Systems and methods for graphically displaying messaging traffic

• US 7,693,947 B2
• Filed: 06/09/2006
• Issued: 04/06/2010
• Est. Priority Date: 03/08/2002
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sellakannu, Arasendran, Krasser, Sven, Alperovitch, Dmitri, Judge, Paul, Willis, Lamar Lorenzo
• Primary Examiner(s): Deane; William J
• Assistant Examiner(s): Gay; Sonia
• Application Number:
  US11/423,308
• Publication Number:
  US 20060267802A1
• Time in Patent Office: 1,397 Days
• Field of Search: 370352-356, 709/206, 709/223, 709/234, 709224-227, 715734-737, 715/853, 345/418, 345/440, 345/441, 340/973
• US Class Current: 709/206
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements

Abstract

Systems and methods for graphically displaying messaging traffic flows by collecting messaging data, converting a portion of the messaging data to a geographical position and collecting statistics related to the messaging data for overlaying upon a geographical map.

Claims

1. A system configured to graphically display message traffic in a geographical context, the system comprising:

a communications interface configured to link the system with an electronic communication network;

a system data store configured to store statistical information related to electronic communications, data associated therewith, configuration data or combinations thereof;

a system processor in communication with the interface, the system data store and endpoints, the system processor comprising one or more processing elements, wherein the one or more processing elements are programmed or adapted to;

receive electronic communications having headers, the headers containing source and destination addresses;

parse the source and destination addresses associated with the electronic communications;

convert source and destination addresses into a geographical position;

assemble statistical information based upon at least the source and destination addresses of at least a sample of electronic communications received at the communications interface, and to store the statistical information in the system data store;

provide a graphical user interface component comprising a geographical information pane configured to display a geographical map to a user via a display device;

a map generator configured to generate the geographical map interface for use by the graphical user interface based upon user input, the map generator being further configured to overlay statistical information onto the geographical map interface to show an electronic traffic flow associated with the source and destination addresses of at least the sample of electronic communications; and

wherein the map generator is further operable to separate the electronic traffic flow between two nodes into multiple flows for display to the user, each flow characterizing a different classification of message content.

2. The system of claim 1, wherein the graphical user interface component is further configured to receive input from the user and communicate the input to the map generator, the map generator being configured to generate a new map for the map interface based upon the user input and send the new map to the graphical user interface component for display to the user.

3. The system of claim 2, wherein the input requests for the new map to focus on a particular portion of the geographical map.

4. The system of claim 3, wherein the input requests more information on a particular traffic flow displayed as part of the geographical map interface;

wherein the map generator is further operable to provide more detailed focus upon a particular traffic flow based upon the user input.

5. The system of claim 4, wherein details about the particular traffic flow can be obtained by hovering over the traffic flow on a new map.

6. The system of claim 1, further comprising a message classification system configured to classify electronic communications and filter those electronic communications that violate at least one of a spam policy, a security policy, a virus policy, a compliance policy, an encryption policy, or combinations thereof.

7. The system of claim 6, wherein the statistical information assembled based upon the electronic communications includes statistics related to the classification of the electronic communications by the message classification system.

8. The system of claim 1, wherein each of the multiple traffic flows is color coded according to the classification of traffic it represents.

9. The system of claim 1, wherein the input from the user includes a specific point of origination or destination to display.

10. The system of claim 1, wherein the display is accompanied by an audio depiction associated with the geographical map or traffic flows.

11. The system of claim 7, wherein the map generator is further operable to display message classification statistics when a user hovers a mouse pointer representation over a particular traffic flow for which the message classification statistics are requested.

27. The system of claim 1, wherein the map generator separates at least one flow based on security concerns regarding the message content.

12. A method for graphically displaying data traffic in a geographical context, the method comprising:

receiving a plurality of electronic communications through a communication interface, the electronic communications having source and destination addresses associated with the communications;

parsing the source and destination addresses associated with the electronic communications;

converting the source and destination addresses into a geographical position;

assembling statistical information based upon at least the source and destination addresses of at least a sample of electronic communications received at the communications interface;

storing the statistical information in the system data store;

generating a geographical map interface;

displaying the geographical map interface to a user;

separating, using one or more processors, the electronic traffic flow between two nodes into multiple flows, each flow characterizing a different classification of message content; and

overlaying the geographical map interface with the multiple flows characterizing different classifications of messages and based upon the statistical information and geographical position associated with the statistical information.

13. The method of claim 12, further comprising the steps of:

receiving input from the user; and

adjusting the display based upon input from the user.

14. The method of claim 13, wherein adjusting the display comprises:

adjusting the boundaries of the geographical map based upon the input from the user;

displaying the adjusted geographical map to the user; and

overlaying the adjusted geographical map with traffic information based upon the statistical information and geographical position associate with the statistical information.

15. The method of claim 14, wherein adjusting the boundaries of the geographical map based upon the input from the user comprises zooming in on a selected portion of the map, the selected portion of the map being based upon the user input.

16. The method of claim 14, wherein adjusting the boundaries of the geographical map based upon input from the user comprises panning towards a selected portion of the geographical map, the selected portion of the map being based upon the user input.

17. The method of claim 13, wherein adjusting the display comprises zooming in on a selected traffic flow, the selected traffic flow comprising traffic between two nodes, and being based upon the user input.

18. The method of claim 17, wherein upon selection of a traffic flow, the selected traffic flow is separated into component parts, thereby enabling a user to review more detailed information about the selected traffic flow.

19. The method of claim 18, wherein a selected traffic flow comprises a plurality of traffic flow subsets related by a common component, and wherein the traffic flow subsets can be selected to reveal further subsets of traffic flow.

20. The method of claim 19, wherein the smallest level of granularity for selection is an individual electronic communication.

21. The method of claim 13, wherein the input from the user comprises hovering a mouse pointer representation over a selected traffic flow, and adjusting the display comprises displaying a dialog box representation showing statistics related to the selected traffic flow.

22. The method of claim 12, further comprising the step of receiving input from a user, wherein the generated map is based upon the input received from the user.

23. The method of claim 22, wherein the input received from the user specifies an internet protocol address, and the generated map and statistical information focuses on traffic involving the specified internet protocol address.

24. The method of claim 12, wherein the plurality of electronic communications comprise information collected from a plurality of sensors distributed on the Internet.

25. The method of claim 12, wherein the step of converting comprises using a location program to determine the physical location of an address.

26. The method of claim 12, further comprising:

receiving input from the user comprising one or more geographical or internet protocol addresses; and

retrieving statistic associated with the one or more geographical or internet protocol addresses input by the user;

wherein the geographical map and the overlay are based upon the one or more geographical or internet protocol addresses received from the user.

28. The method of claim 12, further comprising separating at least one flow based on security concerns regarding the message content.