Continuous Subgraph Matching for Dynamic Network Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting cyber attacks in computer networks are resource-intensive and inefficient, particularly when dealing with large, dynamic data graphs, as they require significant computing power and memory, and struggle to identify partial matches and long-term trends in a timely manner.
Innovation Solution
A network analysis tool that performs continuous subgraph matching queries using distributed computing resources, allowing for incremental processing of dynamic data graphs, and includes a query graph building tool with an intuitive interface for specifying query graphs and their subgraphs, as well as a results visualization tool for presenting findings effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional subgraph matching methods are used to detect cyber attacks in large data graphs, then detection accuracy is maintained, but computing resource consumption increases significantly and processing speed decreases
Solution Approach 1:
The patent decomposes the query graph into multiple query subgraphs and organizes them in a hierarchical structure. This segmentation allows the system to process smaller subgraphs independently and combine results, reducing the computational complexity of matching against large data graphs while maintaining detection accuracy.
Solution Approach 2:
The system performs preliminary processing by pre-computing and storing information about query subgraphs, including their structural properties and relationships. This preliminary action enables faster matching during actual attack detection by avoiding redundant computations on the full query graph.
2Reliability
If the data graph is maintained over a long time window to identify long-term trends, then trend detection capability is improved, but the complexity of continuously updating and managing the data graph increases
Solution Approach 1:
The patent divides the time window into multiple segments or epochs, maintaining separate data graph representations for different time periods. This segmentation simplifies the management of long-term data by allowing independent processing and updating of each time segment without affecting the entire data graph.
Solution Approach 2:
The system applies different management strategies to different parts of the data graph based on their temporal characteristics. Recent data may be maintained with higher granularity and update frequency, while historical data uses coarser representations, optimizing both detection capability and management complexity.
3Reliability
If query graphs are decomposed into multiple query subgraphs to identify partial matches, then detection of emerging threats is improved, but the complexity of tracking and combining intermediate results increases
Solution Approach 1:
The system pre-establishes the hierarchical relationships and join conditions between query subgraphs before execution. This preliminary setup includes pre-computing mapping relationships and dependency structures, which simplifies the tracking and combining of partial matches during actual query execution.
Solution Approach 2:
The system implements feedback mechanisms where intermediate results from matching query subgraphs are continuously evaluated and used to guide subsequent matching operations. This feedback allows the system to prune search spaces and optimize the combination of partial matches based on actual findings rather than exhaustively processing all possibilities.
Data Source
AI summary
A query graph, which includes vertices and edges, represents a query on graph-structured data. The query graph is decomposed into query subgraphs. A network analysis tool performs continuous subgraph matching queries to facilitate analysis of computer network traffic, social media events, or other streams of data represented as a dynamic data graph (graph-structured data). This can help identify emerging trends in the data. Some features of the network analysis tool enhance performance by effectively utilizing distributed computing resources (including processing cores and memory at different nodes of a cluster) to speed up the process of updating the dynamic data graph and detecting matches of query subgraphs. Features of a query graph building tool enhance usability by providing intuitive ways to specify query graphs and their subgraphs. Features of a results visualization tool enhance usability by providing an intuitive way to present the results of continuous subgraph matching queries.