Data investigation and visualization system

Inventors

FORSYTH, Kyle Nicolas • SANDERS, Mark Jason • KOROBOW, Adam Keith • MCCABE, Eric Richard • IVANCICH, Mychal William • Peters, David Michael • JENKINS, Cody Steven

Abstract

Data investigations are performed by querying a plurality of data sources. A system receives an investigation input and queries a plurality of data sources in accordance with the received input. The system receives, in response to the querying, response data from the plurality of data sources, and generates and stores a data structure representing relationships between the first investigation input and the first response data. The data structure may be in the form of a knowledge graph. The system may generate and display a visualization of the data structure. The system may generate and store a record of investigation steps used to generate the data structure, such that the investigation steps may be applied in future instances, for example using different inputs, to generate new data structures.

Core Innovation

A data investigation system receives a first investigation input at a query controller and queries a plurality of data sources in accordance with the first investigation input. It receives first response data from the plurality of data sources and generates and stores a data structure representing relationships between the first investigation input and the first response data, where the data structure comprises a knowledge graph. The system also generates and stores a record of a first set of investigation steps used to generate the data structure.

In accordance with the stored record of the first set of investigation steps, the system applies the first set of investigation steps to a plurality of different entities to generate a plurality of respective data structures. The system trains a machine learning algorithm based on the plurality of respective data structures, where training includes training the machine learning algorithm to classify data structures generated using the first set of investigation steps and generated with respect to different respective entities into one or a set of predefined classifications.

The system displays a visual representation of the data structure comprising the knowledge graph. The system receives a second investigation input at the query controller by detecting selection of a node of the visual representation of the knowledge graph, displays an indication of a set of options for generating investigation inputs based on the selected node, and in response queries the plurality of data sources in accordance with the second investigation input comprising the indication of the node and the selection of the option.

The system receives second response data from the plurality of data sources and augments the data structure, such that the data structure represents relationships between the second investigation input and the second response data.

Claims Coverage

The document includes three independent claim sets: a method for performing a data investigation, a system for performing the same data investigation, and a non-transitory computer-readable storage medium storing instructions to perform the same data investigation. Each independent claim includes five inventive features.

Across the independent claims, the invention is characterized by constructing and storing a knowledge graph data structure that represents relationships between investigation inputs and response data, recording investigation steps and re-applying them across different entities, training a machine learning algorithm to classify those data structures into one or a set of predefined classifications, and supporting interactive refinement by detecting selection of nodes in the knowledge-graph visualization to generate second investigation inputs that trigger additional querying and knowledge-graph augmentation.

Stated Advantages

Documented Applications