DISPLAYING SESSION AUDIT LOGS

• US 20150030313A1
• Filed: 07/24/2014
• Published: 01/29/2015
• Est. Priority Date: 07/25/2013
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Ylonen, Tatu J., Tammisalo, Toni
• Granted Patent: US 10,347,286 B2
• Time in Patent Office: Days
• US Class Current: 386/278
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/30 of unstructured textual data document management systems G06F16/93
• CPC Class Codes: G11B 27/02 Editing, e.g. varying the order of information signals recorded on, or reproduced from, record carriers
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04N 21/44213 Monitoring of end-user related data arrangements for monitoring the users' behaviour or opinions in broadcast systems H04H60/33

Abstract

Methods and apparatus for generation of session audit log displays are disclosed. Audit log data is captured in association with at least one session in a computerized system. A video presentation is generated based on the captured audio log data. A video presentation of at least a part of the at least one session can then be displayed based on the generated data.

Claims

1. A method comprising:

obtaining audit log data captured in association with at least one session in a computerized system,

generating data for a video presentation based on the captured audio log data, and

causing display of the video presentation of at least a part of the at least one session based on the generated data.

2. The method of claim 1, comprising selecting a session from a plurality of sessions.

3. The method of claim 1, comprising highlighting search terms used for finding or selecting a session for the video presentation.

4. The method of claim 1, comprising timing the video presentation according to timing of events taking place in an original session.

5. The method of claim 1, comprising compressing periods of inactivity in the video presentation.

6. The method of claim 1, causing presentation of duplicates of earlier video frames during periods of inactivity in the video presentation.

7. The method of claim 1, comprising obtaining audit log data for at least one of a Secure Shell (SSH) session, a Remote Desktop (RDP) session and an encrypted session protocol session.

8. The method of claim 1, comprising causing display of a web page incorporating the video presentation.

9. The method of claim 1, comprising capturing the audit log data by capturing data associated with an encrypted protocol session where a graphical protocol is used for generating displays, and causing reproduction of the displays as a video presentation based on the generated data.

10. The method of claim 1, comprising processing graphical data by Optical Character Recognition (OCR) to extract one or more text segments from at least one display and/or indexing text segments from one or more captured sessions for fast searching.

11. The method of claim 1, wherein the audit log data is captured by a data capture entity provided in a node of the computerized system.

12. The method of claim 11, comprising capturing the data by a man-in-the middle attack or by a bastion host.

13. The method of claim 1, comprising

capturing encrypted data, and

decryption of the captured data based on at least one key from a database.

14. The method of claim 1, wherein said captured audit log data is stored in a searchable data store.

15. The method of claim 1, wherein the captured audit log data for a session comprises at least one of

at least a portion of content associated with the session,

a timestamp when a particular portion of content associated with the session was transmitted,

characters input by a user in association with the session,

metadata about the session, and

information about the perplexity of the session.

16. The method of claim 1, comprising generating the video presentation by generating images of displays during the session based on the captured audit log data and encoding the generated images as video frames into a video stream.

17. A method comprising:

receiving a request for a video representation of at least a part of a session,

reading audit log data captured for the session from a storage,

extracting content associated with the session,

processing the extracted content through an emulator to produce frame images indicative of events during the session to generate a video stream, and p1 causing the video stream to be displayed by a user interface of the requestor.

18. A method according to claim 17, comprising generating sound and/or visual effects that coincide user actions during the session and/or points of interest in the video presentation.

19. A method according to claim 17, comprising initiating generation of the video presentation during the session.

20. An apparatus for a computerized system comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to

receive audit log data captured in association with at least one session in the computerized system,

generate data for a video presentation based on the captured audio log data, and

cause display of the video presentation of at least a part of the at least one session based on the generated data.

21. The apparatus of claim 20, configured further to at least one of

time the video presentation according to timing of events taking place in an original session,

compress periods of inactivity in the video presentation,

cause presentation of duplicates of earlier video frames during periods of inactivity in the video presentation,

cause display of a web page incorporating the video presentation,

generate sound and/or visual effects that coincide user actions during the session,

generate sound and/or visual effects that coincide with points of interest in the video presentation, and

initiate generation of the video presentation during the session.

22. The apparatus of claim 20, wherein the audit log data is captured from an encrypted protocol session where a graphical protocol is used for generating displays, the apparatus being configured to reproduce the displays as a video presentation based on the generated data.

23. The apparatus of claim 20, comprising a data capture entity that is separate from a terminal involved in the session.

24. The apparatus of claim 23, wherein the data capture entity is configured to provide a man-in-the middle attack or a bastion host to capture the audit log data.

25. The apparatus of claim 23, configured to capture encrypted data and decrypt the captured data based on at least one key obtained from a database.

26. The apparatus of claim 20, comprising a searchable data store for storage of said captured audit log data.

27. The apparatus of claim 20, configured to generate the video presentation based on generation of images of displays during the session based on the captured audit log data and encoding of the generated images as video frames into a video stream.

28. The apparatus of claim 20, configured to

receive a request for the video representation associated with a session,

read audit log data captured for the session from a storage,

process information extracted from the audio log data through an emulator to produce at least one frame image indicative of events during the session to generate a video stream, and

cause the video stream to be displayed by a user interface of the requestor.

29. A non-transitory computer readable media, comprising program code for causing a processor to perform instructions for a method comprising:

obtaining audit log data captured in association with at least one session in a computerized system,

generating data for a video presentation based on the captured audio log data, and

causing display of the video presentation of at least a part of the at least one session based on the generated data.