GRAPH DATABASE ANALYSIS FOR NETWORK ANOMALY DETECTION SYSTEMS

• Main Authors: BURKETT, Robin Lynn, WENDT, Michael Evan, PATTERSON, Joshua, KRAUS, Keith, DIVALENTIN, Louis William
• Format: Patent
• Language: English; French; German
• Published: 07.03.2018
• Subjects: CALCULATING; COMPUTING; COUNTING; ELECTRIC COMMUNICATION TECHNIQUE; ELECTRIC DIGITAL DATA PROCESSING; ELECTRICITY; HANDLING RECORD CARRIERS; PHYSICS; PRESENTATION OF DATA; RECOGNITION OF DATA; RECORD CARRIERS; TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHICCOMMUNICATION

Graph database analysis for network anomaly detection systems, in which a data analysis device receives multiple log data entries including parameters associated with a computer network event in a computing network. The data analysis device extracts one or more parameters in real-time and generates a network event graph based on at least one of a first graph metric or a second graph metric. The first and second graph metrics are based on the one or more extracted parameters. The data analysis device detects, based on queries performed on the network event graph, at least one of an anomalous event associated with the computing network or a malicious event associated with the computing network.