Graph Alteration for Program Action Visualization

The patent extracts and removes unnecessary nodes and edges from the graph based on suspiciousness scores and operation history. Specifically, nodes and edges with low suspiciousness scores or those not involved in suspicious operations are removed, retaining only the critical components that represent meaningful program actions while reducing overall graph size and resource consumption.

The patent applies different processing rules to different parts of the graph based on their suspiciousness characteristics. Nodes and edges are evaluated individually, and those meeting specific criteria (high suspiciousness, involvement in suspicious operations) are retained with higher detail, while others are removed or simplified, creating a graph with non-uniform detail distribution that optimizes resource usage.

The patent implements a multi-criteria evaluation system that combines suspiciousness scores with operation history analysis. The graph alteration unit can remove or modify nodes and edges based on multiple factors including suspiciousness scores, frequency of operations, types of operations, and temporal patterns, making the system versatile in handling different graph reduction scenarios beyond just suspiciousness-based filtering.

The patent changes the parameters used for graph alteration from solely suspiciousness scores to include multiple parameters such as operation frequency, operation types, temporal patterns, and suspiciousness scores. This allows flexible adjustment of removal criteria by changing which parameters are considered and their relative weights, enabling adaptation to different analysis requirements.

The patent extracts and removes redundant information from the graph by eliminating nodes and edges that do not contribute to suspicious activity detection. Nodes representing normal operations and edges representing routine transitions are removed, leaving a simplified graph that highlights only the critical suspicious events and operations, thereby improving display effectiveness without significant information loss.

Instead of starting with a complete graph and removing elements, the patent inverts the approach by identifying and retaining only the suspicious nodes and edges that meet specific criteria, then building the final graph from these selected elements. This inversion naturally produces a simplified graph focused on suspicious activities while implicitly excluding normal operations.