Back to results
US 11,153,339 B1Granted
Using graph-based models to identify datacenter anomalies
AssigneeLacework Inc.
InventorsVikram Kapoor, Samuel Joseph Pullara, III, Murat Bog, Yijou Chen, Sanjay Kalra
Life of this patent
Estimating the term…
Abstract
Activities within a network environment are monitored (e.g., using agents). At least a portion of the monitored activities are used to generate a logical graph model. The generated logical graph model is used to determine an anomaly. The detected anomaly is recorded and can be used to generate an alert.
Claims33
A system, comprising:
- a processor configured to:
- monitor activities within a network environment;
- generate a multidimensional logical graph model comprising a set of nodes and a set of edges using at least a portion of the monitored activities;
- and
- determine, using the generated logical graph model, an anomaly, and in response to detecting the anomaly, record the anomaly;
- wherein a first node included in the set of nodes corresponds to an entity of a first type and wherein a second node included in the set of nodes corresponds to an entity of a second type that is different from the first type;
- wherein the first node comprises a plurality of individual elements clustered together;
- wherein a first edge connects the first node and the second node and wherein the first edge has a first edge type;
- wherein a second edge connects the second node and a third node and wherein the second edge has a second edge type that is different from the first edge type;
- and
- wherein the first edge type indicates a first type of behavioral relationship between arbitrary nodes interconnected by the first edge type and wherein the second edge type indicates a different type of behavioral relationship between two arbitrary nodes interconnected by the second edge type;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
10 more elements
A method, comprising:
- monitoring activities within a network environment;
- generating a multidimensional logical graph model comprising a set of nodes and a set of edges using at least a portion of the monitored activities;
- and
- determining, using the generated logical graph model to detect an anomaly, and in response to detecting the anomaly, recording the anomaly;
- wherein a first node included in the set of nodes corresponds to an entity of a first type and wherein a second node included in the set of nodes corresponds to an entity of a second type that is different from the first type;
- wherein the first node comprises a plurality of individual elements clustered together;
- wherein a first edge connects the first node and the second node and wherein the first edge has a first edge type;
- wherein a second edge connects the second node and a third node and wherein the second edge has a second edge type that is different from the first edge type;
- and
- wherein the first edge type indicates a first type of behavioral relationship between arbitrary nodes interconnected by the first edge type and wherein the second edge type indicates a different type of behavioral relationship between two arbitrary nodes interconnected by the second edge type.
7 more elements
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- monitoring activities within a network environment;
- generating a multidimensional logical graph model comprising a set of nodes and a set of edges using at least a portion of the monitored activities;
- and
- determining, using the generated logical graph model to detect an anomaly, and in response to detecting the anomaly, recording the anomaly;
- wherein a first node included in the set of nodes corresponds to an entity of a first type and wherein a second node included in the set of nodes corresponds to an entity of a second type that is different from the first type;
- wherein the first node comprises a plurality of individual elements clustered together;
- wherein a first edge connects the first node and the second node and wherein the first edge has a first edge type;
- wherein a second edge connects the second node and a third node and wherein the second edge has a second edge type that is different from the first edge type;
- and
- wherein the first edge type indicates a first type of behavioral relationship between arbitrary nodes interconnected by the first edge type and wherein the second edge type indicates a different type of behavioral relationship between two arbitrary nodes interconnected by the second edge type.
7 more elements
Dependencies are inferred from the claim text.