Hierarchical navigation through network flow data
First Claim
1. A method for hierarchical navigation of network flow data, the method comprising:
- receiving, over a network, network flow data describing communications between servers;
receiving multi-dimensional labels for each of the different servers, wherein each multi-dimensional label comprises a set of values corresponding to a set of respective server dimensions, wherein a server dimension describes a characteristic of the server;
annotating the network flow data with the multi-dimensional labels describing the servers associated with the communications;
storing the annotated network flow data to a database;
configuring a user interface to display the annotated network flow data from the database using a parallel coordinate graph having a plurality of axes, the configuring comprising;
configuring the parallel coordinate graph to have a first axis associated with a first set of server dimensions of the multi-dimensional labels;
identifying a first set of servers each having a first set of label values assigned to the first set of server dimensions associated with the first axis;
representing the first set of servers as a first data point on the first axis;
configuring the parallel coordinate graph to have a second axis associated with a second set of server dimensions of the multi-dimensional labels;
identifying a second set of servers each having a second set of label values assigned to the second set of server dimensions associated with the second axis;
representing the second set of servers as a second data point on the second axis;
configuring the parallel coordinate graph to have a third axis associated with a third set of server dimensions of the multi-dimensional labels;
identifying a third set of servers each having a third set of label values assigned to the third set of server dimensions associated with the third axis;
representing the third set of servers as a third data point on the third axis;
determining, based on the network flow data, if at least one of the first set of servers communicates with at least one of the second set servers;
responsive to determining that at least one of the first set of servers communicates with at least one of the second set of servers, generating a representation of a connection between the first set of servers and the second set of servers as a line connecting the first data point on the first axis to the second data point on the second axis;
determining, based on the network flow data, if a connection between at least one of the first set of servers and at least one of the third set servers is blocked by a domain wide administrative policy;
responsive to that the connection is blocked, generating a representation of a blocked connection between the first set of servers and the third set of servers as a line connecting the first data point on the first axis to the third data point on the third axis that is visually distinguished from the line connecting the first data point to the second data point; and
sending the configured user interface for display via a client device.
1 Assignment
0 Petitions
Accused Products
Abstract
A system performs hierarchical navigation through network flow data. A user interface is configured to display network flow data and allow hierarchical navigation across the network flow data. The user interface comprises a plurality of axes and lines connecting data points between axes. Data points along an axis represent values of an attribute aggregated along a set of dimensions. The system receives requests for expanding data points along a particular dimension or collapsing the data points along the particular dimension. The system reconfigures the user interface according to the received request and sends the reconfigured user interface for display via the client device. The user interface provides better visibility into the network flow data, thereby allowing security analysts to spot communication patterns associated with security issues and navigate through various dimensions to further analyze a suspect communication pattern.
-
Citations
20 Claims
-
1. A method for hierarchical navigation of network flow data, the method comprising:
-
receiving, over a network, network flow data describing communications between servers; receiving multi-dimensional labels for each of the different servers, wherein each multi-dimensional label comprises a set of values corresponding to a set of respective server dimensions, wherein a server dimension describes a characteristic of the server; annotating the network flow data with the multi-dimensional labels describing the servers associated with the communications; storing the annotated network flow data to a database; configuring a user interface to display the annotated network flow data from the database using a parallel coordinate graph having a plurality of axes, the configuring comprising; configuring the parallel coordinate graph to have a first axis associated with a first set of server dimensions of the multi-dimensional labels; identifying a first set of servers each having a first set of label values assigned to the first set of server dimensions associated with the first axis; representing the first set of servers as a first data point on the first axis; configuring the parallel coordinate graph to have a second axis associated with a second set of server dimensions of the multi-dimensional labels; identifying a second set of servers each having a second set of label values assigned to the second set of server dimensions associated with the second axis; representing the second set of servers as a second data point on the second axis; configuring the parallel coordinate graph to have a third axis associated with a third set of server dimensions of the multi-dimensional labels; identifying a third set of servers each having a third set of label values assigned to the third set of server dimensions associated with the third axis; representing the third set of servers as a third data point on the third axis; determining, based on the network flow data, if at least one of the first set of servers communicates with at least one of the second set servers; responsive to determining that at least one of the first set of servers communicates with at least one of the second set of servers, generating a representation of a connection between the first set of servers and the second set of servers as a line connecting the first data point on the first axis to the second data point on the second axis; determining, based on the network flow data, if a connection between at least one of the first set of servers and at least one of the third set servers is blocked by a domain wide administrative policy; responsive to that the connection is blocked, generating a representation of a blocked connection between the first set of servers and the third set of servers as a line connecting the first data point on the first axis to the third data point on the third axis that is visually distinguished from the line connecting the first data point to the second data point; and sending the configured user interface for display via a client device. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. A non-transitory computer readable storage medium storing instructions executable by a processor for:
