SYSTEM AND METHOD TO VISUALIZE USER SESSIONS

• US 20140280245A1
• Filed: 09/16/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: Mandiant Corporation (Alphabet Inc.)
• Inventors: Wilson, Theodore
• Granted Patent: US 9,824,211 B2
• Time in Patent Office: Days
• US Class Current: 707/752
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2151 Time stamp

Abstract

A system and method operable to identify and analyze persistent state information among a plurality of software-related events, and present persistent state information in a unified fashion.

Claims

1. A method to visualize a user session, the method comprising the steps of:

identifying a persistent event from a plurality of software-related events, the persistent event (i) having at least one timestamp, and (ii) persisting for a period of time;

comparing the persistent event to the others of the plurality of software-related events; and

determining whether any of the others of the plurality of software-related events have a timestamp during the period of time of the persistent event.

2. The method of claim 1, further comprising the step of:

displaying the persistent event and the others of the plurality of software-related events that have the timestamp during the period of time.

3. The method of claim 1, wherein the persistent event is an ongoing event (i) having a start time and a stop time, and (ii) persisting for the period of time.

4. The method of claim 3, wherein the start time corresponds to a user logon to a network.

5. The method of claim 3, wherein,

the start time is assigned by identifying an earliest timestamp among a plurality of known timestamps and the stop time is assigned by identifying a latest-known timestamp among the plurality of known timestamps, and

the plurality of known timestamps are imported timestamps sorted in chronological order.

6. The method of claim 1, wherein the persistent event includes two separate events spaced from each other along a timeframe, each of the two separate events representing one of a start time and a stop time for the persistent event.

7. The method of claim 6, wherein the others of the plurality of software-related events are events occurring in chronological order after the start time for the persistent event and before the stop time for the persistent event.

8. The method of claim 6, wherein the timeframe includes a listing of events in chronological order.

9. A system to visualize a user session, the system including:

an identifier operable to identify a persistent event from among a plurality of software-related events, the persistent event persisting for a period of time that includes others of the plurality of software-related events;

a comparator configured to compare the persistent event to the others of the plurality of software-related events; and

a determiner configured to determine whether any of the others of the plurality of software-related events have a timestamp during the period of time.

10. The system of claim 9, further comprising:

a display operable to display the persistent event and the others of the plurality of software-related events that have the timestamp during the period of time.

11. The system of claim 9, wherein the persistent event is an ongoing event that persists for a period of time and has one of a start time and a stop time.

12. The system of claim 11, wherein the start time corresponds to a user logon to a network.

13. The system of claim 9, wherein the persistent event includes a start time and a stop time for the period of time.

14. The system of claim 13, wherein,

the start time is assigned by identifying an earliest timestamp among a plurality of known timestamps and the stop time is assigned by identifying a latest-known timestamp among the plurality of known timestamps, and

the plurality of known timestamps are imported timestamps sorted in chronological order.

15. A method to carve out and visualize a user session on a network, the method comprising the steps of:

importing a plurality of time-based events;

sorting the plurality of time-based events in chronological order;

determining whether each one of the plurality of time-based events is one of a user logon event and a user log off event;

creating a new user session metadata object for each one of the plurality of time-based events that is the user logon event;

determining whether at least one of the time-based events occurred after the user logon event; and

displaying a list containing identification information of a user associated with the user logon event if the at least one of the time-based events occurred between the user logon event and before a corresponding user log off event.

16. The method according to claim 15, further comprising the step of:

determining whether the user log off event corresponds to the user logon event for the corresponding user log off event, the corresponding user log off event previously stored in a database.

17. The method according to claim 15, further comprising the steps of:

assigning an earliest known timestamp to each one of the plurality of time-based events that does not have a start timestamp; and

assigning a latest known timestamp to each one of the plurality of time-based events that does not have a end timestamp.