This disclosure provides for a signal flow analysis-based exploration of security knowledge represented in a graph structure comprising nodes and edges. “Conductance” values are associated to each of a set of edges. Each node has an associated “toxicity” value representing a degree of maliciousness associated with the node. The conductance value associated with an edge is a function of at least the toxicity values of the nodes to which the edge is incident. A signal flow analysis is conducted with respect to an input node representing an observable associated with an offense. The flow analysis seeks to identify a subset of the nodes that, based on their conductance values, are reached by flow of a signal representing a threat, wherein signal flow over a path in the graph continues until a signal threshold is met. Based on the analysis, nodes within the subset are designated as hypothesis nodes for further examination.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method for cognitive analysis of security data using a knowledge graph comprising nodes and edges, comprising: associating conductance values to each of a set of edges in at least a portion of the knowledge graph; with respect to an input node representing an observable associated with an offense, conducting a signal flow analysis to identify a subset of the nodes that, based on their conductance values, are reached by flow of a signal representing a threat, wherein flow of the signal over a given path in the knowledge graph continues until a signal threshold is met; and associating nodes within the subset as hypothesis nodes, the hypothesis nodes representing a hypothesis to be examined to attempt to identify information in the knowledge graph representing a causal relationship that led to the offense. 2. The method as described in claim 1 wherein each node in the portion of the knowledge graph has an associated toxicity value representing a degree of maliciousness associated with the node. 3. The method as described in claim 2 wherein the conductance value associated with a given edge of the set of edges is a function of at least the toxicity values of the nodes to which the given edge is incident. 4. The method as described in claim 3 wherein the conductance value associated with the given edge is also an additional factor that is one of: an edge type, a confidence of an edge relation, a recency of an edge relation, and a source or destination node. 5. The method as described in claim 3 further including spreading a toxicity value associated with a given node to one or more of its neighboring nodes prior to conducting the signal flow analysis. 6. The method as described in claim 1 wherein the nodes in the subset that constitute the hypothesis are nodes that toxicity values that, relative to toxicity values of other nodes in the knowledge graph, are higher. 7. The method as described in claim 1 further including pruning nodes and edges that are not in any path from the input node to any node that is a hypothesis node. 8. An apparatus for cognitive analysis of security data using a knowledge graph comprising nodes and edges, comprising: a processor; computer memory holding computer program instructions executed by the processor, the computer program instructions operative to: associate conductance values to each of a set of edges in at least a portion of the knowledge graph; with respect to an input node representing an observable associated with an offense, conduct a signal flow analysis to identify a subset of the nodes that, based on their conductance values, are reached by flow of a signal representing a threat, wherein flow of the signal over a given path in the knowledge graph continues until a signal threshold is met; and associate nodes within the subset as hypothesis nodes, the hypothesis nodes representing a hypothesis to be examined to attempt to identify information in the knowledge graph representing a causal relationship that led to the offense. 9. The apparatus as described in claim 8 wherein each node in the portion of the knowledge graph has an associated toxicity value representing a degree of maliciousness associated with the node. 10. The apparatus as described in claim 9 wherein the conductance value associated with a given edge of the set of edges is a function of at least the toxicity values of the nodes to which the given edge is incident. 11. The apparatus as described in claim 8 wherein the conductance value associated with the given edge is also an additional factor that is one of: an edge type, a confidence of an edge relation, a recency of an edge relation, and a source or destination node. 12. The apparatus as described in claim 10 wherein the computer program instructions are further operative to spread a toxicity value associated with a given node to one or more of its neighboring nodes prior to conducting the signal flow analysis. 13. The apparatus as described in claim 8 wherein the nodes in the subset that constitute the hypothesis are nodes that toxicity values that, relative to toxicity values of other nodes in the knowledge graph, are higher. 14. The apparatus as described in claim 8 wherein the computer program instructions are further operation to prune nodes and edges that are not in any path from the input node to any node that is a hypothesis node. 15. A computer program product in a non-transitory computer readable medium for use in a data processing system for cognitive analysis of security data using a knowledge graph comprising nodes and edges, the computer program product holding computer program instructions that, when executed by the data processing system, are operative to: associate conductance values to each of a set of edges in at least a portion of the knowledge graph; with respect to an input node representing an observable associated with an offense, conduct a signal flow analysis to identify a subset of the nodes that, based on their conductance values, are reached by flow of a signal representing a threat, wherein flow of the signal over a given path in the knowledge graph continues until a signal threshold is met; and associate nodes within the subset as hypothesis nodes, the hypothesis nodes representing a hypothesis to be examined to attempt to identify information in the knowledge graph representing a causal relationship that led to the offense. 16. The computer program product as described in claim 15 wherein each node in the portion of the knowledge graph has an associated toxicity value representing a degree of maliciousness associated with the node. 17. The computer program product as described in claim 16 wherein the conductance value associated with a given edge of the set of edges is a function of at least the toxicity values of the nodes to which the given edge is incident. 18. The computer program product as described in claim 15 wherein the conductance value associated with the given edge is also an additional factor that is one of: an edge type, a confidence of an edge relation, a recency of an edge relation, and a source or destination node. 19. The computer program product as described in claim 17 wherein the computer program instructions are further operative to spread a toxicity value associated with a given node to one or more of its neighboring nodes prior to conducting the signal flow analysis. 20. The computer program product as described in claim 15 wherein the nodes in the subset that constitute the hypothesis are nodes that toxicity values that, relative to toxicity values of other nodes in the knowledge graph, are higher. 21. The computer program product as described in claim 15 wherein the computer program instructions are further operation to prune nodes and edges that are not in any path from the input node to any node that is a hypothesis node.