Extensible query interface for dynamic data compositions and filter applications

• US 10,614,071 B1
• Filed: 09/18/2018
• Issued: 04/07/2020
• Est. Priority Date: 11/27/2017
• Status: Active Grant

• Current Assignee: Lacework Inc.
• Original Assignee: Lacework Inc.
• Inventors: Chen, Yijou, Kalra, Sanjay, Kapoor, Vikram
• Primary Examiner(s): Shaw, Peter C
• Application Number:
  US16/134,806
• Time in Patent Office: 567 Days
• Field of Search: 726 22
• CPC Class Codes: G06F 16/2456 Join operations
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9537 Spatial or temporal dependent retrieval, e.g. spatiotemporal queries
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/545 where tasks reside in different layers, e.g. user- and kernel-space
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A request to filter information associated with activities within a network environment is received. As one example, the request to filter is triggered by a user interaction with a graph. As another example, the request to filter is triggered by a user interaction with a query field. In response to receiving the filter request, a query is generated based on an implicit join using a query service.

Claims

1. A system, comprising:

a processor configured to;

receive, in response to a user interaction with a graph that comprises a plurality of nodes, wherein at least one node included in the graph is associated with an activity within a network environment, a request to filter information associated with activities within the network environment; and

in response to receiving the filter request, generate a query based on an implicit join using a query service, wherein generating the query includes constructing a join graph and traversing the join graph to locate a shortest path and wherein generating the query also includes finding a join path; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein the request to filter information is received in response to a user clicking on a visual representation of at least a portion of the graph.

3. The system of claim 1 wherein the request to filter information is received in response to a user interaction with a query field.

4. The system of claim 1 wherein the processor is further configured to perform the generated query against a database.

5. The system of claim 1 wherein the join graph comprises a list of join links.

6. The system of claim 5 wherein a given join link maintains a reverse map from an entity to a filter key.

7. The system of claim 1 wherein finding the join path includes performing a traversal.

8. The system of claim 7 wherein the traversal comprises a breadth first traversal.

9. The system of claim 7 wherein the traversal is performed using a priority order list of join links for all entities sharing an implicit join group.

10. The system of claim 7 wherein the traversal is stopped when a node is reached which has at least one local filter.

11. The system of claim 1 wherein generating the query includes selecting as the shortest path, a shortest path included in a set of join paths.

12. The system of claim 1 wherein the request is associated with target information needed to generate or update a visualization of at least a portion of the graph.

13. A method, comprising:

receiving, in response to a user interaction with a graph that comprises a plurality of nodes, wherein at least one node included in the graph is associated with an activity within a network environment, a request to filter information associated with activities within the network environment; and

in response to receiving the filter request, generating a query based on an implicit join using a query service, wherein generating the query includes constructing a join graph and traversing the join graph to locate a shortest path and wherein generating the query also includes finding a join path.

14. The method of claim 13 wherein the request to filter information is received in response to a user clicking on a visual representation of at least a portion of the graph.

15. The method of claim 13 wherein generating the query includes selecting a shortest path included in a set of join paths.

16. The method of claim 13 wherein the request to filter information is received in response to a user interaction with a query field.

17. The method of claim 13 further comprising performing the generated query against a database.

18. The method of claim 13 wherein the join graph comprises a list of join links.

19. The method of claim 18 wherein a given join link maintains a reverse map from an entity to a filter key.

20. The method of claim 13 wherein finding the join path includes performing a traversal.

21. The method of claim 20 wherein the traversal comprises a breadth first traversal.

22. The method of claim 21 wherein the traversal is performed using a priority order list of join links for all entities sharing an implicit join group.

23. The method of claim 21 wherein the traversal is stopped when a node is reached which has at least one local filter.

24. The method of claim 13 wherein generating the query includes selecting as the shortest path, a shortest path included in a set of join paths.

25. The method of claim 13 wherein the request is associated with target information needed to generate or update a visualization of at least a portion of the graph.

26. A computer program product embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving, in response to a user interaction with a graph that comprises a plurality of nodes, wherein at least one node included in the graph is associated with an activity within a network environment, a request to filter information associated with activities within the network environment; and

in response to receiving the filter request, generating a query based on an implicit join using a query service, wherein generating the query includes constructing a join graph and traversing the join graph to locate a shortest path and wherein generating the query also includes finding a loin path.