System, method and program product for visually presenting data describing network intrusions

• US 20080016208A1
• Filed: 07/13/2006
• Published: 01/17/2008
• Est. Priority Date: 07/13/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Treinen, James J.
• Granted Patent: US 7,681,132 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Computer system, method and program for graphically representing network intrusions. Source icons are displayed in rows in a first column. The source icons represent source IP addresses from which intrusions were sent. Destination icons are displayed in rows in a second column. The destination icons represent destination IP addresses to which the intrusions were sent. The destination icons that receive intrusions from a same source icon are clustered together in the graphical representation across from the same source icon. An arrow is displayed from each of the source icons pointing to each of the destination icons to which each source icon sent an intrusion, such that there are “N” arrows from each source icon to “N” destination icons to which each source icon sent at least one intrusion.

Claims

1. A method for graphically representing network intrusions, said method comprising the steps of:

displaying source icons in rows in a first column, said source icons representing source IP addresses from which intrusions were sent;

displaying destination icons in rows in a second column, said destination icons representing destination IP addresses to which said intrusions were sent, wherein the destination icons that receive intrusions from a same source icon are clustered together in said graphical representation across from said same source icon; and

displaying an arrow from each of the source icons pointing to each of the destination icons to which said each source icon sent an intrusion, such that there are “

N”

arrows from each source icon to “

N”

destination icons to which said each source icon sent at least one intrusion.

2. A method as set forth in claim 1 wherein the destination icons that receive intrusions from a same source icon are displayed in successive rows closest to the row of said same source icon.

3. A method as set forth in claim 1 further comprising the step of:

displaying an arrow from one of said destination icons pointing to the source icon that sent an intrusion to said one destination icon, said arrow from said one destination icon representing a response from a destination device to said source icon.

4. A method as set forth in claim 1 further comprising the step of:

color coding said destination icons based on severity levels of respective vulnerabilities of said destination icons.

5. A method as set forth in claim 1 further comprising the step of:

color coding said destination icons based on severity levels or numbers of security incidents relating to said destination icons.

6. A method as set forth in claim 1 further comprising the step of:

color coding said arrows based on numbers of intrusions represented by said arrows, respectively.

7. A method as set forth in claim 1 further comprising the steps of:

displaying other destination icons in said rows in a third column, said other destination icons representing other destination IP addresses to which said intrusions propagated from the first said destination icons; and

displaying an arrow from each of said first destination icons to each of said other destination icons to which said intrusion propagated.

8. A method as set forth in claim 1 further comprising the steps of:

displaying in each of said source icons the source IP addresses that the source icon represents; and

displaying in each of said destination icons the destination IP addresses that the destination icon represents.

9. A method as set forth in claim 1 further comprising the step of taking corrective action in response to the display of said graphic representation.

10. A method for graphically representing network intrusions, said method comprising the steps of:

displaying source icons in columns in a first row, said source icons representing source IP addresses from which intrusions were sent;

displaying destination icons in columns in a second row, said destination icons representing destination IP addresses to which said intrusions were sent, wherein the destination icons that receive intrusions from a same source icon are clustered together in said graphical representation above or below said same source icon; and

displaying an arrow from each of the source icons pointing to each of the destination icons to which said each source icon sent an intrusion, such that there are “

N”

arrows from each source icon to “

N”

destination icons to which said each source icon sent at least one intrusion.

11. A method as set forth in claim 10 wherein the destination icons that receive intrusions from a same source icon are displayed in successive columns closest to the column of said same source icon.

12. A method as set forth in claim 10 further comprising the step of:

displaying an arrow from one of said destination icons pointing to the source icon that sent an intrusion to said one destination icon, said arrow from said one destination icon representing a response from a destination device to said source icon.

13. A method as set forth in claim 10 further comprising the step of:

color coding said destination icons based on severity levels of respective vulnerabilities of said destination icons.

14. A method as set forth in claim 10 further comprising the step of:

color coding said destination icons based on severity levels or numbers of security incidents relating to said destination icons.

15. A method as set forth in claim 10 further comprising the step of:

color coding said arrows based on numbers of intrusions represented by said arrows, respectively.

16. A method as set forth in claim 10 further comprising the steps of:

displaying other destination icons in said columns in a third row, said other destination icons representing other destination IP addresses to which said intrusions propagated from the first said destination icons; and

displaying an arrow from each of said first destination icons to each of said other destination icons to which said intrusion propagated.

17. A method as set forth in claim 10 further comprising the steps of:

displaying in each of said source icons the source IP addresses that the source icon represents; and

displaying in each of said destination icons the destination IP addresses that the destination icon represents.

18. A method as set forth in claim 10 further comprising the step of taking corrective action in response to the display of said graphic representation.

19. A computer program product for graphically representing network intrusions, said computer program product comprising:

a computer readable media;

first program instructions to direct display source icons in rows in a first column, said source icons representing source IP addresses from which intrusions were sent;

second program instructions to direct display of destination icons in rows in a second column, said destination icons representing destination IP addresses to which said intrusions were sent, wherein the destination icons that receive intrusions from a same source icon are clustered together in said graphical representation across from said same source icon; and

third program instructions to direct display of an arrow from each of the source icons pointing to each of the destination icons to which said each source icon sent an intrusion, such that there are “

N”

arrows from each source icon to “

N”

destination icons to which said each source icon sent at least one intrusion; and

wherein

said first, second and third program instructions are stored on said media in functional form.

20. A computer program product as set forth in claim 19 wherein said second program instructions direct display of the destination icons that receive intrusions from a same source icon in successive rows closest to the row of said same source icon.