NETWORK DATA ANALYSIS

• US 20140207945A1
• Filed: 05/02/2013
• Published: 07/24/2014
• Est. Priority Date: 05/04/2012
• Status: Active Grant

• Current Assignee: Fishy & Madge Pty Limited
• Original Assignee: Fishy & Madge Pty Limited
• Inventors: GALLOWAY, John Julian, BROADWAY, Adam
• Granted Patent: US 9,148,347 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/149 for prediction of maintenance
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Apparatus for use in analyzing network data, the apparatus including an electronic processing device that determines network data representing a network having a number of nodes and links between the nodes, selects a model in accordance with a data type associated with the network data, the model being indicative of at least one trigger for a behaviour of interest, selected network metrics and a mathematical relationship relating network nodes to the at least one trigger using the selected network metrics and determines at least one trigger associated with the network data, determines the selected metrics for the network data and uses the mathematical relationship, the selected network metrics and the identified at least one trigger to determine predicted nodes, the predicted nodes being nodes predicted to exhibit behaviour of interest.

Claims

1. An apparatus for use in analyzing network data, the apparatus including an electronic processing device that:

a) determines network data representing a network having a number of nodes and links between the nodes;

b) selects a model in accordance with a data type associated with the network data, the model being indicative of;

i) at least one trigger for a behaviour of interest;

ii) selected network metrics; and

iii) a mathematical relationship relating network nodes to the at least one trigger using the selected network metrics; and

,

c) determines at least one trigger associated with the network data;

d) determines the selected metrics for the network data; and

,

e) uses the mathematical relationship, the selected network metrics and the identified at least one trigger to determine predicted nodes, the predicted nodes being nodes predicted to exhibit behaviour of interest.

2. The apparatus according to claim 1, wherein for network data from at least one first time period the electronic processing device:

a) calculates a range of different network metrics for the network;

b) determines nodes exhibiting a behaviour of interest;

c) determines potential triggers;

d) determines a mathematical relationship relating the identified nodes to the potential triggers using selected ones of the metrics; and

,

e) at least one of defines and refines the model in accordance with the identified triggers, the mathematical relationship and the selected ones of the metrics.

3. The apparatus according to claim 2, wherein the electronic processing device, determines predicted nodes for at least one second time period subsequent to the at least one first time period.

4. The apparatus according to claim 2, wherein the electronic processing device:

a) receives data indicative of the network data;

b) segments the data into at least one first time period and at least one second time period.

5. The apparatus according to claim 1, wherein the mathematical relationship is indicative of a weighted sum based at least partially on the selected network metrics and the at least one trigger, and wherein the electronic processing device:

a) calculates an index for at least some of the nodes using the weighted sum; and

,

b) determines the predicted nodes using the index.

6. The apparatus according to claim 5, wherein the index is at least partially indicative of at least one of a proximity and a connectivity of the respective node to at least one trigger associated with at least one node within the network.

7. The apparatus according to claim 5, wherein for network data from at least one first time period the electronic processing device:

a) calculates a plurality of indices for at least some of the nodes using a plurality of weighted sums; and

,

b) uses the indices and the behaving nodes to at least one of;

i) select a respective one of the plurality of weighted sums; and

,

ii) modify at least one of the plurality of weighted sums.

8. The apparatus according to claim 1, wherein the trigger is indicative of at least one of:

a) a node exhibiting a particular behaviour;

b) a node having predefined attributes; and

,

c) an event associated with or otherwise connected to at least one node within the network.

9. The apparatus according to claim 1, wherein the electronic processing device:

analyses the network data to determine one or more network structures; and

,

determines the selected metrics for the network structures.

10. The apparatus according to claim 9, wherein the network structures include groups of nodes, and wherein the electronic processing device determines the groups based on the connectivity of nodes.

11. The apparatus according to claim 10, wherein the electronic processing device:

a) determines connectivity metrics representing the connectivity of nodes; and

,

b) determines the groups using the connectivity metrics.

12. The apparatus according to claim 1, wherein the electronic processing device:

a) determines raw data indicative of network data;

b) determines nodes and links in the raw data; and

,

c) generates the network data using the nodes and links.

13. The apparatus according to claim 12, wherein the electronic processing device determines the nodes and links using a defined mapping.

14. The apparatus according to claim 12, wherein the electronic processing device filters the raw data so that at least some of the raw data is not converted to network data.

15. The apparatus according to claim 12, wherein the electronic processing device:

a) parses the raw data to identify data variables;

b) determines associations between the data variables and network nodes and links; and

,

c) defines a mapping indicative of the associations.

16. The apparatus according to claim 15, wherein the electronic processing device determines associations between the data variables and network nodes and links using a machine learning algorithm.

18. The apparatus according to claim 3, wherein the electronic processing device:

a) receives data indicative of the network data;

b) segments the data into at least one first time period and at least one second time period.

19. The apparatus according to claim 2, wherein the mathematical relationship is indicative of a weighted sum based at least partially on the selected network metrics and the at least one trigger, and wherein the electronic processing device:

a) calculates an index for at least some of the nodes using the weighted sum; and

b) determines the predicted nodes using the index.

20. The apparatus according to claim 3, wherein the mathematical relationship is indicative of a weighted sum based at least partially on the selected network metrics and the at least one trigger, and wherein the electronic processing device:

a) calculates an index for at least some of the nodes using the weighted sum; and

b) determines the predicted nodes using the index.

17. A method for use in analyzing network data, the method including, in an electronic processing device:

a) determining network data representing a network having a number of nodes and links between the nodes;

b) selecting a model in accordance with a data type associated with the network data, the model being indicative of;

i) at least one trigger for a behaviour of interest;

ii) selected network metrics; and

iii) a mathematical relationship relating network nodes to the at least one trigger using the selected network metrics; and

,

c) determining at least one trigger associated with the network data;

d) determining the selected metrics for the network data; and

,

e) using the mathematical relationship, the selected network metrics and the identified at least one trigger to determine predicted nodes, the predicted nodes being nodes predicted to exhibit behaviour of interest.