Method and apparatus for grouping nodes based on connection characteristics
First Claim
Patent Images
1. A computer implemented method of correlating different results of role grouping, comprises:
- receiving in a computer system two sets of groupings of nodes on a network, each grouping of the nodes being according to connection characteristics of the nodes in the groups, with each of the sets having associated identifications;
correlating associated identifications of one set of groupings with those of the other set of groupings by;
determining a degree of similarity between a first node in the one set of groupings and a second node in the other set of groupings based on a number of connections that the first and second node have with a node one hop away over a plurality of time-periods, wherein similarity between host members in the groups is related to a sum of similarity values that the members in one group have with their similar neighbors in the other group;
computing a set of nodes that existed at time t−
1 but have been removed at time t, and a set of nodes that only appear at time t, to provide two sets of nodes that represent difference sets so that changes in the connection set of each host are as a result of changing connection patterns between the host and its neighbors that existed at time t; and
identifying the set of nodes that have not changed their neighbors between different executions of the role grouping; and
producing a result which indicates a structured view of the network based on the groupings.
21 Assignments
0 Petitions
Accused Products
Abstract
Techniques for correlating different results of role grouping includes receiving two sets of grouping of nodes on a network, grouping of the nodes according to connection characteristics of the nodes in the groups, each of the sets having associated identifications and correlating associated identifications of one set with those of the other set so that the two groups have the same identifications, if the member hosts of each set of groups have nearly identical connection habits.
13 Citations
49 Claims
-
1. A computer implemented method of correlating different results of role grouping, comprises:
-
receiving in a computer system two sets of groupings of nodes on a network, each grouping of the nodes being according to connection characteristics of the nodes in the groups, with each of the sets having associated identifications; correlating associated identifications of one set of groupings with those of the other set of groupings by; determining a degree of similarity between a first node in the one set of groupings and a second node in the other set of groupings based on a number of connections that the first and second node have with a node one hop away over a plurality of time-periods, wherein similarity between host members in the groups is related to a sum of similarity values that the members in one group have with their similar neighbors in the other group; computing a set of nodes that existed at time t−
1 but have been removed at time t, and a set of nodes that only appear at time t, to provide two sets of nodes that represent difference sets so that changes in the connection set of each host are as a result of changing connection patterns between the host and its neighbors that existed at time t; andidentifying the set of nodes that have not changed their neighbors between different executions of the role grouping; and producing a result which indicates a structured view of the network based on the groupings. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
-
-
15. A computer implemented method, comprises:
-
correlating in a computer system assigned identifiers associated with groups of hosts on a network that are in a first set of the groups, with assigned identifiers that are associated with groups of hosts on the network in a second set of the groups by; determining a degree of similarity between a first node in the first set of groups and a second node in the second set of groups based on a number of connections that the first and second node have with a node one hop away over a plurality of time-periods, wherein similarity between host members in the groups is related to a sum of similarity values that the members in one group have with their similar neighbors in the other group; computing a set of nodes that existed at time t−
1 but have been removed at time t, and a set of nodes that only appear at time t, to provide two sets of nodes that represent difference sets, so that changes in the connection set of each host are as a result of changing connection patterns between the host and its neighbors that existed at time t;identifying the set of nodes that have not changed their neighbors from between different executions of the role grouping; determining if both groups have a common host neighbor; and assigning a similarity value based on the minimum value of an average number of connections that members of the groups have with the common host neighbor; and producing a result which indicates a structured view of the network based on the first and second set of groups. - View Dependent Claims (16, 17, 18, 19, 20, 21, 22, 23, 24, 25)
-
-
26. Apparatus comprises:
-
a processor; a memory; and a non-transitory computer readable medium storing a computer program product for correlating groupings of nodes in a network, comprising instructions for causing the computer to; receive two sets of results of nodes on a network associated into groups according to connection characteristics of the nodes in the groups, each of the sets having associated identifiers (IDs); correlate IDs of one set with those of the other set so that the two groups have the same IDs by; determining a degree of similarity between a first node in one group of the two sets of results of nodes and a second node in a second set of the two sets of results of nodes based on a number of connections that the first and second node have with a node one hop away over a plurality of time-periods, wherein similarity between host members in the groups is related to a sum of similarity values that the members in one group have with their similar neighbors in the other group; computing a set of nodes that existed at time t−
