SYSTEMS AND METHODS FOR PREDICTION OF ANOMALIES

• US 20200136923A1
• Filed: 10/28/2018
• Published: 04/30/2020
• Est. Priority Date: 10/28/2018
• Status: Abandoned Application

• Current Assignee: Netz Forecasts Ltd.
• Original Assignee: Netz Forecasts Ltd.
• Inventors: ALTSHULER, Yaniv, Gordon, Goren
• Application Number:
  US16/172,808
• Publication Number:
  US 20200136923A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/288 Entity relationship models
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06Q 30/0251 Targeted advertisements
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 4/08 User group management

Abstract

There is provided a method for adapting components of a network, comprising: providing graphs each indicative of a respective sequential snapshot of a dynamic graph obtained over a historical time interval, wherein nodes of the graphs denote entities, and edges of the graphs denote interactions between the entities over a network, computing community graphs according to the graphs, computing meta-community graphs according to the community graphs, analyzing dynamics of the community graphs to detect changes between two temporally adjacent community graphs, analyzing dynamics of the meta-community graphs to detect changes between two temporally adjacent meta-community graphs, identifying at least one entity corresponding to node(s) of the dynamic graph according to a predicted likelihood of performing an anomalous action during a future time interval, and generating instructions for adapting component(s) of the network for ensuring availability of network resources for interactions between entities during the future time interval.

Claims

1. A method for identifying at least one node of a dynamic graph predicted to perform an anomalous action for adapting components of a network for ensuring availability of network resources for interactions between entities during a future time interval, comprising:

providing a plurality of graphs each indicative of a respective sequential snapshot of a dynamic graph obtained over a historical time interval, wherein nodes of the plurality of graphs denote entities, and edges of the plurality of graphs denote interactions between the entities over a network;

computing a plurality of community graphs according to the plurality of graphs;

computing a plurality of meta-community graphs according to the plurality of community graphs;

analyzing dynamics of the plurality of community graphs to detect changes between two temporally adjacent community graphs;

analyzing dynamics of the plurality of meta-community graphs to detect changes between two temporally adjacent meta-community graphs;

identifying at least one entity corresponding to at least one node of the dynamic graph according to a predicted likelihood of performing an anomalous action during a future time interval; and

generating instructions in response to the predicted likelihood of performing an anomalous action during a future time interval and the identified at least one entity for adapting at least one component of the network for ensuring availability of network resources for interactions between entities during the future time interval.

2. The method according to claim 1, wherein the generated instructions are selected from the group consisting of:

preventing the at least one entity from performing the prediction anomalous action, performing the predicted anomalous action earlier than the future time interval, performing another target action prior to the predicted anomalous action being performed by the at least one entity, and performing the anomalous action by another entity prior to the at least one entity performing the predicted anomalous action.

3. The method according to claim 1, wherein each respective community graph is computed according to each respective graph, each respective community graph including community nodes computed by assigning each node of each respective graph to one community node of the respective community graph.

4. The method according to claim 3, wherein each respective meta-community graph is computed according to each respective community graph, each respective meta-community graph comprising a plurality of meta-community nodes, wherein each community node of each respective community graph is assigned to one meta-community node, wherein weights between meta-community nodes are proportional to a number of edges between corresponding community nodes.

5. The method according to claim 1, wherein the changes between two temporally adjacent community graphs include at least one of:

a change in a weight between community nodes, and a change in structure of community nodes.

6. The method according to claim 1, wherein the changes between two temporally adjacent meta-community graphs include a transfer of communities between meta-community nodes.

7. The method according to claim 1, wherein the predicted likelihood of performing the anomalous action is computed according to the analyzed dynamics of the plurality of community graphs and the analyzed dynamics of the plurality of meta-community graphs.

8. The method according to claim 1, wherein the anomalous action predicted to be performed by the identified at least one node is selected from the group consisting of:

being a member of a community that split off from another community, being a member of a community that merged with another community, and being a member of a community that transferred between meta-communities.

9. The method according to claim 1, wherein temporally adjacent graphs of the plurality of graphs overlap in at least one common node, and each graph of the plurality of graphs has a unique combination of nodes and edges that is not present in any other graph.

10. The method according to claim 1, wherein the graphs are computed according to at least one dataset, wherein nodes of the graphs denote entities of records of the at least one dataset, and edges of the graphs denote interactions between entities of the records of the at least one dataset.

11. The method according to claim 1, wherein entities are selected from the group consisting of:

user accounts, wallets, social network accounts, bank accounts, shopping accounts, email accounts, gaming application, blockchain user accounts, mobile device, smartphone, standard phones, servers, applications being used by the user, and client terminals, and interactions are selected from the group consisting of;

calls, multimedia objects sent from one entity to another entity, financial transactions, a game played by two or more entities, transactions associated with smart contracts, and transfer of blockchain-based tokens or cryptocurrencies.

12. The method according to claim 1, wherein the communities of each respective community graph of the plurality of community graphs are computed according to an initial community seed according to the communities computed for the previous community graph.

13. The method according to claim 5, wherein the change in weight between communities is selected from the group consisting of:

increase in weight, decreasing in weight, or disappearance of the weight.

14. The method according to claim 5, wherein the change in structure of community nodes is selected from the group consisting of:

appearance of a new community node, disappearance of a previously existing community node, split of a single existing community node into two or more communities, and unification of two or more communities into a single community.

