METHODS AND APPARATUS FOR A MULTI-GRAPH SEARCH AND MERGE ENGINE

• US 20200134076A1
• Filed: 10/25/2018
• Published: 04/30/2020
• Est. Priority Date: 10/25/2018
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Ogrinz, Michael, Linn, Heather
• Granted Patent: US 11,354,325 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 7/14 Merging, i.e. combining at least two sets of record carriers each arranged in the same ordered sequence to produce a single set having the same ordered sequence
• CPC Class Codes: G06F 7/36 Combined merging and sorting

Abstract

Aspects of the disclosure relate to a system for amalgamating a plurality of graphs. The system may include a set of graphs. A user may input search criteria via a user interface (“UI”) module. The system may search the set of graphs for a subset of qualifying graphs that satisfy the search criteria. The subset of graphs may be merged into an amalgamated graph. Merging the graphs may include superimposing the qualifying graphs over each other at a locus. The locus may be a node or a sub-graph. The amalgamated graph may be displayed via the UI module.

Claims

1. A multi-graph search and merge platform, said platform comprising:

a set of one or more graphs, at least one graph from said set of graphs comprising two or more nodes interconnected by one or more edges; and

a set of computer executable code, said computer executable code that, when run on a processor, is configured to;

receive as input a search criterion via a user interface (“

UI”

) module, said search criterion being a node profile or a subgraph profile;

search the set of graphs for a subset of graphs that each includes a node or subgraph that matches the node profile or subgraph profile of the search criterion;

merge all of the graphs from the subset of graphs into a merged graph, said merging comprising superimposing the subset of graphs on each other at the matching nodes or subgraphs; and

display the merged graph via the UI module.

2. The platform of claim 1, wherein each graph from the set of graphs defines a beginning and an end, and wherein, when more than one node or subgraph in a particular graph matches the search criterion, the matching node or subgraph that is closest to the beginning of the particular graph is selected as the matching node or subgraph at which the particular graph is superimposed on the other graphs in the subset of graphs.

3. The platform of claim 1, wherein merging the subset of graphs further comprises coloring each graph of the subset of graphs a distinct color selected from a set of colors.

4. The platform of claim 1, wherein each node of each graph in the set of graphs comprises an event, said event that is defined by a predetermined set of properties.

5. The platform of claim 4, wherein each edge of each graph in the set of graphs connects a first node to a second node, and the connection defines a causational relationship between said first and second nodes, said relationship wherein the event of the first node causes the event of the second node.

6. The platform of claim 4, wherein each event defines a cybersecurity incident, and the platform is configured to analyze past cybersecurity incidents and to predict potential future cybersecurity incidents.

7. The platform of claim 1, wherein the set of graphs is stored in a hybrid database, said hybrid database comprising a graph database and a relational database.

8. A dynamic platform for multi-graph searching and merging, said platform comprising:

a set of one or more graphs, at least one graph from said set of graphs comprising two or more nodes interconnected by one or more edges; and

a set of computer executable code, said computer executable code that, when run on a processor, is configured to;

receive as input a search criterion via a user interface (“

UI”

) module, said UI module that is configured to receive input and display output;

search the set of graphs for a subset of graphs that each satisfy the search criterion;

merge all of the graphs from the subset of graphs into a merged graph; and

display the merged graph as displayed output via the UI module.

9. The platform of claim 8, wherein the search criterion comprises a node profile, said node profile comprising a set of one or more node properties.

10. The platform of claim 9, wherein the subset of graphs comprises all of the graphs from the set of graphs that include at least one matching node, said matching node being a node that matches the node profile, and wherein merging the subset of graphs comprises:

selecting a matching node from a first graph in the subset of graphs as a locus node;

selecting a matching node from each of the remaining graphs as secondary nodes, said remaining graphs being all the graphs in the subset of graphs aside from the first graph; and

superimposing the remaining graphs onto the first graph by superimposing the secondary nodes onto the locus node to form a single merged graph.

11. The platform of claim 10, wherein each graph from the set of graphs defines a beginning and an end, and wherein the first matching node in the first graph is selected as the locus node and the first matching node in each of the remaining graphs are selected as the secondary nodes, the first matching node of a graph being a matching node that is closest to the beginning of said graph.

12. The platform of claim 8, wherein the search criterion comprises a subgraph profile, said subgraph profile comprising a set of nodes, each node from the set of nodes comprising a set of node properties, wherein the nodes from the set of nodes are connected in a particular arrangement via a set of edges.

13. The platform of claim 8, wherein merging the subset of graphs further comprises coloring each graph of the subset of graphs a distinct color selected from a set of colors.

14. The platform of claim 8, wherein:

each node of each graph in the set of graphs comprises an event, said event that is defined by a predetermined set of properties; and

each edge of each graph in the set of graphs connects a first node to a second node, and the connection defines a causational relationship between said first and second nodes, said relationship wherein the event of the first node causes the event of the second node.

15. The platform of claim 14, wherein each event defines a cybersecurity incident, and the platform is configured to analyze past cybersecurity incidents and to predict potential future cybersecurity incidents.

16. The platform of claim 8, further comprising a plurality of modes, wherein:

each node is associated with a plurality of values, and each value of the plurality of values corresponds to one mode of the plurality of modes;

the platform, when in a selected mode, is configured to display the values corresponding to the selected mode; and

the platform is configured to pivot from one mode to another.

17. The platform of claim 8, wherein the set of graphs is stored in a hybrid database, said hybrid database comprising a graph database and a relational database.

18. A method for amalgamating a plurality of graphs, said method comprising:

searching, via a processor, a set of graphs for all the graphs that satisfy a search criterion, said search criterion comprising a set of properties that is received as input;

forming a qualifying subset, said qualifying subset comprising the graphs that satisfy the search criterion;

amalgamating, via the processor, the graphs in the qualifying subset into a merged graph; and

displaying the merged graph on a display.

19. The method of claim 18, wherein the set of properties of the search criterion define either a node profile or a subgraph profile, and wherein a graph that satisfies the search criterion comprises a unifying node or a unifying subgraph, said unifying node or unifying subgraph that matches the search criterion, and wherein the amalgamating comprises superimposing the subset of graphs on each other at the unifying nodes or unifying subgraphs.

20. The method of claim 19, wherein, when more than one node or subgraph in a particular graph matches the search criterion, the matching node or subgraph that is closest to the beginning of the particular graph is selected as the unifying node or subgraph.