Visual structuring of multivariable data

• US 20060100974A1
• Filed: 10/22/2004
• Published: 05/11/2006
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Pawlitzek, Rene A., Stolze, Markus G., Dieberger, Andreas
• Granted Patent: US 7,516,114 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/324 Display of status information
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: Y10S 707/99931 Database or file accessing

Abstract

Visual structuring of multivariable data sets provided in records which include fields, and are displayed in tabular form. A method comprising: defining a key field; sorting records by defined key field; finding equivalent field values in fields in records arranged adjacent to each other; defining a block for fields having equivalent field values; displaying one field value of fields of a block having equivalent field values and masking all other fields within the block having equivalent field values like the one field value. Facilitating monitoring or analysis of large multivariable data sets provided in records and displayed in tabular form it is proposed to define blocks of fields having equivalent field values and display only one field value of a block. The visual output is useful to identify patterns indicative of an attack. A service provider monitors records provided by a customer and notifies the customer of the attack.

Claims

1. A method for visual structuring comprising:

providing visual structuring of multivariable data sets in records, the records including a plurality of fields and being displayed in tabular form on a display device, the step of providing comprising the steps of;

defining one of the fields as a key field;

sorting the records by the key field;

finding equivalent field values in the fields in the records arranged adjacent to each other;

defining a block for those equivalent field values;

displaying one field value of the block; and

masking all other field values within the block.

2. The method as claimed in claim 1, further comprising a step of assigning one of a color and a hatching to the records whose fields have equivalent field values in the records arranged adjacent to each other.

3. The method as claimed in claim 1, wherein the records are received from an intrusion detection system, a record representing an event provided with the fields including a source IP address, signature, and time of arrival.

4. The method as claimed in claim 1, the step of defining a key field further comprising steps of:

finding equivalent field values in all fields; and

defining the key field depending on a number of found equivalent field values.

5. The method as claimed in claim 1, further comprising a step of displaying a panorama bar indicating sizes of all blocks for a predetermined field of the multivariable data set, the panorama bar being composed of block elements whose size is set in relation to the size of each of the blocks for the predetermined field for all records, the panorama bar having a scaled size fitting on the display device for providing an overview for a distribution of the blocks within the records.

6. The method as claimed in claim 5, further comprising a step of assigning to the block elements of the panorama bar one of the same colors and hatchings as used for the blocks of the predetermined fields.

7. The method as claimed in claim 5, further comprising a step of providing an indicator frame on the panorama bar indicating a currently displayed position within the records.

8. The method as claimed in claim 1, further comprising a step of providing a detail view for a selectable number of the records, wherein field values of all fields of the selected records are displayed, and wherein those field values that exhibit a range of values within the selected block are provided with a summarized information item.

9. The method as claimed in claim 8, wherein the summarized information item is one of a graphical distribution of field values, a number of different field values for the field in the selected records and a trend of field values for a predetermined time.

10. The method as claimed in claim 9, further comprising providing for navigating between the blocks by means of an inputting device for selecting a current block and displaying a detail view of the current block.

18. An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing visual structuring, the computer readable program code means in said article of manufacture comprising computer readable program code means for causing a computer to effect the steps of claim 1.

19. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for visual structuring, said method steps comprising the steps of claim 1.

11. A computer program including a program code to carry out a method for visual structuring of multivariable data sets being provided in records, the records including a plurality of fields and being displayed in tabular form on a display device, the method comprising the steps of:

defining one of the fields as a key field;

sorting the records by the key field;

finding equivalent field values in the fields in the records arranged adjacent to each other;

defining a block for those equivalent field values;

displaying one field value of the block; and

masking all other field values within the block, when the program code is executed on a computer.

12. A computer readable medium including an executable program for visual structuring of multivariable data sets being provided in records, the records including a plurality of fields and being displayed in tabular form on a display device, where the program performs the steps of:

defining one of the fields as a key field;

sorting the records by the key field;

finding equivalent field values in the fields in the records arranged adjacent to each other;

defining a block for those equivalent field values;

displaying one field value of the block;

masking all other field values within the block.

13. A method of providing a visualization service comprising the steps of

a service provider receiving from a customer records including a plurality of fields;

said service provider defining one of the fields as a key field;

said service provider sorting the records by the key field;

said service provider finding equivalent field values in the fields in the records arranged adjacent to each other;

said service provider defining a block for those equivalent field values;

said service provider outputting a visualization of the records wherein for the block one field value is displayed; and

masking all other field values within the block.

14. The method according to claim 13, further comprising identifying in the visualization data patterns that are indicative of an attack against the customer.

15. The method according to claim 14, further comprising notifying the customer of such identified attack.

16. The method according to claim 14, further comprising performing a countermeasure against the identified attack.

20. An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing provision of a visualization service, the computer readable program code means in said article of manufacture comprising computer readable program code means for causing a computer to effect the steps of claim 13.

21. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for providing a visualization service, said method steps comprising the steps of claim 13.

17. An apparatus for visual structuring comprising:

means for providing visual structuring of multivariable data sets in records, the records including a plurality of fields and being displayed in tabular form on a display device, the means for providing comprising;

means for defining one of the fields as a key field;

means for sorting the records by the key field;

means for finding equivalent field values in the fields in the records arranged adjacent to each other;

means for defining a block for those equivalent field values;

means for displaying one field value of the block; and

means for masking all other field values within the block.

22. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing visual structuring, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 17.