Abstract: Provided are a system, method, and computer program product for network anomaly detection. The method includes determining a plurality of nested groups based on event data associated with a plurality of communications in a computer network. The method also includes generating display data configured to cause a display of a computing device to show a first graphical representation of the event data including a plurality of nested graphical nodes. The method further includes receiving new event data associated with a plurality of new communications in the computer network in a subsequent time period and generating new display data configured to cause the display to show a new graphical representation of the new event data. The method further includes determining an anomalous graphical node based at least partly on a size of the anomalous graphical node being increased in the new graphical representation relative to the first graphical representation.

Abstract: Provided are a system, method, and computer program product for network anomaly detection. The method includes receiving event data associated with a plurality of events in a computer network. The method also includes determining nested groups of the event data representing tiers of an operational hierarchy. The method further includes generating display data to show a graphical representation of the event including a plurality of nested graphical nodes and at least one spline. Each graphical node is associated with a group or a computer node, each graphical node encompasses and/or is encompassed by another graphical node, a size of each graphical node is proportional to an aggregated parameter value of events associated therewith, each spline connects at least two graphical nodes and includes a curve that passes through a common graphical node, and each spline is associated with a communication between at least two computer nodes.

Abstract: Provided are a system, method, and computer program product for network anomaly detection. The method includes receiving event data associated with a plurality of events in a computer network. The method also includes determining nested groups of the event data representing tiers of an operational hierarchy. The method further includes generating display data to show a graphical representation of the event including a plurality of nested graphical nodes and at least one spline. Each graphical node is associated with a group or a computer node, each graphical node encompasses and/or is encompassed by another graphical node, a size of each graphical node is proportional to an aggregated parameter value of events associated therewith, each spline connects at least two graphical nodes and includes a curve that passes through a common graphical node, and each spline is associated with a communication between at least two computer nodes.