1 but have been removed at time t and a set of nodes that only appear at time t, to provide two sets of nodes that represent difference sets so that changes in the connection set of each host are as a result of changing connection patterns between the host and its neighbors that existed at time t;identifying the set of nodes that have not changed their neighbors from between different executions of the role grouping; determining if both groups have a common host neighbor; and assigning a similarity value based on the minimum value of an average number of connections that members of the groups have with the common host neighbor; and produce a result which indicates a structured view of the network based on the two groups. - View Dependent Claims (27, 28, 29, 30, 31)
-
-
32. Apparatus comprises:
-
a processor; a memory; and a non-transitory computer readable medium storing a computer program product for correlating groupings of nodes in a network, comprising instructions for causing the computer to; correlate assigned identifiers associated with groups of hosts on a network that are in a first set of the groups, with assigned identifiers that are associated with groups of hosts on the network in a second set groups by; determining a degree of similarity between a first node in the first set of groups and a second node in the second set of groups based on a number of connections that the first and second node have with a node one hop away over a plurality of time-periods, wherein similarity between host members in the groups is related to a sum of similarity values that the members in one group have with their similar neighbors in the other group; computing a set of nodes that existed at time t−
1 but have been removed at time t, and a set of nodes that only appear at time t, to provide two sets of nodes that represent difference sets, so that changes in the connection set of each host are as a result of changing connection patterns between the host and its neighbors that existed at time t;identifying the set of nodes that have not changed their neighbors from between different executions of the role grouping; determining if both groups have a common host neighbor; and assigning a similarity value based on the minimum value of an average number of connections that members of the groups have with the common host neighbor; and produce a result which indicates a structured view of the network based on the two sets of groups. - View Dependent Claims (33, 34, 35, 36, 37)
-
-
38. A computer program product residing on a non-transitory computer readable medium for correlating groupings of nodes in a network, comprising instructions for causing the computer to:
-
receive two sets of results of nodes on a network associated into groups according to connection characteristics of the nodes in the groups, each of the sets having associated identifiers (IDs); correlate IDs of one set with those of the other set so that the two groups have the same IDs by; determining a degree of similarity between a first node in a first set of the two sets of results of nodes and a second node in a second set of the two sets of results of nodes based on a number of connections that the first and second node have with a node one hop away over a plurality of time-periods, wherein similarity between host members in the groups is related to a sum of similarity values that the members in one group have with their similar neighbors in the other group; computing a set of nodes that existed at time t−
1 but have been removed at time t, and a set of nodes that only appear at time t, to provide two sets of nodes that represent difference sets, so that changes in the connection set of each host are as a result of changing connection patterns between the host and its neighbors that existed at time t;identifying the set of nodes that have not changed their neighbors from between different executions of the role grouping; determining if both have a common host neighbor; and assigning a similarity value based on the minimum value of an average number of connections that members of the groups have with the common host neighbor; and assigning a similarity value based on the minimum value of an average number of connections that members of the groups have with the common host neighbor; and produce a result which indicates a structured view of the network based on the two sets of results of nodes. - View Dependent Claims (39, 40, 41, 42, 43)
-
-
44. A computer program product residing on a non-transitory computer readable medium for correlating groupings of nodes in a network, comprising instructions for causing the computer to:
-
correlate assigned identifiers associated with groups of hosts on a network that are in a first set of the groups, with assigned identifiers that are associated with groups of hosts on the network in a second set of the groups by; determining a degree of similarity between a first node in the first set of the groups and a second node in the second set of the groups based on a number of connections that the first and second node have with a node one hop away over a plurality of time-periods, wherein similarity between host members in the groups is related to a sum of similarity values that the members in one group have with their similar neighbors in the other group; computing a set of nodes that existed at time t−
1 but have been removed at time t, and a set of nodes that on at time t, to provide two sets of nodes that represent difference sets, so that changes in the connection set of each host are as a result of changing connection patterns between the host and its neighbors that existed at time t;identifying the set of nodes that have not changed their neighbors from between different executions of the role grouping; determining if both groups have a common host neighbor; and assigning a similarity value based on the minimum value of an average number of connections that members of the groups have with the common host neighbor; and produce a result which indicates a structured view of the network based on the first and second set of groups. - View Dependent Claims (45, 46, 47, 48, 49)
-
Specification