Aggregating results from multiple anomaly detection engines

Patent metadata

Field	Value
Publication number	US-12021885-B2
Application number	US-202017120335-A
Country	US
Kind code	B2
Filing date	Dec 14, 2020
Priority date	Dec 14, 2020
Publication date	Jun 25, 2024
Grant date	Jun 25, 2024

Abstract

Examples described herein provide a computer-implemented method that includes receiving a list of objects with anomaly detection results associated therewith. The method further includes generating a resource graph, wherein the resource graph comprises at least two nodes, each of the at least two nodes being associated with one of the objects. The method further includes determining a relationship between the at least two nodes. The method further includes assigning an anomaly score to at least one of the objects. The method further includes calculating for at least one of the nodes, an overall anomaly score for the at least one of the nodes based on the anomaly score for the at least one of the objects and based on the anomaly score for another node related to the at least one of the nodes.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, by a processing device, a list of objects with anomaly detection results associated therewith;
generating, by the processing device, a resource graph, wherein the resource graph comprises at least two nodes, each of the at least two nodes being associated with one of the objects;
determining, by the processing device, a type of a relationship between the at least two nodes, wherein the type of the relationship indicates a physical relationship between the resources represented by the at least two nodes and a summary method that is configured to generate a summary across multiple nodes having a same type of the relationship, wherein the summary method includes one of calculating an average value and identifying a maximum value;
labeling an edge of the resource graph between the at least two nodes with the type of the relationship;
assigning, by the processing device, an anomaly score to at least one of the objects; and
calculating, by the processing device, for at least one of the nodes, an overall anomaly score for the at least one of the nodes based on the anomaly score for the at least one of the objects and based on the anomaly score for another node related to the at least one of the nodes,
wherein the overall anomaly score for the at least one of the nodes is calculated using a weighted linear combination that combines the anomaly score from each of the at least two nodes multiplied by a weight that is determined based on the type of a relationship to the respective nodes, wherein the weight assigned to each of the type of a relationship is set by a user.

2. The computer-implemented method of claim 1 , further comprising:
determining whether the overall anomaly score for the at least one of the nodes exceeds a threshold.

3. The computer-implemented method of claim 2 , further comprising:
responsive to determining that the overall anomaly score for the at least one of the nodes exceeds the threshold, causing, by the processing device, an action to be taken to remedy at least one anomaly associated with the overall anomaly score that exceeds the threshold.

4. The computer-implemented method of claim 1 , wherein a user is presented with an interface to view the resource graph, wherein the interface enables the user to drill down on one or more portions of the resource graph to view details about the one or more of the at least two of the nodes.

5. A system comprising:
a memory comprising computer readable instructions; and
a processing device for executing the computer readable instructions, the computer readable instructions controlling the processing device to perform operations comprising:
receiving a list of objects with anomaly detection results associated therewith;
generating a resource graph, wherein the resource graph comprises at least two nodes, each of the at least two nodes being associated with one of the objects;
determining a type of a relationship between the at least two nodes, wherein the type of the relationship indicates a physical relationship between the resources represented by the at least two nodes and a summary method that is configured to generate a summary across multiple nodes having a same type of the relationship, wherein the summary method includes one of calculating an average value and identifying a maximum value;
labeling an edge of the resource graph between the at least two nodes with the type of the relationship;
assigning an anomaly score to at least one of the objects; and
calculating for at least one of the nodes, an overall anomaly score for the at least one of the nodes based on the anomaly score for the at least one of the objects and based on the anomaly score for another node related to the at least one of the nodes,

wherein the overall anomaly score for the at least one of the nodes is calculated using a weighted linear combination that combines the anomaly score from each of the at least two nodes multiplied by a weight that is determined based on the type of a relationship to the respective nodes, wherein the weight assigned to each of the type of a relationship is set by a user.

6. The system of claim 5 , wherein the operations further comprise:
determining whether the overall anomaly score for the at least one of the nodes exceeds a threshold.

7. The system of claim 6 , wherein the operations further comprise:
responsive to determining that the overall anomaly score for the at least one of the nodes exceeds the threshold, causing, by the processing device, an action to be taken to remedy at least one anomaly associated with the overall anomaly score that exceeds the threshold.

8. The system of claim 5 , wherein a user is presented with an interface to view the resource graph, wherein the interface enables the user to drill down on one or more portions of the resource graph to view details about the one or more of the at least two of the nodes.

9. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:
receiving a list of objects with anomaly detection results associated therewith;
generating a resource graph, wherein the resource graph comprises at least two nodes, each of the at least two nodes being associated with one of the objects;
determining a type of a relationship between the at least two nodes, wherein the type of the relationship indicates a physical relationship between the resources represented by the at least two nodes and a summary method that is configured to generate a summary across multiple nodes having a same type of the relationship, wherein the summary method includes one of calculating an average value and identifying a maximum value;
labeling an edge of the resource graph between the at least two nodes with the type of the relationship;
assigning an anomaly score to at least one of the objects; and
calculating for at least one of the nodes, an overall anomaly score for the at least one of the nodes based on the anomaly score for the at least one of the objects and based on the anomaly score for another node related to the at least one of the nodes,

wherein the overall anomaly score for the at least one of the nodes is calculated using a weighted linear combination that combines the anomaly score from each of the at least two nodes multiplied by a weight that is determined based on the type of a relationship to the respective nodes, wherein the weight assigned to each of the type of a relationship is set by a user.

10. The computer program product of claim 9 , wherein the operations further comprise:
determining whether the overall anomaly score for the at least one of the nodes exceeds a threshold.

11. The computer program product of claim 10 , wherein the operations further comprise:
responsive to determining that the overall anomaly score for the at least one of the nodes exceeds the threshold, causing, by the processing device, an action to be taken to remedy at least one anomaly associated with the overall anomaly score that exceeds the threshold.

Assignees

• IBM

Inventors

• Chan Yuk L
• Deedwaniya Anuja
• Abrams Robert M

Classifications

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title