Aggregating results from multiple anomaly detection engines

A system comprising:

• a memory comprising computer readable instructions;
• and
• a processing device for executing the computer readable instructions, the computer readable instructions controlling the processing device to perform operations comprising:
• receiving a list of objects with anomaly detection results associated therewith;
• generating a resource graph, wherein the resource graph comprises at least two nodes, each of the at least two nodes being associated with one of the objects;
• determining a relationship between the at least two nodes;
• assigning an anomaly score to at least one of the objects;
• and
• calculating for at least one of the nodes, an overall anomaly score for the at least one of the nodes based on the anomaly score for the at least one of the objects and based on the anomaly score for another node related to the at least one of the nodes.

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:

• receiving a list of objects with anomaly detection results associated therewith;
• generating a resource graph, wherein the resource graph comprises at least two nodes, each of the at least two nodes being associated with one of the objects;
• determining a relationship between the at least two nodes;
• assigning an anomaly score to at least one of the objects;
• and
• calculating for at least one of the nodes, an overall anomaly score for the at least one of the nodes based on the anomaly score for the at least one of the objects and based on the anomaly score for another node related to the at least one of the nodes.