Back to results
US 2017/0288979 A1Published application
Blue print graphs for fusing of heterogeneous alerts
AssigneeNEC Laboratories America, Inc.
InventorsKenji Yoshihira, Zhichun Li, Zhengzhang Chen, Haifeng Chen, Guofei Jiang, LuAn Tang
Life of this patent
Estimating the term…
Abstract
Methods and systems for reporting anomalous events include building a process graph that models states of process-level events in a network. A topology graph is built that models source and destination relationships between connection events in the network. A set of alerts is clustered based on the process graph and the topology graph. Clustered alerts that exceed a threshold level of trustworthiness are reported.
Claims18
A method for reporting anomalous events, comprising:
- building a process graph that models states of process-level events in a network using a processor;
- building a topology graph that models source and destination relationships between connection events in the network using the processor;
- clustering a set of alerts based on the process graph and the topology graph;
- and
- reporting clustered alerts that exceed a threshold level of trustworthiness.
2 more elements
A system for reporting anomalous events, comprising:
- a blue print update module comprising a processor configured to build a process graph that models states of process-level events in a network and to build a topology graph that models source and destination relationships between connection events in the network;
- a clustering module configured to cluster a set of alerts based on the process graph and the topology graph;
- and
- a user interface configured to report clustered alerts that exceed a threshold level of trustworthiness.
1 more element
Dependencies are inferred from the claim text.