Geo-distributed computation and analytics using an input graph

1. A system comprising processing circuitry configured to:

process a computation request for a dataset to generate a compiled request comprising a plurality of functions, wherein the dataset comprises one or more geographically-distributed sets of data, the sets of data including a set of data that is located on or sourced by a device proximate to a proximate field node of a plurality of field nodes;

determine a cost function based on a cost of transporting the set of data from the proximate field node to one or more other field nodes of the plurality of field nodes using a network deployment of the plurality of field nodes and a computational cost for processing the set of data using the proximate field node;

process, based on the cost function, an input graph mapping the plurality of functions to the plurality of field nodes to generate an updated graph that modifies the input graph to map a first function of the plurality of functions to the proximate field node and to map a second function of the plurality of functions to a first field node of the plurality of field nodes, wherein to process the input graph, the processing circuitry is further configured to:

determine a layer of the input graph with a fewest number of nodes, wherein each node in the layer does not depend on any other nodes in the layer; and

move a mapping of the second function in the input graph from a second field node of the plurality of fields nodes to the first field node based on a determination that the second function is in the layer with the fewest number of nodes, wherein the second field node is mapped, in the updated graph, to one or more functions of the plurality of functions of another layer of the input graph that is different from the layer with the fewest number of nodes;

output, based on the updated graph mapping the first function to the proximate field node, a first request to the proximate field node to cause the proximate field node to process the set of data using the first function and output first modified data; and

output, based on the updated graph mapping the second function to the first field node, a second request to the first field node, wherein the second request is configured to cause the first field node to generate, based on the first modified data and using the second function, second modified data.

2. The system of claim 1 , wherein the input graph comprises a plurality of nodes that each represents one or more functions of a plurality of functions and a plurality of edges that each represents a corresponding data dependency between functions of the plurality of functions.

3. The system of claim 1 , wherein to process the input graph to generate the updated graph, the processing circuitry is configured to apply deep learning.

4. The system of claim 1 , wherein the updated graph comprises a decision tree or a feedforward neural network.

5. The system of claim 1 , wherein the updated graph comprises a hierarchical pipeline.

6. The system of claim 5 , wherein to process the input graph to generate the updated graph, the processing circuitry is configured to apply a logical reductive function.

7. The system of claim 1 , wherein to process the input graph to generate the updated graph, the processing circuitry is configured to map an auto-encoder to the network deployment of the plurality of field nodes.

8. The system of claim 1 , wherein the updated graph comprises a recurrent model.

9. The system of claim 1 , wherein the updated graph is non- acyclic.

10. The system of claim 1 , wherein to process the input graph to generate the updated graph, the processing circuitry is configured to apply a combination of one or more neural network models and one or more non-neural network models.

11. The system of claim 1 , wherein the computation request comprises a request to process streaming network data for network and information security and intrusion detection.

12. The system of claim 11 , wherein to process the streaming network data, the proximate field node is configured to generate behavioral analysis information and send information for the streaming network data to a cloud node.

13. The system of claim 12 , wherein the cloud node is configured to determine malware is detected in the system using the behavioral analysis information.

14. The system of claim 1 , wherein the first modified data comprises less data than the set of data and/or the second modified data comprises less data than the first modified data.

15. The system of claim 1 , wherein the updated graph further maps a third function of the plurality of functions to a third second field node of the plurality of field nodes; and

wherein the processing circuitry is further configured to output, based on the updated graph mapping the third function to the third field node, a third request to the third field node to cause the third field node to process the second modified data using the third function.

16. The system of claim 1 , wherein to process the input graph, the processing circuitry is further configured to:

move a mapping of the first function in the input graph from a third field node of the plurality of fields nodes to the proximate field node.

17. The system of claim 1 ,

wherein, the processing circuitry is configured to determine the cost function further based on a set of metrics, wherein the set of metrics comprises one or more of network latencies, policy requirements, or security requirements.

18. A method comprising:

processing, by processing circuitry, a computation request for a dataset to generate a compiled request comprising a plurality of functions, wherein the dataset comprises one or more geographically-distributed sets of data, the sets of data including a set of data that is located on or sourced by a device proximate to a proximate field node of a plurality of field nodes;

determining, by the processing circuitry, a cost function based on a cost of transporting the set of data from the proximate field node to one or more other field nodes of the plurality of field nodes using a network deployment of the plurality of field nodes and a computational cost for processing the set of data using the proximate field node;

processing, by the processing circuitry and based on the cost function, an input graph mapping the plurality of functions to the plurality of field nodes to generate an updated graph that modifies the input graph to map a first function of the plurality of functions to the proximate field node and to map a second function of the plurality of functions to a first field node of the plurality of field nodes, wherein processing the input graph further comprises:

determining a layer of the input graph with a fewest number of nodes, wherein each node in the layer does not depend on any other nodes in the layer; and

moving a mapping of the second function in the input graph from a second field node of the plurality of fields nodes to the first field node based on a determination that the second function is in the layer with the fewest number of nodes, wherein the second field node is mapped, in the updated graph, to one or more functions of the plurality of functions of another layer of the input graph that is different from the layer with the fewest number of nodes;

outputting, by the processing circuitry and based on the updated graph mapping the first function to the proximate field node, a first request to the proximate field node to cause the proximate field node to process the set of data using the first function and output first modified data; and

outputting, by the processing circuitry and based on the updated graph mapping the second function to the first field node, a second request to the first field node, wherein the second request is configured to cause the first field node to generate, based on the first modified data and using the second function, second modified data.

19. Non-transitory computer-readable storage media comprising instructions that, when executed, cause processing circuitry to:

process a computation request for a dataset to generate a compiled request comprising a plurality of functions, wherein the dataset comprises one or more geographically-distributed sets of data, the sets of data including a set of data that is located on or sourced by a device proximate to a proximate field node of a plurality of field nodes;

determine a cost function based on a cost of transporting the set of data from the proximate field node to one or more other field nodes of the plurality of field nodes using a network deployment of the plurality of field nodes and a computational cost for processing the set of data using the proximate field node;

process, based on the cost function, an input graph mapping the plurality of functions to the plurality of field nodes to generate an updated graph that modifies the input graph to map a first function of the plurality of functions to the proximate field node and to map a second function of the plurality of functions to a first field node of the plurality of field nodes, wherein to process the input graph, the instructions further cause the processing circuitry to:

determine a layer of the input graph with a fewest number of nodes, wherein each node in the layer does not depend on any other nodes in the layer; and

move a mapping of the second function in the input graph from a second field node of the plurality of fields nodes to the first field node based on a determination that the second function is in the layer with the fewest number of nodes, wherein the second field node is mapped, in the updated graph, to one or more functions of the plurality of functions of another layer of the input graph that is different from the layer with the fewest number of nodes;

output, based on the updated graph mapping the first function to the proximate field node, a first request to the proximate field node to cause the proximate field node to process the set of data using the first function and output first modified data; and

output, based on the updated graph mapping the second function to the first field node, a second request to the first field node, wherein the second request is configured to cause the first field node to generate, based on the first modified data and using the second function, second modified data.