Graphical analysis to detect process object anomalies

• US 7,926,026 B2
• Filed: 12/20/2006
• Issued: 04/12/2011
• Est. Priority Date: 12/20/2006
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Zimmermann, Daniel, Wieczorek, Thomas, Sievi, Oliver, Klein, Udo, Pecht-Seibert, Guenter
• Primary Examiner(s): Zhen; Wei Y
• Assistant Examiner(s): Brophy; Matthew J
• Application Number:
  US11/613,413
• Publication Number:
  US 20080155335A1
• Time in Patent Office: 1,574 Days
• Field of Search: 717/104, 717/105, 717120-123
• US Class Current: 717/105
• CPC Class Codes: G06F 18/232 Non-hierarchical techniques
• CPC Class Codes: G06F 18/2433 Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection

Abstract

A method and system for graphical analysis to detect anomalies in process objects. The method generates a graph to represent a set of process objects, applies a clustering algorithm to cluster like nodes of the graph, compares the clusters to the process objects, and, if the objects match the clusters, accepts the objects for further review or for use in applications. If one or more of the objects do not match the clusters, such suggests that there are anomalies in the process objects requiring correction. An example implementation may be to detect anomalies in the design of the process objects.

Claims

1. A graphical analysis method to detect anomalies in objects, comprising:

generating a graph to represent a group of objects, each object having components comprising data and routines to manipulate the data and having structures to define relationships between the components of the object and between the components of the object and the components of the other objects,

wherein nodes of the graph represent the components of the objects, and

wherein edges of the graph connect the nodes of the graph and represent the defined relationships between the components of the objects and the defined relationships between the components of two or more of the objects;

forming clusters of the nodes of the graph;

in a first test, for each object, comparing the object to the clusters to match the object with one of the clusters,

if the object does not match one of the clusters, determining that the object includes at least one anomaly,

otherwise, in a second test, calculating performance metrics for the clusters, and

for each object,

calculating performance metrics data for the object, and

statistically comparing the metrics data for the object with metrics of the clusters; and

based on the statistical comparison, determining whether the objects include at least one anomaly.

2. The method of claim 1, wherein the generating comprises:

generating the nodes of the graph to represent the components of the objects,

generating the edges of the graph to represent the defined relationships between the components of the objects and the defined relationships between the components of two or more of the objects, and

connecting the nodes with the edges based on the defined relationships.

3. The method of claim 1, wherein the forming comprises:

applying a clustering algorithm to the graph to form the clusters of nodes based on a plurality of clustering parameters.

4. The method of claim 1, wherein the matching comprises:

designating the object as corresponding to the cluster if the difference between the metrics data for the cluster and the metrics data for the object is approximate to a predetermined value, within a predetermined range, or less than or greater than a predetermined limit.

5. The method of claim 1, wherein the determining comprises:

designating the objects as including at least one anomaly if one or more of the objects does not correspond to any of the clusters,

otherwise, designating the objects as free of anomalies.

6. The method of claim 1, wherein the determining comprises:

for each cluster,

designating the objects as including at least one anomaly if the cluster does not match any of the objects, wherein the anomaly is that the components represented by the nodes in the cluster should belong to a single object instead of belonging to multiple ones of the objects.

7. The method of claim 1, wherein the determining comprises:

for each object newly added to the group of objects,

designating the objects as including at least one anomaly if the clusters are very different from clusters generated prior to addition of the newly added object, wherein the anomaly is in either the newly added object or the other objects.

8. The method of claim 1, further comprising:

if an object is new, adding the new object to the group of objects.

9. The method of claim 1, further comprising:

upon detecting an anomaly, sending a message to a user regarding the detected anomaly;

awaiting receipt of revised objects from the user that correct the detected anomaly; and

upon receipt of the revised objects, repeating the generating, forming, comparing, and determining until no further anomalies are detected.

19. The method of claim 1, wherein the performance metrics associate a relationship parameter between the object and the clusters.

10. A system for graphically analyzing process objects to detect anomalies, comprising:

a memory to store a set of process objects; and

a processor in communication with the memory, the processor to;

map the process objects into a graph, including to

map components of the process objects into nodes of the graph, the components comprising data and routines to manipulate the data,

map structures of the process objects into edges of the graph, the structures defining relationships between the components of the process objects and relationships between components of two or more of the process objects, and

connect the nodes with the edges based on the defined relationships, cluster the nodes of the graph,

in a first test, for each object, compare the object to the clusters to match the object with one of the clusters,

if the object does not match one of the clusters, determine that the object includes at least one anomaly,

otherwise, in a second test, calculate performance metrics for the clusters, and

for each object,

 

calculate performance metrics data for the object, and

 

statistically compare the metrics data for the object with metrics of the clusters; and

based on the statistical comparison, determine whether the objects include at least one anomaly.

11. The system of claim 10, wherein the processor is to:

detect at least one anomaly in a process object if a cluster does not correspond to any of the process objects and at least one of the nodes of the cluster represents at least one component of the process object.

12. The system of claim 10, wherein the processor is to:

detect at least one anomaly in a process object if the clusters are very different than previous clusters made prior to introduction of the process object into the set of process objects.

20. The system of claim 10, wherein the performance metrics associate a relationship parameter between the object and the clusters.

13. A computer-readable storage medium including instructions, that when executed by a processor, are adapted to execute a method to detect anomalies in process objects, the method comprising:

generate a graphical representation of a group of process objects, wherein each process object comprises data, routines that manipulate the data, and definitions of associations between the process object and the other process objects in the group,

wherein nodes in the graphical representation correspond to the data and the routines of the process objects, and

wherein edges in the graphical representation correspond to the associations between the process objects and connect the nodes together based on the associations;

cluster the nodes in the graphical representation; and

in a first test, for each object, compare the object to the clusters to match the object with one of the clusters,

if the object does not match one of the clusters, determine that the object includes at least one anomaly,

otherwise, in a second test, calculate performance metrics for the clusters, and

for each object,

calculate performance metrics data for the object, and

statistically compare the metrics data for the object with metrics of the clusters; and

based on the statistical comparison, determine whether the objects include at least one anomaly.

14. The computer-readable storage medium of claim 13, further comprising:

introduce new process objects into the group of process objects to create a new group of process objects, and

generate the graphical representation of the new group of process objects.

15. The computer-readable storage medium of claim 13, further comprising:

replace anomalous process objects with revised process objects that have the detected anomaly removed in the group of process object to create a revised group of process objects, and

generate the graphical representation of the revised group of process objects.

16. The computer-readable storage medium of claim 13, wherein the statistical comparison comprises:

computing the performance metrics for the clusters and the process objects,

comparing the computed metrics for the clusters to the computed metrics for the process objects, and

detecting if the difference between the computed metrics are outside a predetermined limit.

17. The computer-readable storage medium of claim 13, further comprising:

determine that the anomaly is a design anomaly in the process objects requiring correction.

18. The computer-readable storage medium of claim 13, further comprising:

apply a clustering algorithm to the graphical representation to cluster the nodes that are deemed to be alike based a set of clustering parameters.

21. The computer-readable storage medium of claim 13, wherein the performance metrics associate a relationship parameter between the object and the clusters.