Back to results
US 11,693,958 B1Granted
Processing and storing event data in a knowledge graph format for anomaly detection
AssigneeRadiant Security, Inc.
InventorBarry Steiman
Life of this patent
Estimating the term…
Abstract
A technique for anomaly detection is disclosed. Event data is converted into a normalized common information model. The resulting data may be stored in an event data store database. Additionally, the resulting data may be stored in a knowledge graph representation in a knowledge graph database. The knowledge graph database efficiently stores event data to generate histograms on demand for common anomaly queries.
Claims20
A computer-implemented method for storing data for anomaly detection, comprising:
- monitoring event data in an information technology (IT) environment for at least one of machine users and human users;
- mapping collected event data into a common information model;
- inserting event data, mapped into the common information model, into an event store database;
- transforming the event data, mapped into the common information model, into a knowledge graph representation in which events are represented by nodes and links between nodes, with the links including attributes of time series data for event activity strings;
- wherein the knowledge graph representation is selected to store event data to generate histograms on demand for a set of common anomaly queries and to serve as an index into the event store database;
- and
- performing query processing using the knowledge graph representation as an index into event data in the event store database to answer a selected query.
4 more elements
A computer-implemented method for storing data for anomaly detection, comprising:
- monitoring event data in an information technology (IT) environment for at least one of machine users and human users;
- mapping collected event data into a common information model;
- inserting event data, mapped into the common information model, into an event store database;
- transforming the event data, mapped into the common information model, into a knowledge graph representation in which events are represented by nodes and links between nodes, with the links including attributes of time series data for event activity strings wherein the links include configuration filters for time series data indicative of one or more values of conditions associated with events, and wherein the knowledge graph representation is selected to store event data to generate histograms on demand for a set of common anomaly queries;
- and
- performing query processing by using the knowledge graph representation to generate histograms on demand to answer a selected query.
3 more elements
A computer-implemented method for storing data for anomaly detection, comprising:
- monitoring event data in an information technology (IT) environment for at least one of machine users and human users;
- mapping collected event data into a common information model;
- inserting event data, mapped into the common information model, into an event store database;
- transforming the event data, mapped into the common information model, into a knowledge graph representation in which events are represented by nodes and links between nodes, with the links including attributes of time series data for event activity strings wherein the links include configuration filters for time series data indicative of one or more values of conditions associated with events, and wherein the knowledge graph representation is selected to store event data to generate histograms on demand for a set of common anomaly queries;
- and
- performing anomaly detection by decoding the knowledge graph representation to generate at least one histogram on demand and using the at least one histogram to identify an anomaly.
3 more elements
A computer-implemented method for storing data for anomaly detection, comprising:
- monitoring event data in an information technology (IT) environment for at least one of machine users and human users;
- mapping collected event data into a common information model;
- inserting event data, mapped into the common information model, into an event store database;
- transforming the event data, mapped into the common information model, into a knowledge graph representation in which events are represented by nodes and links between nodes, with the links including attributes of time series data for event activity strings, wherein the knowledge graph representation is selected to store event data to generate histograms on demand for a set of common anomaly queries and to serve as an index into the event data for anomaly queries not directly answerable from data in the knowledge graph representation;
- performing query processing, including;
- in response to a selected query being directly answerable from data in the knowledge graph representation, generating a histogram from the knowledge graph representation to answer the query;
- and
- in response to the selected query not being directly answerable from the knowledge graph representation, using the knowledge graph representation as an index into the event store database to generate a histogram from the event data store to answer the selected query.
5 more elements
An anomaly detection system, comprising:
- a processor and a memory configured to implement a method including:
- monitoring event data in an information technology (IT) environment for at least one of machine users and human users;
- mapping collected event data into a common information model;
- inserting event data, mapped into the common information model, into an event store database;
- transforming the event data, mapped into the common information model, into a knowledge graph representation in which events are represented by nodes and links between nodes, with the links including attributes of time series data for event activity strings;
- wherein the knowledge graph representation is selected to store event data to generate histograms on demand for a set of common anomaly queries and to serve as an index into the event store database;
- and
- performing query processing using the knowledge graph representation as an index into event data in the event store database to answer a selected query.
5 more elements
A system comprising:
- a processor and a memory configured to implement a method including:
- monitoring event data in an information technology (IT) environment for at least one of machine users and human users;
- mapping collected event data into a common information model;
- inserting event data, mapped into the common information model, into an event store database;
- transforming the event data, mapped into the common information model, into a knowledge graph representation in which events are represented by nodes and links between nodes, with the links including attributes of time series data for event activity strings wherein the links include configuration filters for time series data indicative of one or more values of conditions associated with events, and wherein the knowledge graph representation is selected to store event data to generate histograms on demand for a set of common anomaly queries;
- and
- performing query processing using the knowledge graph representation to generate histograms on demand to answer a selected query.
4 more elements
A system comprising:
- a processor and a memory configured to implement a method including:
- monitoring event data in an information technology (IT) environment for at least one of machine users and human users;
- mapping collected event data into a common information model;
- inserting event data, mapped into the common information model, into an event store database;
- transforming the event data, mapped into the common information model, into a knowledge graph representation in which events are represented by nodes and links between nodes, with the links including attributes of time series data for event activity strings wherein the links include configuration filters for time series data indicative of one or more values of conditions associated with events, and wherein the knowledge graph representation is selected to store event data to generate histograms on demand for a set of common anomaly queries;
- and
- performing anomaly detection by decoding the knowledge graph representation to generate at least one histogram on demand and using the at least one histogram to identify an anomaly.
4 more elements
A system comprising:
- a processor and a memory configured to implement a method including:
- monitoring event data in an information technology (IT) environment for at least one of machine users and human users;
- mapping collected event data into a common information model;
- inserting event data, mapped into the common information model, into an event store database;
- transforming the event data, mapped into the common information model, into a knowledge graph representation in which events are represented by nodes and links between nodes, with the links including attributes of time series data for event activity strings, wherein the knowledge graph representation is selected to store event data to generate histograms on demand for a set of common anomaly queries and to serve as an index into the event data for anomaly queries not directly answerable from data in the knowledge graph representation;
- performing query processing, including:
- in response to a selected query being directly answerable from data in the knowledge graph representation, generating a histogram from the knowledge graph representation to answer the query;
- and
- in response to the selected query not being directly answerable from the knowledge graph representation, using the knowledge graph representation as an index into the event store database to generate a histogram from the event data store to answer the selected query.
6 more elements
Dependencies are inferred from the claim text.