Transitive tensor analysis for detection of network activities

A computer implemented method for detection of network activities using transitive tensor analysis, the method comprising an act of:

• causing one or more processors to execute instructions encoded on one or more associated memories, each associated memory being a non-transitory computer-readable medium, such that upon execution, the one or more processors perform operations of:
• dividing a tensor, having a plurality of tensor modes, into a plurality of subtensors, wherein the tensor represents communications on a communications network comprising streaming network data;
• decomposing each subtensor, separately and independently on a separate processor, into a plurality of subtensor mode factors;
• using transitive mode factor matching, determining orderings of the plurality of subtensor mode factors;
• determining a set of subtensor factor coefficients for the plurality of subtensor mode factors;
• using the set of subtensor factor coefficients, determining the relative weighting of the plurality of subtensor mode factors;
• detecting a plurality of activity patterns represented by the plurality of subtensor mode factors;
• and
• based on the detection, generating an alert of an anomaly indicating a location of the anomaly in the communications network and a time of occurrence of the anomaly.

A computer program product for detection of network activities using transitive tensor analysis, the computer program product comprising:

• computer-readable instructions stored on a non-transitory computer-readable medium that are executable by a computer having one or more processors for causing the processor to perform operations of:
• dividing a tensor, having a plurality of tensor modes, into a plurality of subtensors, wherein the tensor represents communications on a communications network comprising streaming network data;
• decomposing each subtensor, separately and independently on a separate processor, into a plurality of subtensor mode factors;
• using transitive mode factor matching, determining orderings of the plurality of subtensor mode factors;
• determining a set of subtensor factor coefficients for the plurality of subtensor mode factors;
• using the set of subtensor factor coefficients, determining the relative weighting of the plurality of subtensor mode factors;
• detecting a plurality of activity patterns represented by the plurality of subtensor mode factors;
• and
• based on the detection, generating an alert of an anomaly indicating a location of the anomaly in the communications network and a time of occurrence of the anomaly.