions which, when executed by at least one processor, cause the at least one processor to: receiving event data associated with a plurality of events in a computer network over a sampling time period, the event data comprising an aggregatable parameter, and each event in the plurality of events comprising a communication between at least two network computer nodes of a plurality of computer nodes in the computer network; determining a plurality of nested groups of the event data, wherein a lowest order group in the plurality of nested groups includes a group of at least one computer node in the plurality of computer nodes, and wherein each group in the plurality of nested groups having a higher order than the lowest order group includes at least one other group in the plurality of nested groups nested therein; generating display data configured to cause a display of a computing device to show a first graphical representation of the event data, the first graphical representation comprising a plurality of nested graphical nodes and at least one spline; wherein, Each of the plurality of nested graph nodes is associated with a group of the plurality of nested groups or a computer node of the plurality of computer nodes, each graph node in the plurality of nested graph nodes encompasses and / or is encompassed by another graph node in the plurality of nested graph nodes, each of the plurality of nested graph nodes has a size proportional to an aggregate value of an aggregatable parameter of each event associated with a computer node associated with the graph node or with a plurality of computer nodes consisting of a group associated with the graph node, Each of the at least one spline has endpoints including a pair of graphical nodes of the plurality of nested graphical nodes and includes a curve generated by a path passing through a common graphical node encompassing each of the pair of graphical nodes, and Each spline of the at least one spline is associated with communications between at least two computer nodes of the plurality of computer nodes.

16. The computer program product of claim 15, wherein the plurality of events comprises a plurality of transactions, the computer network comprises an electronic payment processing network, the event data comprises transaction data associated with the plurality of transactions, and the aggregatable parameters comprise transaction values.

17. The computer program product of claim 16, wherein the program instructions further cause the at least one processor to: receiving, from a user interface of the computing device, an identification of an anomalous graph node among the plurality of nested graph nodes; and At least one transaction between computer nodes in a group of a plurality of nested groups associated with the abnormal graph node or with graph nodes encompassing the abnormal graph node during a time period after the sampling time period is rejected.

18. The computer program product of claim 16, wherein the program instructions further cause the at least one processor to: receiving new event data associated with a plurality of new events in the computer network during a subsequent time period after the sampling time period; generating new display data configured to cause a display of the computing device to show a new graphical representation of the new event data, wherein the new graphical representation is displayed using the same set of graphical parameters as the first graphical representation, and wherein the new graphical representation is displayed in chronological order relative to the first graphical representation; receiving, from a user interface of the computing device, an identification of an anomalous graphical node in the new graphical representation, wherein the identification is determined based on an increase in size of the anomalous graphical node in the new graphical representation relative to the first graphical representation; and At least one transaction between computer nodes in a set of a plurality of nested groups associated with the anomalous graph node or associated with graph nodes encompassing the anomalous graph node is rejected.

19. The computer program product of claim 15, wherein the program instructions further cause the at least one processor to determine the identification of the abnormal graph node based on a size of the abnormal graph node satisfying a threshold relative to an average size of graph nodes associated with the same group associated with the abnormal graph node.

20. A computer program product according to claim 15, wherein the program instructions further cause the at least one processor to determine the identification of the abnormal graph node based on the size of the abnormal graph node generated by the event data within the sampling time period relative to the average size of the abnormal graph node generated by the event data within multiple previous time periods satisfying a threshold.

21. A non-transitory computer-readable storage medium comprising computer program instructions stored thereon, which, when executed by at least one processor, cause the at least one processor to perform the method of any one of claims 1 to 8.

Images