SYSTEMS AND METHODS FOR INTERACTIVE ANALYTICS OF INTERNET TRAFFIC

• US 20130339514A1
• Filed: 06/13/2012
• Published: 12/19/2013
• Est. Priority Date: 06/13/2012
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Zscaler Incorporated
• Inventors: CRANK, Samuel John, HAZARIKA, Upasona Kath
• Granted Patent: US 9,003,023 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A computer implemented method, a cloud system, and a log system provide interactive analytics providing various intuitive mechanisms for interaction with data visualizations of Internet traffic, email, etc. The methods and systems utilize a cloud based monitoring system where all traffic from an organization may be monitored in a location and platform independent manner. The methods and systems include context-aware drilldown with progressively applied filtering and grouping while maintaining workflow history such that a user can go back to any point in the flow and proceed down a new path of investigation.

Claims

1. A computer implemented interactive analytics method, comprising:

logging data traffic between a plurality of users and an external network in a log system, wherein the logging is performed by a cloud based system;

receiving a first request for interactive analytics of the logged data traffic, wherein the first request comprises a date range, a visualization type, and a grouping;

obtaining data traffic from the log system responsive to the first request;

formatting the obtained data traffic based on the date range, the visualization type, and the grouping to provide a first interaction based on the first request;

displaying the first interaction; and

storing the first interaction in a history list.

2. The method of claim 1, further comprising:

monitoring the data traffic between the plurality of users and the external network via the cloud based system, wherein the monitoring is independent of location, device type, and operating system of each of the plurality of users.

3. The method of claim 2, further comprising:

monitoring Hypertext Transfer Protocol, Hypertext Transfer Protocol Secure, and email traffic associated with the plurality of users.

4. The method of claim 2, further comprising:

compressing the monitored data traffic using a plurality of compression techniques prior to logging the data traffic in the log system.

5. The method of claim 2, further comprising:

receiving a second request for interactive analytics of the logged data traffic, wherein the second request comprises a modification of the first request;

obtaining data traffic from the log system responsive to the second request;

formatting the obtained data traffic based on the modification to provide a second interaction based on the second request;

displaying the second interaction;

storing the second interaction in the history list.

6. The method of claim 2, further comprising:

receiving a plurality of additional requests for interactive analytics of the logged data traffic;

obtaining data traffic from the log system responsive to the each of the plurality of additional requests;

formatting the obtained data traffic to provide a plurality of additional interactions each based on the plurality of additional requests; and

storing the plurality of additional interactions in the history list.

7. The method of claim 6, further comprising:

receiving a selection of any interaction in the history list;

displaying the selection;

receiving a request to modify the selection; and

if the selection is not the last interaction in the history list, deleting all subsequent interactions in the history list based on the modified selection.

8. The method of claim 6, further comprising:

receiving a selection of any interaction in the history list;

displaying the selection;

receiving an additional request for interactive analytics of the logged data traffic, wherein the additional request comprises a modification of the selection;

obtaining data traffic from the log system responsive to the additional request;

formatting the obtained data traffic to provide the additional request.

9. The method of claim 6, wherein the data traffic comprises Hypertext Transfer Protocol or Hypertext Transfer Protocol Secure traffic;

wherein the visualization type comprises one of a bar chart, a pie chart, a line chart, a totals lists, a summary table, and a table of transactions; and

wherein the grouping comprises one of Application Class, Threat Class, Basic Threat Class, Basic Threat Type, Data Leakage Prevention (DLP) Class, DLP Dictionary, DLP Engine, Instant Message (IM) Direction, Location, Social Direction, Department, User Direction, Uniform Resource Locator (URL) Class, URL Category, URL Super-Category, Action, Web Application, Webmail Direction, and Domain.

10. The method of claim 6, wherein the data traffic comprises email traffic;

wherein the visualization type comprises a table of transactions; and

wherein the grouping comprises any of action, direction, user, domain, department, and email type.

11. A cloud system for interactive analytics, comprising:

a plurality of servers forming a cloud system communicatively coupled to an external network and a plurality of users; and

a log server communicatively coupled to the plurality of servers;

wherein each of the plurality of servers comprise computer executable instructions, and, in response to execution, the computer executable instructions cause each of the plurality of servers to;

monitor data traffic between each of the plurality of users and the external network;

analyze the monitored data traffic; and

log the analyzed data traffic to the log server in a compressed format;

wherein the log server comprises computer executable instructions, and, in response to execution, the computer executable instructions cause the log server to;

present an interactive analytics tool to a user;

receive requests via the interactive analytics tool for visualization of data in the log server; and

maintain a workflow history in the interactive analytics tool for context-aware drilldown and progressively applying filters.

12. The cloud system of claim 11, wherein the plurality of users are associated with an organization and the cloud system is configured to monitor each of the plurality of users independent of location, device type, and operating system of each of the plurality of users.

13. The cloud system of claim 12, wherein the data traffic comprises Hypertext Transfer Protocol, Hypertext Transfer Protocol Secure, and email traffic associated with the plurality of users.

14. The cloud system of claim 12, wherein the compressed format comprises a plurality of compression techniques based on a type of data.

15. The cloud system of claim 12, whereine, in response to execution, the computer executable instructions cause the log server to:

receive a plurality of additional requests for interactive analytics;

obtain data traffic from the log server responsive to the each of the plurality of additional requests;

format the obtained data traffic to provide a plurality of additional interactions each based on the plurality of additional requests; and

store the plurality of additional interactions in a history list.

16. The cloud system of claim 15, wherein, in response to execution, the computer executable instructions cause the log server to:

receive a selection of any interaction in the history list;

display the selection;

receive a request to modify the selection; and

if the selection is not the last interaction in the history list, delete all subsequent interactions in the history list based on the modified selection.

17. A log system for interactive analytics, comprising:

a network interface communicatively coupled to a cloud based system, wherein the cloud system is configured to monitor each of a plurality of users independent of location, device type, and operating system of each of the plurality of users;

a processor; and

memory storing computer executable instructions, and in response to execution by the processor, the computer executable instructions cause the processing node to;

receive monitored data from the cloud based system, wherein the monitored data comprises all data traffic between a plurality of users and an external network;

compress the monitored data;

store the monitored data in a log file;

receive a request for interactive analytics;

obtain data from the log file based on the request; and

maintain a workflow history of all requests for interactive analytics.