HIGH-PERFORMANCE, DYNAMICALLY SPECIFIABLE KNOWLEDGE GRAPH SYSTEM AND METHODS
A system for dynamically specifiable knowledge graphs. The system uses an in-memory associative array for high-performance graph storage and access, with a non-volatile distributed database for scalable backup storage, a scalable, distributed graph service for graph creation, an indexing search engine to increase searching performance, and a graph crawler for graph traversal. The system may be provided as a set of cloud services. The cloud-based services may be containerized to allow for multitenant co-existence with no possibility of data leakage or cross-over. The system uses a cyber-physical graph to represent an enterprise's cyber-physical system and can provide graph analysis, graph security, and graph fusion related tasks to identify potential operational risks.
1 . A computing system for dynamically specifiable knowledge graphs, the computing system comprising:
one or more hardware processor configured for:
determining whether each of a plurality of data clumps complies with a schema comprising one or more entity definitions, one or more link definitions, and one or more attribute definitions;
assembling a new knowledge graph that is fully compliant with the schema by using only fully compliant data clumps;
instantiating the knowledge graph in an in-memory associative array; and
on receiving further data clumps, wherein the further data clumps are known to be fully compliant with the schema, adding the fully compliant further data clumps into the knowledge graph in the in-memory associative array.
2 . The computing system of claim 1 , wherein a graph access control subsystem assigns access rights to a user, the access rights allowing the user to interact with at least one node and its associated edges, of the knowledge graph.
3 . The computing system of claim 1 , wherein the processor is further configured for:
retrieving one or more known schemas from a database;
applying a known schema to the one or more data clumps;
identifying any errors in the application of the known schema to the data clumps and computing an error rate based on any identified errors;
wherein if the error rate is below a predetermined threshold value the known schema is added to a list; and
displaying the list to a user, wherein the user can optionally select a known schema from a plurality of known schemas on the list.
4 . The computing system of claim 1 , wherein the processor is further configured for:
receiving a network event associated with an observed event;
applying a known schema to create a constrained knowledge graph;
analyzing the constrained knowledge graph to identify a operational risk;
generating one or more subgraphs from the constrained knowledge graph based on the identified cybersecurity threat, wherein each subgraph maps the identified operational risk to a threat scenario;
performing graph fusion on the subgraphs to form a fused knowledge graph;
storing the fused knowledge graph in a database; and
presenting the fused knowledge graph to a user for graph analysis.
5 . The computing system of claim 1 , wherein the knowledge graph is a cyber-physical graph representing an enterprise's cyber-physical system.
6 . The computing system of claim 1 , wherein the distributed in-memory associative array is instantiated as a service in a containerized service management application.
7 . The computing system of claim 1 , wherein separate instances of the distributed in-memory associative array are used for each client as services in a containerized service management subsystem.
8 . A computer-implemented method for creating dynamically specifiable knowledge graphs, comprising the steps of:
determining whether each of a plurality of data clumps complies with a schema comprising one or more entity definitions, one or more link definitions, and one or more attribute definitions;
assembling a new knowledge graph that is fully compliant with the schema by using only fully compliant data clumps;
instantiating the knowledge graph in an in-memory associative array; and
on receiving further data clumps, wherein the further data clumps are known to be fully compliant with the schema, adding the fully compliant further data clumps into the knowledge graph in the in-memory associative array.
9 . The method of claim 8 , wherein a graph access control subsystem assigns access rights to a user, the access rights allowing the user to interact with at least one node and its associated edges, of the knowledge graph.
10 . The method of claim 8 , further comprising the steps of:
retrieving one or more known schemas from a database;
applying a known schema to the one or more data clumps;
identifying any errors in the application of the known schema to the data clumps and computing an error rate based on any identified errors;
wherein if the error rate is below a predetermined threshold value the known schema is added to a list; and
displaying the list to a user, wherein the user can optionally select a known schema from a plurality of known schemas on the list.
11 . The method of claim 8 , further comprising the steps of:
receiving a network event associated with an observed event;
applying a known schema to create a constrained knowledge graph;
analyzing the constrained knowledge graph to identify a operational risk;
generating one or more subgraphs from the constrained knowledge graph based on the identified cybersecurity threat, wherein each subgraph maps the identified operational risk to a threat scenario;
performing graph fusion on the subgraphs to form a fused knowledge graph;
storing the fused knowledge graph in a database; and
presenting the fused knowledge graph to a user for graph analysis.
