US Patent 9202052 Dynamic graph anomaly detection framework and scalable system architecture

Machine generated event log data which includes event(s) occurring over a window of time is received where each event includes one or more events having a first node, a second node, and a timestamp. The events are aggregated into a plurality of aggregated graph snapshots. One or more communities are identified within the plurality of aggregated graph snapshots. One or more community tracking links are determined between communities in the plurality of aggregated graph snapshots. Communities in the plurality of aggregated graph snapshot which are anomalous are identified based on one or more of the following: a community level anomaly or an evolutionary path level anomaly.