-
receiving network flow data describing communications between servers; receiving, over a network, network flow data describing communications between servers; receiving multi-dimensional labels for each of the different servers, wherein each multi-dimensional label comprises a set of values corresponding to a set of respective server dimensions, wherein a server dimension describes a characteristic of the server; annotating the network flow data with the multi-dimensional labels describing the servers associated with the communications; storing the annotated network flow data to a database; configuring a user interface to display the annotated network flow data from the database using a parallel coordinate graph having a plurality of axes, the configuring comprising; configuring the parallel coordinate graph to have a first axis associated with a first set of server dimensions of the multi-dimensional labels; identifying a first set of servers each having a first set of label values assigned to the first set of server dimensions associated with the first axis; representing the first set of servers as a first data point on the first axis; configuring the parallel coordinate graph to have a second axis associated with a second set of server dimensions of the multi-dimensional labels; identifying a second set of servers each having a second set of label values assigned to the second set of server dimensions associated with the second axis; representing the second set of servers as a second data point on the second axis; configuring the parallel coordinate graph to have a third axis associated with a third set of server dimensions of the multi-dimensional labels; identifying a third set of servers each having a third set of label values assigned to the third set of server dimensions associated with the third axis; representing the third set of servers as a third data point on the third axis; determining, based on the network flow data, if at least one of the first set of servers communicates with at least one of the second set servers; responsive to determining that at least one of the first set of servers communicates with at least one of the second set of servers, generating a representation of a connection between the first set of servers and the second set of servers as a line connecting the first data point on the first axis to the second data point on the second axis; determining, based on the network flow data, if a connection between at least one of the first set of servers and at least one of the third set servers is blocked by a domain wide administrative policy; responsive to that the connection is blocked, generating a representation of a blocked connection between the first set of servers and the third set of servers as a line connecting the first data point on the first axis to the third data point on the third axis that is visually distinguished from the line connecting the first data point to the second data point; and sending the configured user interface for display via a client device. - View Dependent Claims (14, 15, 16, 17)
-
-
18. A computer system comprising:
-
one or more processors; a computer readable non-transitory storage medium storing instructions for execution by the one or more processors, wherein the stored instructions comprise instructions for; receiving, over a network, network flow data describing communications between servers; receiving multi-dimensional labels for each of the different servers, wherein each multi-dimensional label comprises a set of values corresponding to a set of respective server dimensions, wherein a server dimension describes a characteristic of the server; annotating the network flow data with the multi-dimensional labels describing the servers associated with the communications; storing the annotated network flow data to a database; configuring a user interface to display the annotated network flow data from the database using a parallel coordinate graph having a plurality of axes, the configuring comprising; configuring the parallel coordinate graph to have a first axis associated with a first set of server dimensions of the multi-dimensional labels; identifying a first set of servers each having a first set of label values assigned to the first set of server dimensions associated with the first axis; representing the first set of servers as a first data point on the first axis; configuring the parallel coordinate graph to have a second axis associated with a second set of server dimensions of the multi-dimensional labels; identifying a second set of servers each having a second set of label values assigned to the second set of server dimensions associated with the second axis; representing the second set of servers as a second data point on the second axis; configuring the parallel coordinate graph to have a third axis associated with a third set of server dimensions of the multi-dimensional labels; identifying a third set of servers each having a third set of label values assigned to the third set of server dimensions associated with the third axis; representing the third set of servers as a third data point on the third axis; determining, based on the network flow data, if at least one of the first set of servers communicates with at least one of the second set servers; responsive to determining that at least one of the first set of servers communicates with at least one of the second set of servers, generating a representation of a connection between the first set of servers and the second set of servers as a line connecting the first data point on the first axis to the second data point on the second axis; determining, based on the network flow data, if a connection between at least one of the first set of servers and at least one of the third set servers is blocked by a domain wide administrative policy; responsive to that the connection is blocked, generating a representation of a blocked connection between the first set of servers and the third set of servers as a line connecting the first data point on the first axis to the third data point on the third axis that is visually distinguished from the line connecting the first data point to the second data point; and sending the configured user interface for display via a client device. - View Dependent Claims (19, 20)
-
Specification