Abstract: In general, systems and methods for identifying anomalous activity are described. For example, systems and methods are described, in which patterns of unusual behavior can be identified by aggregating logged, or sampled, data into cells and annotating each cell with statistically derived measures of how extreme the cell is relative to, for example, historical behavior of corresponding characteristics or relative to, for example, behavior of characteristics from a general population. Cells that have more than a predefined number of such annotations can be identified as anomalous and can be investigated by a user or outright acted upon in an automatic, pre-defined way.

Abstract: An element order independent comparison of hierarchically organized data structures may be performed efficiently using a transformation operation that orthogonally and recursively encodes child node information. In some implementations, a hash table is defined for which values are encoded as powers of two. Each value is therefore orthogonal when combined using simple binary addition. At any particular node, a concatenation of node-specific information with a sum of child-node hashes is, itself, hashed and associated with the node. Orthogonal encodings ensure that a combination (e.g., an additive combination) of values corresponding to elements of a sub-hierarchy is insensitive to ordering of the elements. Recursion can be employed to fold in information contributions at successive layers of an information hierarchy.