Abstract: A system and method for identifying a threatening network is provided. The system comprises a network movement before/after algorithm that provides a graphical plot of changes in networks' communications activity from before to after a key event occurs, so that an analyst is able to identify anomalous behavior; a network progression algorithm that provides a graphical plot to analyze behavior in small increments of time without specification or emphasis upon a particular event, so that the analyst is able to see a trend in behavioral changes; a statistical network anomaly ranking algorithm that provides as output a ranked list of the networks; and an anomaly trend graphs algorithm that analyzes and visualizes the networks' anomaly scores over time, so that the analyst is able to see which networks are consistently suspicious, which networks accumulate more suspiciousness in response to an event, and which networks are trending toward more suspiciousness.

Abstract: An embodiment of the system and method for optimizing pattern query searches on a graph database uses a pattern query optimizer to optimize execution of the search plan for any sequence of SQL expressions by separating or breaking a pattern query into multiple subpattern queries before converting the subpattern queries into SQL expressions. An embodiment of the pattern query optimizer algorithmically, without intervention by an analyst, decomposes any pattern query into a set of subpattern queries by first identifying branches and cycles within a pattern query and then decomposing each identified branch and cycle into equivalent straight line paths, i.e., straight line nodes joined by edges. Cardinality may be used to improve the performance of pattern searches.