GEO-MAPPING SYSTEM SECURITY EVENTS

• US 20130174259A1
• Filed: 12/29/2011
• Published: 07/04/2013
• Est. Priority Date: 12/29/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Pearcy, Derek Patton, Heinrich, Jessica Anne, Gaskins, Jessica Jeanne
• Granted Patent: US 8,973,147 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 16/29 Geographical information databases
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06T 11/60 Editing figures and text; Combining figures or text
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

A particular security event is identified that has been detected as targeting a particular computing device included in a particular computing system. A particular grouping of assets in a plurality of asset groupings within the particular computing system is identified as including the particular computing device. A source of the particular security event is also identified and at least one of a geographic location and a grouping of assets in the plurality of asset groupings is associated with the identified source. Data is generated that is adapted to cause a presentation of a graphical representation of the particular security event on a display device, the graphical representation including a first graphical element representing the particular computing device as included in the particular grouping of assets and a second graphical element representing the source associated with the at least one of a geographic location and a grouping of assets.

Claims

1. A method comprising:

identifying a particular security event detected in a particular computing system, the particular security event detected as targeting a particular computing device included in the particular computing system;

identifying a particular grouping of assets in a plurality of asset groupings defined for devices within the particular computing system as including the particular computing device;

identifying a source of the particular security event, wherein the source is associated with at least one second computing device;

associating the source with at least one of a geographic location and a grouping of assets included in the plurality of asset groupings; and

generating data adapted to cause a graphical representation of the particular security event to be presented on a display device, the graphical representation including;

a first graphical element representing the particular computing device as included in the particular grouping of assets and a second graphical element representing the source associated with the at least one of a geographic location and a grouping of assets included in the plurality of asset groupings.

2. The method of claim 1, wherein the graphical representation includes a view of a geographic map and at least one of the first and second graphical elements are overlaid on the view of the geographic map.

3. The method of claim 2, wherein the source is associated with a particular geographic location included in the view of the geographic map and the particular geographic location is identified from a device identifier associated with the source.

4. The method of claim 2, wherein the graphical representation further includes a representation of two or more asset groupings in the plurality of asset groupings, the two or more asset groupings including the particular grouping.

5. The method of claim 4, wherein the first graphical element is positioned in the graphical representation to correspond with the representation of the particular grouping and the second graphical element is positioned in the graphical representation to correspond with the particular geographic location on the view of the geographic map.

6. The method of claim 1, the graphical representation further including a graphical connector associating the first graphical element with the second graphical element and representing that the particular computing device and the source are associated with the particular security event.

7. The method of claim 1, wherein the first graphical element is a bubble element and a diameter of the bubble element corresponds to a quantity of detected security events including the particular security event.

8. The method of claim 1, wherein the source is identified as included in the particular computing system and the source is associated with a first grouping in the plurality of asset groupings.

9. The method of claim 8, wherein the particular grouping is the first grouping.

10. The method of claim 8, wherein the particular grouping is a grouping other than the first grouping.

11. The method of claim 1, wherein the graphical representation further includes representations of each of the plurality of security events.

12. The method of claim 1, wherein each of the plurality of asset groupings is a distinct, user-defined asset grouping.

13. The method of claim 1, wherein each of the plurality of asset groupings corresponds to a range of IP addresses of assets in the particular computing system.

14. The method of claim 1, wherein the graphical representation is an interactive presentation and user interactions with one or more of the first and second graphical elements causes a view to be presented of details of the particular security event.

15. The method of claim 14, wherein the user interactions include a mouse-over of one or more of the first and second graphical elements.

16. The method of claim 14, wherein the user interactions include a selection of one or more of the first and second graphical elements.

17. The method of claim 1, wherein the graphical representation of the particular security event communicates a type of the particular security event.

18. The method of claim 17, wherein the graphical representation of the particular security event color-codes each of the first and second graphical elements according to the type of the particular security event, wherein the type of the particular security event is one of a plurality of security event types and each of the plurality of security event types is coded to a respective color.

19. The method of claim 1, wherein the first graphic element is a first type of graphic element representing targets of a security event and the second graphic element is a second, different type of security event representing sources of a security event.

20. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying a particular security event detected in a particular computing system, the particular security event detected as targeting a particular computing device included in the particular computing system;

identifying a particular grouping of assets in a plurality of asset groupings defined for devices within the particular computing system as including the particular computing device;

identifying a source of the particular security event, wherein the source is associated with at least one second computing device;

associating the source with at least one of a geographic location and a grouping of assets included in the plurality of asset groupings; and

generating data adapted to cause a graphical representation of the particular security event to be presented on a display device, the graphical representation including;

a first graphical element representing the particular computing device as included in the particular grouping of assets and a second graphical element representing the source associated with the at least one of a geographic location and a grouping of assets included in the plurality of asset groupings.

21. A system comprising:

at least one processor device;

at least one memory element; and

a geo-mapping engine, adapted when executed by the at least one processor device to;

identify a particular security event detected in a particular computing system, the particular security event detected as targeting a particular computing device included in the particular computing system;

identify a particular grouping of assets in a plurality of asset groupings defined for devices within the particular computing system as including the particular computing device;

identify a source of the particular security event, wherein the source is associated with at least one second computing device;

associate the source with at least one of a geographic location and a grouping of assets included in the plurality of asset groupings; and

generate data adapted to cause a graphical representation of the particular security event to be presented on a display device, the graphical representation including;

a first graphical element representing the particular computing device as included in the particular grouping of assets and a second graphical element representing the source associated with the at least one of a geographic location and a grouping of assets included in the plurality of asset groupings.

22. A method comprising:

identifying a particular security event detected in a particular computing system, the particular security event detected as involving a particular computing device included in the particular computing system and targeting at least one second computing device outside the computing system;

identifying a particular grouping of assets in a plurality of asset groupings defined for devices within the particular computing system as including the particular computing device;

associating the second computing device with a geographic location; and

generating data adapted to cause a graphical representation of the particular security event to be presented on a display device, the graphical representation including;

a first graphical element representing the particular computing device as a source of the particular security event and included in the particular grouping of assets, and a second graphical element representing the second computing device associated with the geographic location and overlaid on a portion of a representation of a geographical map corresponding to the geographic location.