Event anomaly analysis and prediction

A method for event anomaly analysis and prediction, the method comprising:

• accessing at least one master directed graph that specifies known events and transitions between the known events;
• ranking each of the known events, wherein
• the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and
• the probability of anomalousness assigned to a known event of the known events is determined relative to each of the other known events;
• clustering each of the ranked known events into a plurality of anomaly categories;
• determining, based on the plurality of anomaly categories, a plurality of rules to analyze new events;
• accessing data that is to be analyzed for anomalies;
• identifying, based on an application of the plurality of rules to the data, selected ones of the anomalies in the data;
• determining, for the data, a plurality of objects of different sizes that represent different ones of the selected ones of the anomalies;
• and
• generating a display of the plurality of objects.

A non-transitory computer readable medium having stored thereon machine readable instructions for event anomaly analysis and prediction, the machine readable instructions, when executed, cause a processor to:

• access at least one master directed graph that specifies known events and transitions between the known events;
• rank each of the known events, wherein
• the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and
• the probability of anomalousness assigned to a known event of the known events is determined relative to each of the other known events;
• cluster each of the ranked known events into a plurality of anomaly categories;
• determine, based on the plurality of anomaly categories, a plurality of rules to analyze new events;
• access data that is to be analyzed for an anomaly;
• determine, based on an application of the plurality of rules to the data, whether the data includes the anomaly by
• determining, based on the master directed graph, a baseline activity graph,
• determining, based on the data, a real-time activity graph, and
• comparing the baseline activity graph to the real-time activity graph to determine whether the data includes the anomaly;
• and
• in response to a determination that the data includes the anomaly, control a device associated with the data.