System, method and program product for visually presenting data describing network intrusions

• US 7,681,132 B2
• Filed: 07/13/2006
• Issued: 03/16/2010
• Est. Priority Date: 07/13/2006
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Treinen, James J.
• Primary Examiner(s): Lo; Weilun
• Assistant Examiner(s): Chuong; Truc T
• Application Number:
  US11/486,742
• Publication Number:
  US 20080016208A1
• Time in Patent Office: 1,342 Days
• Field of Search: 715/736, 715/763, 715/764, 715/853, 715/741, 715/743, 709/223, 709/224, 709/225
• US Class Current: 715/736
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Computer system, method and program for graphically representing network intrusions. Source icons are displayed in rows in a first column. The source icons represent source IP addresses from which intrusions were sent. Destination icons are displayed in rows in a second column. The destination icons represent destination IP addresses to which the intrusions were sent. The destination icons that receive intrusions from a same source icon are clustered together in the graphical representation across from the same source icon. An arrow is displayed from each of the source icons pointing to each of the destination icons to which each source icon sent an intrusion, such that there are “N” arrows from each source icon to “N” destination icons to which each source icon sent at least one intrusion.

Claims

1. A method for graphically representing network intrusions, the method comprising the steps of:

a computer identifying intrusions sent from a source Internet Protocol (IP) address to a destination IP address and determining a color-code based on a number of the intrusions sent from the source IP address to the destination IP address; and

the computer displaying on a monitor concurrently;

a source icon representing the source IP address,

the source IP address in association with the source icon,

a destination icon representing the destination IP address,

the destination IP address in association with the destination icon,

a first arrow pointing from the source icon to the destination icon representing intrusions sent from the source IP address to the destination IP address, the first arrow being color-coded based on the number of intrusions sent from the source IP address to the destination IP address, and

wherein the computer also identifies a response to the source IP address from the destination IP address to the intrusion sent from the source IP address, and displays concurrently on the monitor an arrow from the destination icon pointing to the source icon representing the response to the source IP address from the destination IP address to the intrusion sent from the source IP address.

2. The method of claim 1 wherein the source IP address is displayed within the source icon, and the destination IP address is displayed within the destination icon.

3. The method of claim 1 further comprising the step of:

the computer color coding the destination icon based on a severity level of the intrusions sent to the destination IP address.

4. The method of claim 1 further comprising the step of:

the computer color coding the destination icon based on a vulnerability of a destination device at the destination IP address.

5. The method of claim 1 further comprising the steps of:

the computer determining that one of the intrusions sent from the source IP address to the destination IP address was propagated from the destination IP address to another destination IP address; and

the computer also displaying concurrently on the monitor another destination icon representing the other destination IP address, and another arrow from the first said destination icon to the other destination icon to represent the intrusion that was propagated from the first said destination IP address to the other destination IP address.

6. The method of claim 1 further comprising the step of:

the computer also displaying concurrently on the monitor adjacent to the arrow, a number of intrusions sent from the source IP address to the destination IP address.

7. The method of claim 1 further comprising the step of the computer notifying an administrator to reconfigure a destination device at the destination IP address to block subsequent messages from the source IP address.

8. A computer system for graphically representing network intrusions, the system comprising:

a computer processing unit (CPU), a computer readable memory and a computer readable storage media;

first program instructions to identify intrusions sent from a source Internet Protocol (IP) address to a destination IP address and determine a color-code based on a number of the intrusions sent from the source IP address to the destination IP address; and

second program instructions to direct concurrent display on a monitor of the following;

a source icon representing the source IP address,

the source IP address in association with the source icon,

a destination icon representing the destination IP address,

the destination IP address in association with the destination icon, and

a first arrow pointing from the source icon to the destination icon representing intrusions sent from the source IP address to the destination IP address, the first arrow being color-coded based on the number of intrusions sent from the source IP address to the destination IP address;

wherein

the first and second program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory; and

wherein the first program instructions also identify a response to the source IP address from the destination IP address to the intrusion sent from the source IP address, and the second program instructions also direct concurrent display on the monitor of an arrow from the destination icon pointing to the source icon representing the response to the source IP address from the destination IP address to the intrusion sent from the source IP address.

9. The computer system of claim 8 wherein the source IP address is displayed within the source icon, and the destination IP address is displayed within the destination icon.

10. The computer system of claim 8 wherein the second program instructions also direct concurrent display on the monitor of the destination icon in a color-code based on a severity level of the intrusions sent to the destination IP address.

11. The computer system of claim 8 wherein the second program instructions also direct concurrent display on the monitor of the destination icon in a color-code based on a vulnerability of a destination device at the destination IP address.

12. The computer system of claim 8 wherein:

the first program instructions determine that one of the intrusions sent from the source IP address to the destination IP address was propagated from the destination IP address to another destination IP address; and

the second program instructions also direct concurrent display on the monitor of another destination icon representing the other destination IP address, and another arrow from the first said destination icon to the other destination icon to represent the intrusion that was propagated from the first said destination IP address to the other destination IP address.

13. The computer system of claim 8 wherein the second program instructions also direct concurrent display on the monitor, adjacent to the arrow, of a number of intrusions sent from the source IP address to the destination IP address.

14. A computer program product for graphically representing network intrusions, the computer program product comprising:

a computer readable storage media;

first program instructions to identify intrusions sent from a source Internet Protocol (IP) address to a destination IP address and determine a color-code based on a number of the intrusions sent from the source IP address to the destination IP address; and

second program instructions to direct concurrent display on a monitor of the following;

a source icon representing the source IP address,

the source IP address in association with the source icon,

a destination icon representing the destination IP address,

the destination IP address in association with the destination icon, and

a first arrow pointing from the source icon to the destination icon representing intrusions sent from the source IP address to the destination IP address, the first arrow being color-coded based on the number of intrusions sent from the source IP address to the destination IP address;

wherein

the first and second program instructions are stored on the computer readable storage media; and

wherein the first program instructions also identify a response to the source IP address from the destination IP address to the intrusion sent from the source IP address, and the second program instructions also direct concurrent display on the monitor of an arrow from the destination icon pointing to the source icon representing the response to the source IP address from the destination IP address to the intrusion sent from the source IP address.

15. The computer program product of claim 14 wherein the source IP address is displayed within the source icon, and the destination IP address is displayed within the destination icon.

16. The computer program product of claim 14 wherein the second program instructions also direct concurrent display on the monitor of the destination icon in a color-code based on a severity level of the intrusions sent to the destination IP address.

17. The computer program product of claim 14 wherein the second program instructions also direct concurrent display on the monitor of the destination icon in a color-code based on a vulnerability of a destination device at the destination IP address.

18. The computer program product of claim 14 wherein:

the first program instructions determine that one of the intrusions sent from the source IP address to the destination IP address was propagated from the destination IP address to another destination IP address; and

the second program instructions also direct concurrent display on the monitor of another destination icon representing the other destination IP address, and another arrow from the first said destination icon to the other destination icon to represent the intrusion that was propagated from the first said destination IP address to the other destination IP address.

19. The computer program product of claim 14 wherein:

the second program instructions also direct concurrent display on the monitor, adjacent to the arrow, of a number of intrusions sent from the source IP address to the destination IP address.