Feature extraction and time series anomaly detection over dynamic graphs

A method of creating time series data from graph data for use in time series processing, comprising:

• receiving, by a processor, data including a plurality of graph snapshots for a plurality of consecutive periodic time samples, the data mapping between connected components in consecutive graph snapshots and describing at least one feature of each connected component, the mapping between the connected components including nodes representing entities in at least one computer network and edges representing relationships between the entities in the at least one computer network;
• recursively building, by the processor, a tree tracking an evolution of one of the connected components through the plurality of graph snapshots, the tree including a root node representing the connected component at a final one of the consecutive periodic time samples and a plurality of leaf nodes branching from the root node;
• extracting, by the processor, a plurality of paths from the tree, wherein each path is extracted by traversing the tree from the root node to one of the plurality of leaf nodes and each path contains data describing an evolution of a respective one of the connected components through time as indicated by evolution of the at least one feature of the respective one of the connected components;
• converting, by the processor, the graph data into time-series data compatible with a time series anomaly detection algorithm, by converting each of the plurality of paths into a respective numerical vector of a plurality of numerical vectors, the time series data tracking a change in the plurality of paths over time;
• and
• providing, by the processor, the plurality of numerical vectors as inputs to a time series anomaly detection algorithm executed by the processor or at least one other processor that detects anomalies in the at least one computer network based on the change in the plurality of paths over time.

A system for creating time series data from graph data for use in time series processing, comprising:

• a processor;
• and
• a non-transitory computer-readable medium in communication with the processor and configured to store instructions that, when executed by the processor, cause the processor to perform processing comprising:
• receiving data including a plurality of graph snapshots for a plurality of consecutive periodic time samples, the data mapping between connected components in consecutive graph snapshots and describing at least one feature of each connected component, the mapping between the connected components including nodes representing entities in at least one computer network and edges representing relationships between the entities in the at least one computer network;
• recursively building a tree tracking an evolution of one of the connected components through the plurality of graph snapshots, the tree including a root node representing the connected component at a final one of the consecutive periodic time samples and a plurality of leaf nodes branching from the root node;
• extracting a plurality of paths from the tree, wherein each path is extracted by traversing the tree from the root node to one of the plurality of leaf nodes and each path contains data describing an evolution of a respective one of the connected components through time as indicated by evolution of the at least one feature of the respective one of the connected components;
• converting the graph data into time-series data compatible with a time series anomaly detection algorithm, by converting each of the plurality of paths into a respective numerical vector of a plurality of numerical vectors, the time series data tracking a change in the plurality of paths over time;
• and
• providing the plurality of numerical vectors as inputs to a time series anomaly detection algorithm executed by the processor or at least one other processor that detects anomalies in the at least one computer network based on the change in the plurality of paths over time.