12 . The method of claim 8 , wherein the knowledge graph is a cyber-physical graph representing an enterprise's cyber-physical system.
13 . The method of claim 8 , wherein the distributed in-memory associative array is instantiated as a service in a containerized service management application.
14 . The method of claim 13 , wherein separate instances of the distributed in-memory associative array are used for each client as services in a containerized service management subsystem.
15 . A system for dynamically specifiable knowledge graphs, comprising one or more computers with executable instructions that, when executed, cause the system to:
determine whether each of a plurality of data clumps complies with a schema comprising one or more entity definitions, one or more link definitions, and one or more attribute definitions;
assemble a new knowledge graph that is fully compliant with the schema by using only fully compliant data clumps; and
instantiate the knowledge graph in an in-memory associative array; and
on receiving further data clumps wherein the further data clumps are known to be fully compliant with the schema, add the fully compliant further data clumps into the knowledge graph in the in-memory associative array.
16 . The system of claim 15 , wherein a graph access control subsystem assigns access rights to a user, the access rights allowing the user to interact with at least one node and its associated edges, of the knowledge graph.
17 . The system of claim 15 , wherein the system is further configured to:
retrieve one or more known schemas from a database;
apply a known schema to the one or more data clumps;
identify any errors in the application of the known schema to the data clumps and compute an error rate based on any identified errors;
wherein if the error rate is below a predetermined threshold value the known schema is added to a list; and
display the list to a user, wherein the user can optionally select a known schema from a plurality of known schemas on the list.
18 . The system of claim 15 , wherein the system is further configured to:
receive a network event associated with an observed event;
apply a known schema to create a constrained knowledge graph;
analyze the constrained knowledge graph to identify a operational risk;
generate one or more subgraphs from the constrained knowledge graph based on the identified cybersecurity threat, wherein each subgraph maps the identified operational risk to a threat scenario;
perform graph fusion on the subgraphs to form a fused knowledge graph;
store the fused knowledge graph in a database; and
present the fused knowledge graph to a user for graph analysis.
19 . The system of claim 15 , wherein the knowledge graph is a cyber-physical graph representing an enterprise's cyber-physical system.
20 . The system of claim 15 , wherein the distributed in-memory associative array is instantiated as a service in a containerized service management application.
21 . The system of claim 20 , wherein separate instances of the distributed in-memory associative array are used for each client as services in a containerized service management subsystem.
22 . Non-transitory, computer-readable storage media having computer executable instructions embodied thereon that, when executed by one or more processors of a computing system for dynamically specifiable knowledge graphs, causes the computing system to:
determine whether each of a plurality of data clumps complies with a schema comprising one or more entity definitions, one or more link definitions, and one or more attribute definitions;
assemble a new knowledge graph that is fully compliant with the schema by using only fully compliant data clumps; and
instantiate the knowledge graph in an in-memory associative array; and
on receiving further data clumps wherein the further data clumps are known to be fully compliant with the schema, add the fully compliant further data clumps into the knowledge graph in the in-memory associative array.
23 . The media of claim 22 , wherein a graph access control subsystem assigns access rights to a user, the access rights allowing the user to interact with at least one node and its associated edges, of the knowledge graph.
24 . The media of claim 22 , wherein the computing system is further caused to:
retrieve one or more known schemas from a database;
apply a known schema to the one or more data clumps;
identify any errors in the application of the known schema to the data clumps and compute an error rate based on any identified errors;
wherein if the error rate is below a predetermined threshold value the known schema is added to a list; and
display the list to a user, wherein the user can optionally select a known schema from a plurality of known schemas on the list.
25 . The media of claim 22 , wherein the computing system is further caused to:
receive a network event associated with an observed event;
apply a known schema to create a constrained knowledge graph;
analyze the constrained knowledge graph to identify a operational risk;
generate one or more subgraphs from the constrained knowledge graph based on the identified cybersecurity threat, wherein each subgraph maps the identified operational risk to a threat scenario;
perform graph fusion on the subgraphs to form a fused knowledge graph;
store the fused knowledge graph in a database; and
present the fused knowledge graph to a user for graph analysis.
26 . The media of claim 22 , wherein the knowledge graph is a cyber-physical graph representing an enterprise's cyber-physical system.
27 . The system of claim 22 , wherein the distributed in-memory associative array is instantiated as a service in a containerized service management application.
28 . The system of claim 27 , wherein separate instances of the distributed in-memory associative array are used for each client as services in a containerized service management subsystem.