Displaying information regarding time-based events

• US 8,365,278 B1
• Filed: 09/10/2009
• Issued: 01/29/2013
• Est. Priority Date: 12/02/2002
• Status: Expired due to Term

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Njemanze, Hugh S., Bhatt, Rajesh P.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US12/557,229
• Time in Patent Office: 1,237 Days
• Field of Search: 726 22- 25, 726/11, 709223-225, 709/229
• US Class Current: 726/22
• CPC Class Codes: G06F 11/32 with visual or acoustical indication of the functioning of the machine
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A user interface for a network security console associated with multiple network security devices is disclosed. A graphical user interface (GUI) for use with an intrusion detection system, comprises a radar display that is configured to simulate a stream of time-based events chronologically. In addition, one or more playback controls are configured to control the stream during simulation. In further embodiments, the radar display includes a slider configured to allow a user to jump to events that occurred at a user-defined time.

Claims

1. A computer-implemented method for displaying information regarding time-based events, the method comprising:

separating the events into sets, wherein a set includes events associated with a time period;

dividing, by a processor, the set of events into groups, wherein a group includes events that have a same value for a same attribute; and

displaying a user interface showing the groups of events and different groups have different visual appearances and showing a navigation panel including categories of resources that are selectable for drill downs to identify subcategories for the categories, wherein information regarding resources in the subcategories are viewable under the subcategories and events for the resources in the subcategories are viewable.

2. The method of claim 1, wherein the same attribute is severity.

3. The method of claim 1, wherein the same attribute is target port.

4. The method of claim 1, wherein the same attribute is category.

5. The method of claim 1, comprising:

grouping the events in time spans according to the time the events occurred; and

receiving an adjustment of a user-manipulable control element to lengthen at least one of the time spans.

6. The method of claim 5, comprising receiving an adjustment of the user-manipulable control element to shorten at least one of the time spans.

7. The method of claim 5, comprising receiving an adjustment of the user-manipulable control element to shift at least one of the time spans.

8. The method of claim 1, wherein the user interface further comprises a view panel that displays information regarding the events, wherein each event is associated with a user-manipuable time span.

9. The method of claim 8, wherein the view panel comprises a pie chart.

10. The method of claim 9, wherein the pie chart represents the events, and wherein a sector of the pie chart represents events with a same value of a same attribute.

11. The method of claim 8, wherein the view panel comprises a table.

12. The method of claim 8, wherein a row of the table represents an event and wherein a column of the table represents an attribute of an event.

13. The method of claim 12, wherein a color of the row is based on a value of the attribute of the event represented by the row.

14. The method of claim 8, wherein the view panel comprises a bar graph.

15. The method of claim 1, wherein the user interface further comprises an indication of a start date and an indication of an end date, wherein the start date represents a date of the beginning of a time period associated with a set of the events and wherein the end date represents a date of the end of the time period.

16. The method of claim 1, wherein the user interface further comprises an indication of a start time and an indication of an end time, wherein the start time represents the beginning of a time period associated with a set of the events and wherein the end time represents the end of the time period.

17. The method of claim 1, wherein an event was generated by either a device or an application.

18. The method of claim 1, wherein a first event of the set of events was generated by a first source, and wherein a second event of the set of events was generated by a second source.

19. A computer program product for displaying information regarding time-based events, the computer program product comprising a non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method, the method comprising:

separating the events into sets, wherein a set includes events associated with a time period;

dividing the set of events into groups, wherein a group includes events that have a same value for a same attribute; and

displaying a user interface showing the groups of events and different groups have different visual appearances and showing a navigation panel including categories of resources that are selectable for drill downs to identify subcategories for the categories, wherein information resources in the subcategories are viewable under the subcategories and events for the resources in the subcategories are viewable.

20. The computer program product of claim 19, wherein the user interface comprises a view panel that displays information regarding the events, wherein each event is associated with a user-manipulable time span, and wherein the view panel comprises a pie chart that represents the events, and a sector of the pie chart represents events with a same value of a same attribute.

21. A system for displaying information regarding time-based events, the system comprising a processor to:

separate the events into sets, wherein a set includes events associated with a time period;

divide the set of events into groups, wherein a group includes events that have a same value for a same attribute; and

display a user interface showing the groups of events and different groups have different visual appearances and showing a navigation panel including categories of resources that are selectable for drill downs to identify subcategories for the categories, wherein information resources in the subcategories are viewable under the subcategories and events for the resources in the subcategories are viewable.

22. The system of claim 21, wherein the user interface comprises a view panel that displays information regarding the events, wherein each event is associated with a user-manipuable time span, and wherein the view panel comprises a pie chart that represents the events, and a sector of the pie chart represents events with a same value of a same attribute.