Pixel-based temporal plot of events according to multidimensional scaling values based on event similarities and weighted dimensions

• US 10,699,449 B2
• Filed: 03/17/2015
• Issued: 06/30/2020
• Est. Priority Date: 03/17/2015
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Hao, Ming C, Jackle, Dominik, Chang, Nelson L, Lee, Wei-Nchih, Keim, Daniel
• Primary Examiner(s): Richer, Aaron M
• Application Number:
  US15/544,675
• Publication Number:
  US 20170365079A1
• Time in Patent Office: 1,932 Days
• Field of Search: None
• CPC Class Codes: G06F 18/213 Feature extraction, e.g. by transforming the feature space; Summarisation; Mappings, e.g. subspace methods
• CPC Class Codes: G06F 18/2137 based on criteria of topology preservation, e.g. multidimensional scaling or self-organising maps
• CPC Class Codes: G06F 2218/12 Classification; Matching
• CPC Class Codes: G06F 2218/18 by plotting the signal segments against each other, e.g. analysing scattergrams
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06T 11/001 Texturing; Colouring; Generation of texture or colour inpainting G06T5/77
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: G06V 20/44 Event detection
• CPC Class Codes: G06V 30/1983 Syntactic or structural pattern recognition, e.g. symbolic string recognition

Abstract

Similarities between events that include a plurality of dimensions are computed, the similarities computed based on binary comparisons between the events and based on user-specified weights for the dimensions. Multidimensional scaling (MDS) values are calculated based on the computed similarities between the events. A graphical visualization is generated of a temporal plot of the events, the temporal plot comprising a first axis corresponding to time, and a second axis corresponding to the MDS values, and the temporal plot representing overlapping time slices each containing pixels representing a respective subset of the events.

Claims

1. A method comprising:

computing, by a system including a processor, similarities between events occurring within a network environment and that comprise a plurality of dimensions, the similarities computed based on binary comparisons between the events and based on user-specified weights for the dimensions;

calculating, by the system, multidimensional scaling (MDS) values based on the computed similarities between the events;

generating, by the system, a graphical visualization of a temporal plot of the events, the temporal plot comprising a first axis corresponding to time, and a second axis corresponding to the MDS values, and the temporal plot representing overlapping time slices each containing pixels representing a respective subset of the events;

for each of the overlapping time slices, computing a diversity of each dimension of the plurality of dimensions, wherein a higher value of the diversity for a given dimension of the plurality of dimensions indicates that values of the given dimension are more spread apart; and

identifying, by the system, security issues within the network environment from the graphical visualization.

2. The method of claim 1, wherein MDS values comprise one-dimensional MDS values.

3. The method of claim 1, further comprising:

providing, in the graphical visualization, a respective graphical element representing the diversity of each dimension of the plurality of dimensions in a given time slice of the overlapping time slices.

4. The method of claim 3, further comprising:

assigning different visual indicators to the respective graphical element to represent different diversity values.

5. The method of claim 4, wherein assigning the different visual indicators to the respective graphical element comprises assigning different colors of different brightness.

6. The method of claim 1, further comprising:

presenting a graphical user interface listing the plurality of dimensions, the graphical user interface including control elements that are user-actuatable to specify the respective weights for the plurality of dimensions; and

setting the respective weights for the plurality of dimensions in response to user actuation of the control elements.

7. The method of claim 1, wherein computing the similarities comprises computing weighted distances between the events based on the binary comparisons between individual dimensions of the events.

8. The method of claim 7, further comprising generating a distance matrix having rows corresponding to the events and columns corresponding to the events, wherein a cell of the distance matrix includes a value representing the weighted distance between a pair of the events.

9. The method of claim 1, further comprising:

defining the overlapping time slices, wherein a first time slice of the overlapping time slices shares at least one event with a second time slice of the overlapping time slices.

10. The method of claim 1, further comprising:

iterating among performing defining the overlapping time slices, assigning the user-specified weights, and generating the graphical visualization.

11. A system comprising:

a processor to;

compute, by a system including a processor, similarities between events occurring within a network environment and that comprise a plurality of dimensions, the similarities computed based on binary comparisons between the events and based on user-specified weights for the dimensions;

calculate, by the system, multidimensional scaling (MDS) values based on the computed similarities between the events;

generate, by the system, a graphical visualization of a temporal plot of the events, the temporal plot comprising a first axis corresponding to time, and a second axis corresponding to the MDS values, and the temporal plot representing overlapping time slices each containing pixels representing a respective subset of the events;

for each of the overlapping time slices, compute a diversity of each dimension of the plurality of dimensions, wherein a higher value of the diversity for a given dimension of the plurality of dimensions indicates that values of the given dimension are more spread apart; and

identifying, by the system, security issues within the network environment from the graphical visualization.

12. The system of claim 11, the processor further to:

provide, in the graphical visualization, a respective graphical element representing the diversity of each dimension of the plurality of dimensions in a given time slice of the overlapping time slices.

13. The system of claim 11, the processor further to:

present a graphical user interface listing the plurality of dimensions, the graphical user interface including control elements that are user-actuatable to specify the respective weights for the plurality of dimensions; and

set the respective weights for the plurality of dimensions in response to user actuation of the control elements.

14. A non-transitory machine-readable storage medium comprising instructions for:

computing, by a system including a processor, similarities between events occurring within a network environment and that comprise a plurality of dimensions, the similarities computed based on binary comparisons between the events and based on user-specified weights for the dimensions;

calculating, by the system, multidimensional scaling (MDS) values based on the computed similarities between the events;

generating, by the system, a graphical visualization of a temporal plot of the events, the temporal plot comprising a first axis corresponding to time, and a second axis corresponding to the MDS values, and the temporal plot representing overlapping time slices each containing pixels representing a respective subset of the events;

for each of the overlapping time slices, computing a diversity of each dimension of the plurality of dimensions, wherein a higher value of the diversity for a given dimension of the plurality of dimensions indicates that values of the given dimension are more spread apart; and

identifying, by the system, security issues within the network environment from the graphical visualization.

15. The non-transitory machine-readable storage medium of claim 14, wherein computing the similarities comprises computing weighted distances between the events based on the binary comparisons between individual dimensions of the events.

16. The non-transitory machine-readable storage medium of claim 15, further comprising instructions for:

generating a distance matrix having rows corresponding to the events and columns corresponding to the events, wherein a cell of the distance matrix includes a value representing the weighted distance between a pair of the events.