Processes for determining whether new subgraphs that are observed locally in dynamic graphs are indicative of anomalous behavior are disclosed. Community models including certain factors, such as the rate of creation of new subgraphs of given structures and labels, may provide a basis for measuring the likelihood of newly observed subgraphs. For instance, edge labels including attributes for these specific shapes, such as port numbers and/or other categories, may differentiate legitimate new local occurrences thereof from those that are anomalous. Such processes may have applications including anomaly detection in computer networks, distributed systems, other patterns of life applications including dynamic graphs (e.g., dynamic directed multi graphs), etc.
展开▼
