Contextual graph matching based anomaly detection

A method for contextual graph matching based anomaly detection, the method comprising:

• evaluating, by at least one processor, computer-generated log file data to create, in a computer memory, a master directed graph that specifies known events and transitions between the known events;
• processing, by the at least one processor, the master directed graph to identify a plurality of unique walks through the master directed graph, and to decompose the plurality of unique walks into their probability distributions as a plurality of decomposed master graph walks;
• evaluating, by the at least one processor, incoming computer-generated log file data to create an incoming directed graph that specifies unknown events and transitions between the unknown events;
• processing, by the at least one processor, the incoming directed graph to identify an incoming walk through the incoming directed graph, and to decompose the incoming walk into its probability distribution as a decomposed incoming walk;
• determining, by the at least one processor, an overlap score for each walk pair of a plurality of walk pairs including each of the plurality of decomposed master graph walks and the decomposed incoming walk by evaluating an intersection and a union of an edge set of one of the plurality of decomposed master graph walks and an edge set of the decomposed incoming walk;
• and
• selecting, by the at least one processor, one of the plurality of decomposed master graph walks based on the overlap score to detect an anomaly based on the selected one of the plurality of decomposed master graph walks.

A non-transitory computer readable medium having stored thereon machine readable instructions for contextual graph matching based anomaly detection, the machine readable instructions when executed cause a processor to:

• evaluate computer-generated log file data to create, in a computer memory, a master directed graph that specifies frequencies of state transitions within the master directed graph;
• process the master directed graph to identify a plurality of unique walks through the master directed graph, and to decompose the plurality of unique walks into their probability distributions as a plurality of decomposed master graph walks;
• evaluate incoming computer-generated log file data to create an incoming directed graph that specifies frequencies of state transitions within the incoming directed graph;
• process the incoming directed graph to identify an incoming walk through the incoming directed graph, and to decompose the incoming walk into its probability distribution as a decomposed incoming walk;
• determine a distance difference score for each walk pair of a plurality of walk pairs including each of the plurality of decomposed master graph walks and the decomposed incoming walk;
• and
• select one of the plurality of decomposed master graph walks based on the difference score, to detect an anomaly based on the selected one of the plurality of decomposed master graph walks.