# US 2017/0288979 A1 · Blue print graphs for fusing of heterogeneous alerts

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0288979 A1
- Document ID: US20170288979A1
- Status: Published application
- Kind: A1
- Application number: 15/477,625
- Filed: 2017-04-03
- Published: 2017-10-05
- Earliest claimed: 2016-04-04
- Assignees: NEC Laboratories America, Inc.
- Applicants: nec laboratories america, inc.
- Inventors: Kenji Yoshihira; Zhichun Li; Zhengzhang Chen; Haifeng Chen; Guofei Jiang; LuAn Tang
- Web page: https://patentgrep.com/patent/US20170288979A1

## CPC

- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- H04L 41/12: Discovery or management of network topologies
- H04L 41/142: using statistical or mathematical methods
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods and systems for reporting anomalous events include building a process graph that models states of process-level events in a network. A topology graph is built that models source and destination relationships between connection events in the network. A set of alerts is clustered based on the process graph and the topology graph. Clustered alerts that exceed a threshold level of trustworthiness are reported.

## Claims

### Claim 1

A method for reporting anomalous events, comprising:
building a process graph that models states of process-level events in a network using a processor;
building a topology graph that models source and destination relationships between connection events in the network using the processor;
clustering a set of alerts based on the process graph and the topology graph; and
reporting clustered alerts that exceed a threshold level of trustworthiness.

### Claim 2 (depends on 1)

The method of claim 1, further comprising trimming elements from the process graph and the topology graph if said elements have a last-connection-time value older than a threshold period.

### Claim 3 (depends on 1)

The method of claim 1, wherein building the process graph comprises creating a new process node in the process graph if a process node does not already exist in the process graph for a received process-level event.

### Claim 4 (depends on 3)

The method of claim 3, wherein building the process graph comprises creating a new object node in the process graph if an object node does not already exist in the process graph for the received process-level event.

### Claim 5 (depends on 4)

The method of claim 4, wherein building the process graph comprises creating a new edge between the process node and the object node if an edge does not already exist in the process graph between the process node and the object node.

### Claim 6 (depends on 5)

The method of claim 5, wherein building the process graph comprises updating a last-event-time value for the process node and the object node to a timestamp in the received process-level event.

### Claim 7 (depends on 1)

The method of claim 1, wherein building the topology graph comprises creating a new host node in the topology graph corresponding to a host node that does not already exist in the topology graph from a received network event.

### Claim 8 (depends on 7)

The method of claim 7, wherein building the topology graph comprises creating a new edge between host nodes indicated by the received network event if an edge does not already exist in the topology graph between said hosts.

### Claim 9 (depends on 8)

The method of claim 8, wherein building the topology graph comprises updating a last-event-time value for the hosts indicated by the received network event to a timestamp in the received network event.

### Claim 10

A system for reporting anomalous events, comprising:
a blue print update module comprising a processor configured to build a process graph that models states of process-level events in a network and to build a topology graph that models source and destination relationships between connection events in the network;
a clustering module configured to cluster a set of alerts based on the process graph and the topology graph; and
a user interface configured to report clustered alerts that exceed a threshold level of trustworthiness.

### Claim 11 (depends on 10)

The system of claim 10, wherein the blue print update module is further configured to trim elements from the process graph and the topology graph if said elements have a last-connection-time value older than a threshold period.

### Claim 12 (depends on 10)

The system of claim 10, wherein the blue print update module is further configured to create a new process node in the process graph if a process node does not already exist in the process graph for a received process-level event.

### Claim 13 (depends on 12)

The system of claim 12, wherein the blue print update module is further configured to create a new object node in the process graph if an object node does not already exist in the process graph for the received process-level event.

### Claim 14 (depends on 13)

The system of claim 13, wherein the blue print update module is further configured to create a new edge between the process node and the object node if an edge does not already exist in the process graph between the process node and the object node.

### Claim 15 (depends on 14)

The system of claim 14, wherein the blue print update module is further configured to update a last-event-time value for the process node and the object node to a timestamp in the received process-level event.

### Claim 16 (depends on 10)

The system of claim 10, wherein the blue print update module is further configured to create a new host node in the topology graph corresponding to a host node that does not already exist in the topology graph from a received network event.

### Claim 17 (depends on 16)

The system of claim 16, wherein the blue print update module is further configured to create a new edge between host nodes indicated by the received network event if an edge does not already exist in the topology graph between said hosts.

### Claim 18 (depends on 17)

The system of claim 17, wherein the blue print update module is further configured to update a last-event-time value for the hosts indicated by the received network event to a timestamp in the received network event.