Dynamic Graph Community Analysis for Network Anomaly Prediction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing anomaly detection methods in computer networks fail to accurately predict anomalous actions due to their focus on static networks and loss of information regarding interplay and connectivity between entities, leading to inefficiencies and inaccuracies in identifying potential future anomalies.

Innovation Solution

The method involves analyzing dynamics of community and meta-community graphs within evolving networks to predict future anomalous actions by computing community and meta-community graphs from sequential snapshots of a dynamic graph, detecting changes, and identifying nodes likely to perform anomalous actions based on these analyses.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If static network analysis methods are used, then device complexity is reduced, but measurement precision of anomaly detection deteriorates

Engineering Contradiction:

Improvecomplexity of anomaly detection systemVSAvoidaccuracy of anomaly detection

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The patent segments the network analysis into multiple hierarchical levels: individual nodes, communities of nodes, and meta-communities. This segmentation allows the system to manage complexity by breaking down the large-scale network into smaller, more manageable units while maintaining high detection precision through multi-level pattern recognition.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent transitions from static single-timepoint network analysis to dynamic multi-dimensional analysis by incorporating temporal sequences of network snapshots. This adds the time dimension and hierarchical community structure dimensions, enabling more precise anomaly detection while systematically managing complexity through structured dimensional expansion.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

2Measurement precision

If dynamic graph analysis with community detection is implemented, then anomaly detection accuracy is improved, but device complexity increases

Engineering Contradiction:

Improveaccuracy of anomaly detectionVSAvoidcomplexity of anomaly detection system

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system divides the complex dynamic graph into communities and meta-communities, creating a hierarchical structure that simplifies analysis. Each community is analyzed semi-independently, reducing the overall computational complexity while maintaining high detection accuracy through localized pattern recognition within communities.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements dynamic community detection that evolves over time sequences, allowing communities to form, dissolve, and transform. This dynamic approach captures temporal patterns of anomalous behavior while managing complexity through incremental updates rather than complete re-analysis at each time step.

Inventive Principle:

Principle #15Dynamics

3Loss of information

If temporal sequences of network snapshots are analyzed, then loss of information about entity interplay is reduced, but loss of time for processing increases

Engineering Contradiction:

Improveinformation loss regarding entity connectivityVSAvoidprocessing time

Core Design Contradiction:

Loss of informationVSLoss of time

Solution Approach 1:

The patent extracts key structural features and community patterns from temporal network sequences, separating essential connectivity information from redundant data. This extraction process preserves critical information about entity interplay and community evolution while reducing processing time by focusing computational resources on salient features rather than complete raw data re-processing.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system performs preliminary community detection and structural analysis on network snapshots before conducting full anomaly detection. This preliminary processing organizes the data into meaningful community structures in advance, reducing the time required for subsequent temporal sequence analysis while preserving all essential information about entity connectivity and interactions.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11265225B2Systems and methods for prediction of anomalies

Publication Date: 2022.03.01 NETZ FORECASTS LTD

AI summary

There is provided a method for adapting components of a network, comprising: providing graphs each indicative of a respective sequential snapshot of a dynamic graph obtained over a historical time interval, wherein nodes of the graphs denote entities, and edges of the graphs denote interactions between the entities over a network, computing community graphs according to the graphs, computing meta-community graphs according to the community graphs, analyzing dynamics of the community graphs to detect changes between two temporally adjacent community graphs, analyzing dynamics of the meta-community graphs to detect changes between two temporally adjacent meta-community graphs, identifying at least one entity corresponding to node(s) of the dynamic graph according to a predicted likelihood of performing an anomalous action during a future time interval, and generating instructions for adapting component(s) of the network for ensuring availability of network resources for interactions between entities during the future time interval.