Process tree analysis using GraphDB

In modern cybersecurity and system monitoring, understanding the behavior and relationships between processes is essential for detecting anomalies, malware, and suspicious activities. Traditional relational databases have trouble showing complex hierarchies or linked process relationships. This paper introduces a method for analyzing process trees using a graph database, which provides a natural and efficient way to model and query the structure of processes. By representing processes, hosts, and users as distinct nodes and linking them through edges that capture relationships like parent–child processes, host-to-process connections, and user-to-process associations, a graph database allows fast traversal and provides rich contextual insights and deeper analysis of process trees. This approach helps in finding odd process behaviors, tracking where processes come from, and making it easier to look into threats. This method works well in places where there's a lot of changing and linked data, like in endpoint detection and response systems. Testing outcomes show how Graph DB successfully streamlines intricate process tree examination while boosting query speed when compared to conventional approaches.