15. The method according to claim 1, wherein the predicted likelihood of performing the anomalous action is computed according to a predicted likelihood of unification of two or more communities into a single community, wherein the identified at least one entity corresponding to the at least one node is a member of one of the two or more communities unified into the single community.

16. The method according to claim 14, wherein the unification of two or more communities into the single community is predicted for the future time interval according to change in weight between the two or more communities computed over the historical time interval.

17. The method according to claim 15, wherein the change in weight comprises a computed trend indicative of relative increase in weight over a plurality of temporally sequential community graphs.

18. The method according to claim 1, wherein the predicted likelihood of performing the anomalous action is computed according to a predicted likelihood of transfer of one community between two meta-communities.

19. The method according to claim 18, wherein the predicted likelihood of transfer of one community between two meta-communities is computed according to change in weight between the one community and each of the two meta-communities.

20. The method according to claim 19, wherein the transfer of one community from a first meta-community to a second meta-community of the two meta-communities is predicted according to computed pattern indicative of an increase in the weight between the one community and the second meta-community and a decrease in the weight between the one community and the first meta-community over a plurality of temporally sequentially meta-community graphs.

21. The method according to claim 1, wherein the predicted likelihood of performing the anomalous action is computed by extrapolating the analyzed dynamics of the plurality of community graphs and the meta-community graphs over the historical time interval into the future time interval.

22. The method according to claim 21, wherein the extrapolation the analyzed dynamics comprises extrapolating weights between community nodes of a sequence of temporally adjacent community graphs over the historical time interval for predicting weights into the future time interval.

23. The method according to claim 22, further comprising predicting according to the predicted weights, at least one of:

a change in structure of communities, and a transfer of communities between meta-communities, wherein the at least one entity corresponding to the at least one node identified according to the predicted likelihood of performing the anomalous action is a member of a community experiencing a structural change and/or a member of the community transferred between meta-communities.

24. The method according to claim 1, wherein the predicted likelihood of performing an anomalous action is performed by a trained statistical classifier that is provided at least one of:

a sequence of weights between community nodes of temporally adjacent community graphs, and a sequence of weights between meta-community nodes of temporally adjacent meta-community graphs, the statistical classifier trained on a training dataset including at least one of;

a plurality of training sequences comprising weights between community nodes of temporally adjacent training community graphs, a plurality of training sequences of weights between meta-community nodes of temporally adjacent training meta-community graphs, and associated indication of training anomalous actions.

25. The method according to claim 1, further comprising detecting anomalous actions performed by at least one entity corresponding to the at least one node during the historical time interval.

26. The method according to claim 1, wherein the predicted likelihood of performing the anomalous action is further computed according to at least one of a sequence of a plurality of meta-community parameters of meta-community nodes of sequential temporally adjacent meta-community graphs, and a sequence of a plurality of community parameters of community nodes of sequential temporally adjacent community graphs.

27. The method according to claim 26, wherein the meta-community parameters are selected from the group consisting of:

number of community nodes in respective meta-community nodes, and average degree, wherein the community parameters are selected from the group consisting of;

number of nodes in respective community nodes, and average degree.

28. The method according to claim 1, wherein the instructions are for providing targeted advertisements to the identified at least one entity.

29. A system for identifying at least one node of a dynamic graph predicted to perform an anomalous action for adapting components of a network for ensuring availability of network resources for interactions between entities during a future time interval, comprising:

at least one hardware processor; and

a non-transitory memory having stored thereon a code for execution by the at least one hardware processor, the code comprising instructions for;

providing a plurality of graphs each indicative of a respective sequential snapshot of a dynamic graph obtained over a historical time interval, wherein nodes of the plurality of graphs denote entities, and edges of the plurality of graphs denote interactions between the entities over a network;

computing a plurality of community graphs according to the plurality of graphs;

computing a plurality of meta-community graphs according to the plurality of community graphs;

analyzing dynamics of the plurality of community graphs to detect changes between two temporally adjacent community graphs;

analyzing dynamics of the plurality of meta-community graphs to detect changes between two temporally adjacent meta-community graphs; and

identifying at least one entity corresponding to at least one node of the dynamic graph according to a predicted likelihood of performing an anomalous action during a future time interval; and

generating instructions in response to the predicted likelihood of performing an anomalous action during a future time interval and the identified at least one entity for adapting at least one component of the network for ensuring availability of network resources for interactions between entities during the future time interval.

30. A computer program product for identifying at least one node of a dynamic graph predicted to perform an anomalous action for adapting components of a network for ensuring availability of network resources for interactions between entities during a future time interval, comprising:

a non-transitory memory having stored thereon a code for execution by at least one hardware processor, the code comprising instructions for;

providing a plurality of graphs each indicative of a respective sequential snapshot of a dynamic graph obtained over a historical time interval, wherein nodes of the plurality of graphs denote entities, and edges of the plurality of graphs denote interactions between the entities over a network;

computing a plurality of community graphs according to the plurality of graphs;

computing a plurality of meta-community graphs according to the plurality of community graphs;

analyzing dynamics of the plurality of community graphs to detect changes between two temporally adjacent community graphs;

analyzing dynamics of the plurality of meta-community graphs to detect changes between two temporally adjacent meta-community graphs; and

identifying at least one entity corresponding to at least one node of the dynamic graph according to a predicted likelihood of performing an anomalous action during a future time interval; and

generating instructions in response to the predicted likelihood of performing an anomalous action during a future time interval and the identified at least one entity for adapting at least one component of the network for ensuring availability of network resources for interactions between entities during the future time interval.