System and method to visualize user sessions

• US 9,824,211 B2
• Filed: 09/16/2013
• Issued: 11/21/2017
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Wilson, Theodore
• Primary Examiner(s): Pham, Khanh
• Application Number:
  US14/028,074
• Publication Number:
  US 20140280245A1
• Time in Patent Office: 1,527 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2151 Time stamp

Abstract

A system and method operable to identify and analyze persistent state information among a plurality of software-related events, and present persistent state information in a unified fashion.

Claims

1. A method to visualize a user session on a network, the method comprising:

identifying a persistent event from a plurality of software-related events, the persistent event (i) including at least a start timestamp and a stop timestamp, and (ii) persisting for a period of time between the start timestamp and the stop timestamp, each of the plurality of software-related events representing a change of state of a computer system;

comparing the persistent event to a second plurality of software-related events that is a subset of the plurality of software-related events excluding the persistent event to determine whether any of the second plurality of software-related events includes at least one timestamp during the period of time of the persistent event; and

displaying an indicator associated with a first event of the second plurality of software-related events during at least a portion of the period of time, the indicator associated with the first event of the second plurality of software-related events being displayed to overlay an indicator of the persistent event

wherein the indicator associated with the first event of the second plurality of software-related events is displayed with a start timestamp associated with an earliest start time of the plurality of software-related events and a stop timestamp corresponds to a timestamp for the first event of the second plurality of software-related events that has occurred during the period of time in response to the first event being a persistent event based on a single timestamp being the stop timestamp without the start timestamp, and

wherein the indicator associated with the first event of the second plurality of software-related events is displayed with a start timestamp that corresponds to the timestamp for the first event of the second plurality of software-related events that has occurred during the period of time and a stop timestamp associated with a latest stop time of the plurality of software-related events in response to the first event being a persistent event based on a single timestamp being the start timestamp without the stop timestamp.

2. The method of claim 1, wherein the persistent event is an ongoing event (i) including a start time and a stop time, and (ii) persisting for the period of time.

3. The method of claim 2, wherein the start time corresponds to a user logon to a network.

4. The method of claim 2, wherein,

the start time is assigned by identifying an earliest timestamp among a plurality of known timestamps and the stop time is assigned by identifying a latest-known timestamp among the plurality of known timestamps, and

the plurality of known timestamps are imported timestamps sorted in chronological order.

5. The method of claim 1, wherein the persistent event includes two separate events spaced from each other along a timeframe, a first separate event of the two separate events representing a start time for the persistent event and a second separate event of the two separate events representing a stop time for the persistent event.

6. The method of claim 5, wherein the second plurality of software-related events are events occurring in chronological order after the start time for the persistent event and before the stop time for the persistent event.

7. The method of claim 1, wherein indicators of each of the second plurality of software-related events are associated with each other using one or more visually distinctive interface elements.

8. The method of claim 7, wherein the one or more visually distinctive interface elements includes a selected color further comprises

displaying a list of any logged-on users when a second event of the plurality of software related events occurred, upon selection of the second event of the plurality of software-related events.

9. The method of claim 7, wherein the one or more visually distinctive interface elements includes a selected color being used for each indicator associated with the second plurality of software-related events.

10. The method of claim 1, wherein the persistent event is identified using only one discrete event having a timestamp at a single point during the timeframe.

11. The method of claim 1 further comprising

displaying a list of any logged-on users when a second event of the plurality of software related events occurred, upon selection of the second event of the plurality of software-related events.

12. A system to visualize a user session on a network, the system comprising:

a display operable to display a persistent event, the persistent event (i) including at least one timestamp, and (ii) persisting for a period of time that is at least partially during a selected timeframe; and

a processor configured to (i) identify the persistent event from among a plurality of software-related events, the persistent event including at least a start timestamp and a stop timestamp with a change of state that is ongoing for a period of time between the start timestamp and the stop timestamp, each of the plurality of software-related events representing a change of state of a computer system, (ii) compare the persistent event to a second plurality of the software-related events, the second plurality of software-related events corresponds to the plurality of software-related events excluding the persistent event and including a timestamp during the period of time, and (iii) displaying an indicator associated with a first event of the second plurality of software-related events during at least a portion of the period of time, the indicator associated with the first event of the second plurality of software-related events being displayed to overlay an indicator of the persistent event,

wherein the indicator associated with the first event of the second plurality of software-related events is displayed with a start timestamp associated with an earliest start time of the plurality of software-related events and a stop timestamp corresponds to a timestamp for the first event of the second plurality of software-related events that has occurred during the period of time in response to the first event being a persistent event based on a single timestamp being the stop timestamp without the start timestamp, and

wherein the indicator associated with the first event of the second plurality of software-related events is displayed with a start timestamp that corresponds to the timestamp for the first event of the second plurality of software-related events that has occurred during the period of time and a stop timestamp associated with a latest stop time of the plurality of software-related events in response to the first event being a persistent event based on a single timestamp being the start timestamp without the stop timestamp.

13. The system of claim 12, wherein the persistent event is an ongoing event that persists for a period of time and has one of a start time identified by the start timestamp and a stop time identified by the stop timestamp.

14. The system of claim 13, wherein the start time corresponds to a user logon to a network.

15. The system of claim 12, wherein the persistent event includes a start time and a stop time for the period of time, the start time corresponds to the start timestamp and the stop time corresponds to the stop timestamp.

16. The system of claim 15, wherein,

the start time is assigned by identifying an earliest timestamp among a plurality of known timestamps and the stop time is assigned by identifying a latest-known timestamp among the plurality of known timestamps, and

the plurality of known timestamps are imported timestamps sorted in chronological order.

17. The system of claim 12, wherein the persistent event is identified using only one discrete event having a timestamp at a single point during the timeframe.

18. The system of claim 12, wherein the persistent event includes a plurality of separate events spaced from each other along a timeframe, a first separate event of the plurality of separate events representing a start time for the persistent event and a second separate event of the plurality of separate events representing a stop time for the persistent event.

19. The system of claim 18, wherein the second plurality of software-related events are events occurring in chronological order after the start time for the persistent event and before the stop time for the persistent event.

20. The system of claim 12, wherein indicators for each of the second plurality of software-related events are associated with each other using one or more visually distinctive interface elements.

21. The system of claim 20, wherein the one or more visually distinctive interface elements includes a selected color being used for each indicator associated with the second plurality of software-related events.