FIELD: computer technology.
SUBSTANCE: effect is achieved by a) receiving data on message exchange between the network nodes; b) forming a graph based on the received data, in which the vertices are the identifiers of the network nodes, and the edges are the fact of message exchange between the nodes; c) using the resulting graph to determine the value of the shortest paths between all nodes of the network; d) generating a vector representation for each network node based on the obtained values of the shortest paths; e) reducing the number of dimensions of the resulting vector representations; f) clustering of the network nodes based on the vector representations obtained at stage e); g) forming the first model of interaction between the network nodes in which the nodes are grouped in accordance with the clustering performed; h) after a given time period, formation of the second model of interaction between the network nodes using iterative repetition of stages a) - g); i) performing a comparison of the first and the second models of interaction between the network nodes, during which the network nodes located in different groups are identified; and j) generating a signal characterizing the identifiers of the network nodes demonstrating anomalous interaction during comparison performed at stage i).
EFFECT: increased efficiency and speed of identifying anomalous interaction between computer network nodes.
5 cl, 3 dwg
