Abstract: A method executable via operation of configured processing circuitry may include constructing a mutual information graph for categorical data with respect to observed attributes of a plurality of entities described in terms of respective ones of the observed attributes by the categorical data, determining a clique tree correlating attributes having at least a threshold level of mutual dependence among the observed attributes, and determining a normality rating for an entity relative to the plurality of entities based on the clique tree.

Abstract: An apparatus includes processing circuitry configured to execute instructions that, when executed, cause the apparatus to initialize a mixture model having a number of clusters including categorical data, iteratively update cluster assignments, evaluate cluster quality based on categorical density of the clusters, and prune clusters that have low categorical density, and determine an optimal mixture model based on the pruned clusters.

Abstract: A method for distributed graph processing is provided including receiving ingest data from at least one data source, generating, using processing circuitry, a data map comprising a graph of edges between a plurality of data vertices of the ingest data, determining at least two nodes of a cluster, and storing a portion of the ingest data and a portion of the data map at the at least two nodes.

Abstract: An apparatus includes processing circuitry configured to execute instructions that, when executed, cause the apparatus to initialize a mixture model having a number of clusters including categorical data, iteratively update cluster assignments, evaluate cluster quality based on categorical density of the clusters, and prune clusters that have low categorical density, and determine an optimal mixture model based on the pruned clusters.

Abstract: A method executable via operation of configured processing circuitry may include constructing a mutual information graph for categorical data with respect to observed attributes of a plurality of entities described in terms of respective ones of the observed attributes by the categorical data, determining a clique tree correlating attributes having at least a threshold level of mutual dependence among the observed attributes, and determining a normality rating for an entity relative to the plurality of entities based on the clique tree.

Abstract: A method and apparatus for generating a structured profile of activities and transitions is provided. The method includes receiving data related to a plurality of activities and a plurality of transitions, wherein each of the plurality of transitions is a path between a pair of activities among the plurality of activities, storing the data related to the plurality of activities and the plurality of transitions into the storage device, reducing a dimension of the data by indexing the data using state variables, generating a plurality of nodes, wherein each of the plurality of nodes corresponds to each of the plurality of activities, generating a plurality of links, wherein each of the plurality of links corresponds to each of the plurality of transitions, and storing the plurality of nodes and the plurality of links as the structured profile at the storage device.

Abstract: A method for distributed graph processing is provided including receiving ingest data from at least one data source, generating, using processing circuitry, a data map comprising a graph of edges between a plurality of data vertices of the ingest data, determining at least two nodes of a cluster, and storing a portion of the ingest data and a portion of the data map at the at least two nodes.