Abstract: Contextual graph matching based anomaly detection may include evaluating computer-generated log file data to create a master directed graph that specifies known events and transitions between the known events. The master directed graph may be processed to determine a plurality of decomposed master graph walks. Incoming computer-generated log file data may be evaluated to create an incoming directed graph that specifies unknown events and transitions between the unknown events. The incoming directed graph may be processed to determine a decomposed incoming walk. Overlap, distance difference, and correlation scores may be determined for each walk pair of a plurality of walk pairs including each of the plurality of decomposed master graph walks and the decomposed incoming walk. One of the decomposed master graph walks may be selected based on the overlap score, the difference score, and the correlation score, to detect an anomaly.

Abstract: A data lineage tracking system may include a memory storing a module comprising machine readable instructions to obtain trace log entries representing an interaction with, a manipulation of, and/or a creation of a data value. The data lineage tracking system may further include machine readable instructions to select the trace log entries that are associated with commands performed by an application, cluster similar trace log entries from the selected trace log entries, and analyze mappings between the clustered trace log entries to determine data lineage flow associated with the data value.

Abstract: Contextual graph matching based anomaly detection may include evaluating computer-generated log file data to create a master directed graph that specifies known events and transitions between the known events. The master directed graph may be processed to determine a plurality of decomposed master graph walks. Incoming computer-generated log file data may be evaluated to create an incoming directed graph that specifies unknown events and transitions between the unknown events. The incoming directed graph may be processed to determine a decomposed incoming walk. Overlap, distance difference, and correlation scores may be determined for each walk pair of a plurality of walk pairs including each of the plurality of decomposed master graph walks and the decomposed incoming walk. One of the decomposed master graph walks may be selected based on the overlap score, the difference score, and the correlation score, to detect an anomaly.

Abstract: Contextual graph matching based anomaly detection may include evaluating computer-generated log file data to create a master directed graph that specifies known events and transitions between the known events. The master directed graph may be processed to determine a plurality of decomposed master graph walks. Incoming computer-generated log file data may be evaluated to create an incoming directed graph that specifies unknown events and transitions between the unknown events. The incoming directed graph may be processed to determine a decomposed incoming walk. Overlap, distance difference, and correlation scores may be determined for each walk pair of a plurality of walk pairs including each of the plurality of decomposed master graph walks and the decomposed incoming walk. One of the decomposed master graph walks may be selected based on the overlap score, the difference score, and the correlation score, to detect an anomaly.

Abstract: Contextual graph matching based anomaly detection may include evaluating computer-generated log file data to create a master directed graph that specifies known events and transitions between the known events. The master directed graph may be processed to determine a plurality of decomposed master graph walks. Incoming computer-generated log file data may be evaluated to create an incoming directed graph that specifies unknown events and transitions between the unknown events. The incoming directed graph may be processed to determine a decomposed incoming walk. Overlap, distance difference, and correlation scores may be determined for each walk pair of a plurality of walk pairs including each of the plurality of decomposed master graph walks and the decomposed incoming walk. One of the decomposed master graph walks may be selected based on the overlap score, the difference score, and the correlation score, to detect an anomaly.

Abstract: A data lineage tracking system may include a memory storing a module comprising machine readable instructions to obtain trace log entries representing an interaction with, a manipulation of, and/or a creation of a data value. The data lineage tracking system may further include machine readable instructions to select the trace log entries that are associated with commands performed by an application, cluster similar trace log entries from the selected trace log entries, and analyze mappings between the clustered trace log entries to determine data lineage flow associated with the data value.