Patent attributes
A method for anomaly detection using grouping-based graph summarization is performed by one or more computing devices, each including one or more processors. The method includes identifying a first graph from a stream of incoming graphs, generating a first summary of the first graph, classifying the first summary in a first category, identifying a second graph from the stream of incoming graphs, generating a second summary of the second graph, comparing the first summary with the second summary, mapping the first summary and the second summary to the first category upon determining that the comparing indicates a similarity between the first summary and the second summary satisfies a graph similarity threshold, analyzing a frequency of graphs being mapped to graph categories, the graph categories including at least the first category, and detecting an anomaly in one of the graph categories based at least in part on the analysis.
