Patent attributes
A plurality of graph snapshots for a plurality of consecutive periodic time samples maps between connected components in consecutive graph snapshots and describes at least one feature of each connected component. A recursively-built tree tracks an evolution of one of the connected components through the plurality of graph snapshots, the tree including a root node representing the connected component at a final one of the consecutive periodic time samples and a plurality of leaf nodes branching from the root node. A plurality of paths is extracted from the tree by traversing the tree from the root node to respective ones of the plurality of leaf nodes. Each path contains data describing an evolution of a respective one of the connected components through time as indicated by evolution of the at least one feature of the respective one of the connected components. Each of the plurality of paths is converted into a respective numerical vector of a plurality of numerical vectors that may be used as inputs to a time series anomaly detection algorithm.