Detection of anomalous activities in an enterprise network

Abstract

An enterprise network has network assets, with each network asset having a network interface. A network graph has the network assets as nodes and connections between network interfaces of network assets as edges. An activity graph has nodes and edges, with each node representing a logical resource that performs an activity on the enterprise network, and each edge representing a relationship between the logical resources. Subgraphs of the activity graph are aligned to subgraphs of the network graph to create a mapping based on network assets associated with activities. Activity subgraphs that are aligned to the same network subgraph are compared for similarity to detect anomalous activities. The network graph is displayed at different hierarchical levels as a visualization on a display screen, with risk assessments overlayed on corresponding nodes on the visualization.