Systems and user interfaces for dynamic and interactive investigation of bad actor behavior based on automatic clustering of related data in various data structures

• US 10,447,712 B2
• Filed: 03/03/2017
• Issued: 10/15/2019
• Est. Priority Date: 12/22/2014
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Visbal, Alexander, Thompson, James, Sum, Marvin, Ma, Jason, Fu, Bing Jie, Nepomnyashchiy, Ilya, Witherspoon, Devin, Lai, Victoria, Berler, Steven, Smaliy, Alexei, Lee, Suchan
• Primary Examiner(s): Trotter, Scott S
• Application Number:
  US15/449,042
• Publication Number:
  US 20170244735A1
• Time in Patent Office: 956 Days
• Field of Search: None
• CPC Class Codes: G06F 12/1036 for multiple virtual address spaces, e.g. segmentation G06F12/1045 takes precedence
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/287 Visualization; Browsing
• CPC Class Codes: G06F 16/34 Browsing; Visualisation therefor
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 18/23 Clustering techniques
• CPC Class Codes: G06F 18/40 Software arrangements specially adapted for pattern recognition, e.g. user interfaces or toolboxes therefor
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, automatically tag and group those clustered data structures, and provide results of the automated analysis and grouping in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a tiled display of the groups of related data clusters such that the analyst may quickly and efficiently evaluate the groups of data clusters. In particular, the groups of data clusters may be dynamically re-grouped and/or filtered in an interactive user interface so as to enable an analyst to quickly navigate among information associated with various groups of data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation.

Claims

1. A computer system configured to provide a dynamic user interface relating to visualization of alerts of malicious network activity, the computer system comprising:

one or more electronic data structures configured to store a plurality of clusters of data items, wherein each cluster of data items represents a group of related malicious network activities; and

one or more hardware computer processors configured to execute software code to cause the computer system to;

access the plurality of clusters of data items from the one or more electronic data structures;

analyze the plurality of clusters of data items to determine, for each cluster of the plurality of clusters, respective types of malicious network activity associated with the clusters of data items;

group, into a plurality of groups of clusters, the plurality of clusters of data items such that each group of clusters of the plurality of groups of clusters comprises clusters of data items associated with respective same types of malicious network activity; and

provide a dynamic graphical user interface including a plurality of tiles each representing a different one of the plurality of groups of clusters, wherein each of the respective tiles includes at least;

respective indications of the types of malicious network activity associated with the respective tiles; and

respective numbers of data clusters included in the groups of clusters associated with the respective tiles representing the types of malicious network activity.

2. The computer system of claim 1, wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:

further analyze the plurality of clusters of data items to determine respective numbers of clusters of the plurality of clusters having each of a plurality of types of malicious network activity.

3. The computer system of claim 1, wherein each of the respective tiles further includes:

respective time-based graphs showing events associated with data clusters of the respective groups of clusters associated with the respective tiles.

4. The computer system of claim 3, wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:

in response to selection of a tile of the plurality of tiles, update the graphical user interface such that the time-based graph associated with the selected tile is resized to be larger and comprise a greater portion of the graphical user interface.

5. The computer system of claim 3, wherein each of the respective tiles further includes:

respective indications of numbers of critical malicious network activities associated with the respective tiles.

6. The computer system of claim 5, wherein the plurality of tiles are spatially organized in the graphical user interface according to the numbers of critical malicious network activities associated with the respective tiles.

7. The computer system of claim 5, wherein the plurality of tiles are each colored to indicate the respective numbers of critical malicious network activities associated with the respective tiles.

8. The computer system of claim 1, wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:

determine a change to a data item of a cluster of the plurality of clusters; and

at least one of;

re-analyze the plurality of clusters to determine respective types of malicious network activity associated with the clusters of data items, or

re-group the plurality of clusters of data items into a plurality of groups of clusters.

9. A computer system configured to provide a dynamic user interface relating to visualization of alerts of malicious activity, the computer system comprising:

one or more electronic data structures configured to store a plurality of clusters of data items, wherein each cluster of data items represents a group of related malicious activities; and

one or more hardware computer processors configured to execute software code to cause the computer system to;

access the plurality of clusters of data items from the one or more electronic data structures;

analyze the plurality of clusters of data items to determine, for each of the clusters, respective one or more attribute values associated with the respective clusters of data items;

provide a dynamic user interface configured to include at least indications of a plurality of types of attributes; and

in response to a user input selecting a first type of attribute, update the dynamic user interface to include at least;

indications of a first one or more attribute values associated with the first type of attribute, wherein each of the first one or more attribute values is indicated along with a corresponding graphical tile in the dynamic user interface; and

for each of the first one or more attribute values, and overlaid on the respective graphical tiles, respective numbers of data clusters associated with the respective one or more attribute values.

10. The computer system of claim 9, wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:

in response to a user input selecting a second type of attribute, update the dynamic user interface to include at least;

indications of a second one or more attribute values associated with the second type of attribute, wherein each of the second one or more attribute values is indicated along with a corresponding graphical tile in the dynamic user interface; and

for each of the second one or more attribute values, and overlaid on the respective graphical tiles, respective numbers of data clusters associated with the respective one or more attribute values.

11. The computer system of claim 9, wherein each of the respective graphical tiles is further overlaid with:

respective time-based graphs showing events associated with data clusters associated with the respective one or more attribute values represented by the respective graphical tiles.

12. The computer system of claim 11, wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:

in response to selection of a graphical tile of the plurality of tiles, update the dynamic user interface such that the time-based graph associated with the selected graphical tile is resized to be larger and comprise a greater portion of the dynamic user interface.

13. The computer system of claim 11, wherein each of the respective graphical tiles is further overlaid with:

respective indications of numbers of critical malicious activities associated with data clusters associated the respective tiles.

14. A computer system configured to provide a dynamic user interface relating to visualization of alerts of malicious network activity, the computer system comprising:

one or more electronic data structures configured to store a plurality of clusters of data items, wherein each cluster of data items represents a group of related malicious network activities; and

one or more hardware computer processors configured to execute software code to cause the computer system to;

access the plurality of clusters of data items from the one or more electronic data structures;

analyze the plurality of clusters of data items to determine, for each cluster of the plurality of clusters;

respective types of malicious network activity associated with the clusters of data items, and

respective criticalities of the malicious network activity represented by the respective clusters of data items; and

provide a dynamic user interface configured to include at least;

for each cluster of the plurality of clusters, a respective graphical tile representing an alert corresponding to the cluster, wherein the graphical tile visually indicates at least the criticality of the malicious network activity represented by the cluster and a type of the malicious network activity represented by the cluster.

15. The computer system of claim 14, wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:

in response to a user input selecting a first tile representing a first alert, update the dynamic user interface to display at least;

detailed information associated with the cluster associated with the first alert.

16. The computer system of claim 15, wherein:

each respective graphical tile further visually indicates a time-based graph including events associated with data items of the respective clusters represented by the respective graphical tiles, and

the detailed information includes an enlarged time-based graph.

17. The computer system of claim 14, wherein the graphical tile visually indicates that criticality of the malicious network activity represented by the cluster by at least one or an icon or a color.

18. The computer system of claim 14, wherein the dynamic user interface is further configured to include at least:

a first visualization indicating, for each type of malicious network activity of the plurality of types of malicious network activity, respective portions of the plurality of clusters having the type of malicious network activity; and

a second visualization comprising a chart indicating, over a period of time, numbers of malicious network activities.