Community Graph Clustering for Suspicious Network Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Generating large network graphs for electronic communication systems is resource-intensive and time-consuming, often resulting in complex visuals that hinder analysis and detection of suspicious activities, leading to potential malicious transactions being allowed.
Innovation Solution
The technique generates condensed community graphs and closure graphs by clustering similar network graph structures, allowing for quick analysis and identification of suspicious entities, using modules like community construction, clustering, and summary modules to reduce computational resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If large network graphs are generated to represent all electronic communications, then comprehensive detection coverage is improved, but processing time and computational resources worsen
Solution Approach 1:
The patent segments the large network graph into multiple community graphs based on detected communities within the communication network. Each community graph represents a subset of entities and their communications, allowing parallel processing and analysis. This segmentation maintains comprehensive detection coverage by ensuring all entities are included across communities while reducing the computational burden on any single graph processing operation.
2Reliability
If large network graphs are generated to represent all electronic communications, then comprehensive detection coverage is improved, but computational resources worsen
Solution Approach 1:
The patent divides the comprehensive network graph into multiple smaller community graphs, enabling distributed and parallel processing across multiple computational resources. This segmentation allows the system to process communication data more efficiently by utilizing available computational resources in parallel, reducing the total energy and processing power required compared to analyzing one large monolithic graph.
Solution Approach 2:
The patent creates condensed representations of community graphs that capture the essential structural and relational information of the original network. These condensed graphs serve as efficient copies for analysis purposes, requiring significantly fewer computational resources to process while maintaining the ability to detect suspicious communication patterns and malicious entities.
3Loss of information
If detailed network graphs are generated, then analysis completeness is improved, but ease of operation worsens due to visual complexity
Solution Approach 1:
The patent segments the large network graph into multiple smaller community graphs, each representing a specific community of entities. This segmentation makes visual analysis manageable by presenting analysts with smaller, more focused graphs rather than one overwhelming large graph. The community structure naturally groups related entities together, making patterns and anomalies easier to spot within each community context.
Solution Approach 2:
The patent extracts and highlights suspicious entities and their connections within community graphs, separating potentially malicious communication patterns from normal background traffic. This extraction allows analysts to focus on the most relevant and suspicious portions of the network data without being overwhelmed by the complete network structure, maintaining analysis completeness while improving operational ease.
Data Source
AI summary
Techniques are disclosed for detecting whether an entity associated with a node of a summary graph is suspicious by retrieving, from a graph database storing a network graph representing a plurality of electronic communications, a portion of the network graph that includes a set of target nodes. Based on the target nodes included in the portion of the network graph, the server system generates community graphs that includes at least a target node and nodes connected to the target node. The server system assigns, based on similarities between the community graphs, the community graphs to clusters and generates a closure graph for clusters, including combining two or more community graphs within respective clusters. Based on respective closure graphs, the server system performs preventative actions relative to entities represented by nodes included in respective closure graphs and connected to the target nodes.