TIMELINE WRINKLING SYSTEM AND METHOD

• US 20140181131A1
• Filed: 09/24/2013
• Published: 06/26/2014
• Est. Priority Date: 12/26/2012
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: FireEye, Inc. (Alphabet Inc.)
• Inventors: Ross, David
• Granted Patent: US 9,633,134 B2
• Time in Patent Office: Days
• US Class Current: 707/758
• CPC Class Codes: G06F 16/9577 Optimising the visualization of content, e.g. distillation of HTML documents

Abstract

A method for organizing event data by identifying a primary timeline containing event data, extracting a first timestamp from a first item of the primary timeline, setting a radius around the first timestamp, identifying a second timestamp within the radius, determining whether the second timestamp is already in a wrinkle timeline, and, if not, incorporating the second timestamp into the wrinkle timeline. Event data associated with the first item may be marked and emphasized in the wrinkle timeline. The system may also create one or more indexes of the event data.

Claims

1. A method of organizing event data using a computer system, the method comprising the steps of:

identifying a primary timeline containing event data including a first timestamp;

choosing a radius for the first timestamp;

searching, via the computer system, for at least one subset of the event data within the radius; and

generating, via the computer system, a first wrinkle timeline incorporating the at least one subset of the event data.

2. The method according to claim 1, further comprising the step of:

identifying a first item associated with the first timestamp.

3. The method according to claim 2, further comprising the step of:

identifying a second timestamp by the search and a second item associated with the second timestamp.

4. The method according to claim 1, wherein the step of searching for the at least one subset of the event data within the radius includes identifying one or more timestamp characteristics and comparing the one or more timestamp characteristics to the event data.

5. The method according to claim 3, further comprising the steps of:

identifying a third timestamp associated with the second item; and

determining whether the second and third timestamps are present in the first wrinkle timeline.

6. The method according to claim 5, wherein if one or more of the second and third timestamps are determined not to be present in the first wrinkle timeline, the one or more of the second and third timestamps are copied into the first wrinkle timeline.

7. The method according to claim 1, further comprising the step of:

creating an index of the event data of the first wrinkle timeline.

8. The method according to claim 7, wherein the first wrinkle timeline index is substantially similar to an index associated with the primary timeline.

9. The method of claim 1, wherein the event data of the first wrinkle timeline includes the first timestamp.

10. The method of claim 9, wherein the first timestamp is marked in the first wrinkle timeline.

11. The method of claim 1, wherein the first wrinkle timeline has substantially the same settings as the primary timeline.

12. The method of claim 1, wherein the radius is at least partially defined in minutes.

13. The method of claim 1, further comprising the step of:

identifying the first timestamp of the primary timeline using a keyword search.

14. The method of claim 1, wherein the steps of the method are carried out using a computing device and event data of the primary timeline resides in memory of an external device.

15. The method of claim 14, wherein the primary timeline comprises event data extracted from the external device according to pre-determined parameters.

16. The method of claim 15, wherein the pre-determined parameters define one or more windows of time for comparing against timestamps contained in the memory of the external device.

17. The method of claim 1, further comprising the step of:

creating a visual representation of event data of the primary timeline that is not incorporated into the first wrinkle timeline.

18. The method of claim 1, further comprising the step of:

selecting event data to be incorporated into the first wrinkle timeline.

19. The method of claim 1, further comprising the step of:

selecting event data not to be incorporated into the first wrinkle timeline.

20. The method of claim 1, further comprising the step of:

selecting event data to remove from the first wrinkle timeline.

21. The method of claim 1, further comprising the step of:

marking one or more event data in the first wrinkle timeline.

22. The method of claim 20, further comprising the steps of:

identifying a fourth timestamp in the first wrinkle timeline;

choosing a radius for the fourth timestamp;

searching for one or more event data within the radius; and

generating a second wrinkle timeline incorporating at least one of the event data.