User interface for network security console

• US 7,607,169 B1
• Filed: 12/02/2002
• Issued: 10/20/2009
• Est. Priority Date: 12/02/2002
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Arcsight Incorporated (HP Inc.)
• Inventors: Bhatt, Rajesh P., Njemanze, Hugh S.
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US10/308,418
• Time in Patent Office: 2,514 Days
• Field of Search: 726 22- 25, 726/2
• US Class Current: 726/22
• CPC Class Codes: G06F 11/32 with visual or acoustical indication of the functioning of the machine
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A user interface for a network security console associated with multiple network security devices is disclosed. A graphical user interface (GUI) for use with an intrusion detection system, comprises a radar display that is configured to simulate a stream of time-based events chronologically. In addition, one or more playback controls are configured to control the stream during simulation. In further embodiments, the radar display includes a slider configured to allow a user to jump to events that occurred at a user-defined time.

Claims

1. A computer-implemented method for displaying information regarding time-based security events, the method comprising:

separating the events into sets, wherein a set includes events associated with a time period;

dividing the set of events into groups, wherein a group includes events that have a same value for a same attribute; and

displaying a user interface comprising;

a bar graph comprising;

a first axis that represents a volume of events;

a second axis that represents time; and

multiple bars, wherein a bar represents a set of events associated with a time period, and wherein the bar is divided into multiple portions, and wherein each portion represents a group of events having a same value for a same attribute, and wherein a first portion has a different visual appearance than a second portion; and

a user-manipulable control element that indicates a time span.

2. The method of claim 1, wherein the same attribute is severity.

3. The method of claim 1, wherein the same attribute is target port.

4. The method of claim 1, wherein the same attribute is category.

5. The method of claim 1, wherein widening the user-manipulable control element lengthens the time span.

6. The method of claim 1, wherein narrowing the user-manipulable control element shortens the time span.

7. The method of claim 1, wherein moving the user-manipulable control element shifts the time span.

8. The method of claim 1, wherein the user interface further comprises a view panel that displays information regarding a plurality of events, wherein each event in the plurality is associated with the time span indicated by the user-manipulable control element.

9. The method of claim 8, wherein the view panel comprises a pie chart.

10. The method of claim 9, wherein the pie chart represents the plurality of events, and wherein a sector of the pie chart represents events with a same value of a same attribute.

11. The method of claim 8, wherein the view panel comprises a table.

12. The method of claim 11, wherein a row of the table represents an event and wherein a column of the table represents an attribute of an event.

13. The method of claim 12, wherein a color of the row is based on a value of the attribute of the event represented by the row.

14. The method of claim 8, wherein the view panel comprises a bar graph.

15. The method of claim 1, wherein the user interface further comprises an indication of a start date and an indication of an end date, wherein the start date represents a date of the beginning of the time period and wherein the end date represents a date of the end of the time period.

16. The method of claim 1, wherein the user interface further comprises an indication of a start time and an indication of an end time, wherein the start time represents the beginning of the time period and wherein the end time represents the end of the time period.

17. The method of claim 1, wherein an event was generated by either a security device or a security application.

18. The method of claim 1, wherein a first event of the set of events was generated by a first source, and wherein a second event of the set of events was generated by a second source.

19. The method of claim 1, wherein the bar is vertical.

20. The method of claim 1, wherein the first portion is colored differently than the second portion.

21. A computer program product for displaying information regarding time-based security events, the computer program product comprising a computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method, the method comprising:

separating the events into sets, wherein a set includes events associated with a time period;

dividing the set of events into groups, wherein a group includes events that have a same value for a same attribute; and

displaying a user interface comprising;

a bar graph comprising;

a first axis that represents a volume of events;

a second axis that represents time; and

multiple bars, wherein a bar represents a set of events associated with a time period, and wherein the bar is divided into multiple portions, and wherein each portion represents a group of events having a same value for a same attribute, and wherein a first portion has a different visual appearance than a second portion; and

a user-manipulable control element that indicates a time span.

22. A system for displaying information regarding time-based security events, the system comprising a processor configured to perform a method, the method comprising:

separating the events into sets, wherein a set includes events associated with a time period;

dividing the set of events into groups, wherein a group includes events that have a same value for a same attribute; and

displaying a user interface comprising;

a bar graph comprising;

a first axis that represents a volume of events;

a second axis that represents time; and

multiple bars, wherein a bar represents a set of events associated with a time period, and wherein the bar is divided into multiple portions, and wherein each portion represents a group of events having a same value for a same attribute, and wherein a first portion has a different visual appearance than a second portion; and

a user-manipulable control element that indicates a time span.