System, method, and computer program product for network anomaly detection

A system comprising a server comprising at least one processor, the server programmed and/or configured to:

• receive event data associated with a plurality of events in a computer network in a sample time period, the event data comprising an aggregable parameter and
• each event of the plurality of events comprising a communication between at least two network computer nodes of a plurality of computer nodes in the computer network;
• determine a plurality of nested groups of the event data, wherein a lowest order group of the plurality of nested groups comprises a group of at least one computer node of the plurality of computer nodes, and wherein each group of the plurality of nested groups having a higher order than the lowest order group comprises, nested therein, at least one other group of the plurality of nested groups;
• and
• generate display data configured to cause a display of a computing device to show a first graphical representation of the event data, the first graphical representation comprising a plurality of nested graphical nodes and at least one spline;
• wherein,
• each graphical node of the plurality of nested graphical nodes is associated with a group of the plurality of nested groups or a computer node of the plurality of computer nodes,
• each graphical node of the plurality of nested graphical nodes encompasses and/or is encompassed by another graphical node of the plurality of nested graphical nodes,
• a size of each graphical node of the plurality of nested graphical nodes is proportional to an aggregated value of the aggregable parameter of each event associated with a computer node associated with the graphical node or a plurality of computer nodes comprised by a group associated with the graphical node,
• each spline of the at least one spline has endpoints comprising a pair of graphical nodes of the plurality of nested graphical nodes and comprises a curve that is generated from a path passing through a common graphical node that encompasses each graphical node of the pair of graphical nodes, and
• each spline of the at least one spline is associated with a communication between at least two computer nodes of the plurality of computer nodes.

A computer program product comprising at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to:

• receive event data associated with a plurality of events in a computer network in a sample time period, the event data comprising an aggregable parameter and each event of the plurality of events comprising a communication between at least two network computer nodes of a plurality of computer nodes in the computer network;
• determine a plurality of nested groups of the event data, wherein a lowest order group of the plurality of nested groups comprises a group of at least one computer node of the plurality of computer nodes, and wherein each group of the plurality of nested groups having a higher order than the lowest order group comprises, nested therein, at least one other group of the plurality of nested groups;
• and
• generate display data configured to cause a display of a computing device to show a first graphical representation of the event data, the first graphical representation comprising a plurality of nested graphical nodes and at least one spline;
• wherein,
• each graphical node of the plurality of nested graphical nodes is associated with a group of the plurality of nested groups or a computer node of the plurality of computer nodes,
• each graphical node of the plurality of nested graphical nodes encompasses and/or is encompassed by another graphical node of the plurality of nested graphical nodes,
• a size of each graphical node of the plurality of nested graphical nodes is proportional to an aggregated value of the aggregable parameter of each event associated with a computer node associated with the graphical node or a plurality of computer nodes comprised by a group associated with the graphical node,
• each spline of the at least one spline has endpoints comprising a pair of graphical nodes of the plurality of nested graphical nodes and comprises a curve that is generated from a path passing through a common graphical node that encompasses each graphical node of the pair of graphical nodes, and
• each spline of the at least one spline is associated with a communication between at least two computer nodes of the plurality of computer nodes.