US 12,118,077 B2
Feature extraction and time series anomaly detection over dynamic graphs
Miriam Hanna Manevitz, Tel Aviv (IL); Liat Ben Porat Roda, Tel Aviv (IL); Or Basson, Tel Aviv (IL); Aviv Ben Arie, Tel Aviv (IL); and Hagai Fine, Tel Aviv (IL)
Assigned to Intuit Inc., Mountain View, CA (US)
Filed by Intuit Inc., Mountain View, CA (US)
Filed on Jan. 21, 2021, as Appl. No. 17/154,293.
Prior Publication US 2022/0229903 A1, Jul. 21, 2022
Int. Cl. H04L 9/40 (2022.01); G06F 16/901 (2019.01); G06F 17/16 (2006.01); G06F 21/55 (2013.01)
CPC G06F 21/552 (2013.01) [G06F 16/9027 (2019.01); G06F 17/16 (2013.01); H04L 63/1425 (2013.01); G06F 2221/034 (2013.01); G06F 2221/2101 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method of detecting network security anomalies from dynamic graph data comprising:
receiving, by a processor, data including a plurality of graph snapshots for a plurality of consecutive periodic time samples, the data including a mapping between connected components in consecutive graph snapshots and describing at least one feature of each connected component, the mapping between the connected components including nodes representing entities in at least one computer network and edges representing relationships between the entities in the at least one computer network;
recursively building, by the processor, a tree tracking an evolution of one of the connected components through the plurality of graph snapshots, the tree including a root node representing the connected component at a final one of the consecutive periodic time samples and a plurality of leaf nodes branching from the root node;
extracting, by the processor, a plurality of paths from the tree, wherein each path is extracted by traversing the tree from the root node to one of the plurality of leaf nodes and each path contains data describing an evolution of a respective one of the connected components through time as indicated by evolution of the at least one feature of the respective one of the connected components;
converting, by the processor, the dynamic graph data into time-series data compatible with a time series anomaly detection algorithm, by converting each of the plurality of paths into a respective numerical vector of a plurality of numerical vectors, the time series data tracking a change in the plurality of paths over time; and
executing, by the processor, the time series anomaly detection algorithm on the plurality of numerical vectors, thereby detecting, based on the change in the plurality of paths over time, at least one security anomaly in the at least one computer network in communication with the processor.