Method for visual structuring of multivariable data

• US 7,925,660 B2
• Filed: 02/20/2009
• Issued: 04/12/2011
• Est. Priority Date: 10/22/2004
• Status: Expired due to Fees

• Current Assignee: ServiceNow Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Pawlitzek, Rene A., Stolze, Markus G., Dieberger, Andreas
• Primary Examiner(s): Pham; Khanh B
• Assistant Examiner(s): Cheema; Azam
• Application Number:
  US12/389,872
• Publication Number:
  US 20090249184A1
• Time in Patent Office: 781 Days
• Field of Search: None
• US Class Current: 707/757
• CPC Class Codes: G06F 11/324 Display of status information
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: Y10S 707/99931 Database or file accessing

Abstract

A system for visual structuring of multivariable data sets includes a plurality of sensors for monitoring data and generating events depending on the monitoring; an intrusion detection system for receiving the events generated by the sensors; a plurality of agents for performing pattern recognition on the events, wherein the agents determine whether there are events showing patterns relevant for security purposes; and a display device operatively coupled with the intrusion detection system for displaying in tabular form the events with relevant patterns.

Claims

1. A system for visual structuring of multivariable data sets, the system comprising:

a processor and memory;

a plurality of sensors for monitoring data and generating events depending on the monitoring task, wherein the sensors are configured to receive the data from a network, wherein an event comprises a multivariable data record having multiple data properties;

an intrusion detection system for receiving the events generated by the sensors;

a plurality of agents for performing pattern recognition on the events, said plurality of agents operatively coupled with the intrusion detection system;

wherein the agents are operable for determining whether among the events there are events showing patterns relevant for security purposes; and

a display device operatively coupled with the intrusion detection system, the display device for displaying the events comprising relevant patterns in tabular form, wherein each event of the events being displayed is presented as a record;

wherein the tabular form comprises a plurality of rows and columns for representing the record on the display device, each record comprising a plurality of fields characterizing different attributes of its corresponding event;

wherein field values of a same field in the records are arranged in columns; and

a computer readable storage medium including an executable program for visual structuring of multivariable data sets being provided in records, the records including a plurality of fields and being displayed in tabular form on the display device, wherein the program performs the steps of;

defining one of the fields as a key field;

sorting the records by the key field;

finding equivalent field values in the fields in the records arranged adjacent to each other;

defining a block for those equivalent field values;

displaying one field value of the block; and

masking all other field values within the block.

2. The system of claim 1 wherein the network is the Internet.

3. The system of claim 1 wherein the plurality of the agents are contained within the intrusion detection system.

4. The system of claim 1 wherein the display device is further operable for presenting a detail view of the records in a separate window.

5. The system of claim 4 wherein the display device is further operable for presenting the detail view by selecting a specific block, said detail view showing field values in a field of the records related to the specific block.

6. The system of claim 5 wherein the at least one field is the key field.

7. The system of claim 4 wherein the display device is further operable for presenting the detail view providing an indication about a temporal distribution of field values, wherein each entry is associated with a time stamp of at least one field.

8. The system of claim 1 wherein the tabular form comprises visibility enhancement selected from a group of enhancements consisting of:

colors, hatching, border lines around cells, and any combination thereof.

9. The system of claim 1 wherein the records whose display fields have equivalent field values are arranged adjacent to each other.

10. The system of claim 9 wherein the records arranged adjacent to each other employ visibility enhancement for facilitating monitoring of the multivariable data set.

11. The system of claim 1 wherein the display fields comprise a source IP address, signature, and time of arrival.

12. The system of claim 1 wherein the display device is further operable for presenting a panorama bar comprising block elements whose size is set in relation to a size of each of the blocks for a predetermined field for all records.

13. The system of claim 12 wherein the panorama bar comprises a scaled size fitting on the display device for providing an overview for a distribution of the blocks within the records.

14. The system of claim 13 wherein the block elements of the panorama bar comprise the visual enhancements used for the blocks of the predetermined display fields.

15. The system of claim 12 wherein the panorama bar further comprises an indicator frame indicating a currently displayed position within the records.

16. The system of claim 1 wherein the display device is further operable for providing a detail view for a selectable number of records, wherein field values of all display fields of the selected records are displayed, and wherein those fields values that exhibit a range of values within the selected block are provided with a summarized information item.

17. The system of claim 16 wherein the summarized information item is one of a graphical distribution of field values, a number of different field values for the field in the selected records and a trend of field values for a predetermined time.

18. The system of claim 1 further comprising an input device for selecting a current block and displaying the detail view of the current block.

19. The system of claim 1 wherein the key field is defined by finding equivalent field values in all display fields.