Abstract: What is disclosed is a method of operating a communication network, where the communication network comprises a set of users. The method includes obtaining usage activity for each of the users of the set and processing the usage activity to determine connectivity information between individual ones of the users of the set. The method also includes processing the connectivity information to determine users of the set with similar connectivity, and processing the users of the set with similar connectivity to identify a community of users within the users of the set with similar connectivity. The method also includes monitoring at least one of the users in the community to determine if action is needed for at least another one of the users in the community.

Abstract: An analysis system is described for identifying potentially malicious activity within a computer network. It performs this task by interacting with a user to successively remove known instances of non-malicious activity, to eventually reveal potentially malicious activity. The analysis system interacts with the user by inviting the user to apply labels to identified examples of network behavior; upon response by the user, the analysis system supplies new examples of network behavior to the user. In one implementation, the analysis system generates such examples using a combination of feature-based analysis and graph-based analysis. The graph-based analysis relies on analysis of graph structure associated with access events, such as by identifying entropy scores for respective portions of the graph structure.

Abstract: An analysis system is described for identifying potentially malicious activity within a computer network. It performs this task by interacting with a user to successively remove known instances of non-malicious activity, to eventually reveal potentially malicious activity. The analysis system interacts with the user by inviting the user to apply labels to identified examples of network behavior; upon response by the user, the analysis system supplies new examples of network behavior to the user. In one implementation, the analysis system generates such examples using a combination of feature-based analysis and graph-based analysis. The graph-based analysis relies on analysis of graph structure associated with access events, such as by identifying entropy scores for respective portions of the graph structure.