Rarity analysis in network security anomaly/threat detection
US-10038707-B2 · Jul 31, 2018 · US
US10229243B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-10229243-B2 |
| Application number | US-201514961235-A |
| Country | US |
| Kind code | B2 |
| Filing date | Dec 7, 2015 |
| Priority date | Dec 26, 2012 |
| Publication date | Mar 12, 2019 |
| Grant date | Mar 12, 2019 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
A method and system create a model of a set of relationships between a set of parent computer network objects and a set of corresponding child computer network objects, over a period of time, and output a user interface graphing the model in a single view to illustrate the set of relationships over the period of time. The parent computer network objects include virtual machines and the child computer network objects include hosts. The user interface includes a search option to provide for a search of problems with the child computer network objects over the period of time.
Opening claim text (preview).
What is claimed is: 1. A method comprising: generating, by a microprocessor of a computing device, a model of a set of relationships that includes virtual machines, over a time period; on a display of the computing device in a single view on a user interface, displaying a graph of the model to illustrate changes in the set of relationships during a user-selected first and second time period, the single view including changes in status corresponding to virtual machines with a selected status of interest to a user of the model; filtering which virtual machines are displayed in the single view to depict an expanded depth of view of relationships and the selected status of interest pertaining to two or more virtual machines during the user-selected first and second time period; and hiding at least one of the relationships based on receiving a selection of at least one user interface element depicted in the single view. 2. The method of claim 1 , wherein changes to the first and second time periods are from a first interval to a second interval. 3. The method of claim 2 , wherein the first interval is measured in hours and the second interval is measured in minutes. 4. The method of claim 1 , further comprising: generating a status indication for a relationship between virtual machines and child hosts. 5. The method of claim 1 , wherein the first and second time periods are adjustable. 6. The method of claim 1 , wherein the expanded depth of view indicates that at least one of the virtual machines caused a change in a behavior pattern of another of the virtual machines. 7. The method of claim 1 , wherein filtering which virtual machines are displayed includes filtering a number of graph layers depicted for child hosts associated with at least one of the virtual machines. 8. The method of claim 1 , wherein the selection of the at least one user interface element hides one or more relationships depicted in the single view based at least in part on a common relationship type associated with each of the relationships. 9. The method of claim 1 , further comprising displaying a search option. 10. A system comprising: a display; a memory including executable instructions; and a processor operably coupled to the memory and configured to execute the executable instructions to cause the system to: create, by a microprocessor of a computing device, a model of a set of relationships that includes virtual machines, over a time period; on a display of the computing device in a single view on a user interface, display a graph of the model to illustrate changes in the set of relationships during a user-selected first and second time period, the single view including a status change indicator corresponding to virtual machines with a selected status of interest to a user of the model; filter which virtual machines are displayed in the single view to depict an expanded depth of view of relationships and the selected status of interest pertaining to two or more virtual machines in a time period between the user-selected first and second time period; and hide at least one of the relationships based on receiving a selection of at least one user interface element depicted in the single view. 11. The system of claim 10 , wherein changes to the first and second time period are from a first interval to a second interval. 12. The system of claim 11 , wherein the first interval is measured in hours and the second interval is measured in minutes. 13. The system of claim 10 , wherein the processor is further configured to execute the instructions to cause the system to: generate a status indication for a relationship between virtual machines and child hosts. 14. The system of claim 10 , wherein the first and the second time periods are adjustable. 15. The system of claim 10 , wherein the expanded depth of view indicates that at least one of the virtual machines caused a change in a behavior pattern of another of the virtual machines. 16. The system of claim 10 , wherein the processor is further configured to execute the instructions to cause the system to: filter, from display, a number of graph layers depicted for child hosts associated with at least one of the virtual machines. 17. The system of claim 10 , wherein the selection of the at least one user interface element hides one or more relationships depicted in the single view based at least in part on a common relationship type associated with each of the relationships. 18. The system of claim 10 , wherein the processor is further configured to execute the instructions to cause the system to: display a search option. 19. A non-transitory computer-readable storage medium including code segments that when executed by a processor cause the processor to: create, by a microprocessor of a computing device, a model of a set of relationships that includes virtual machines, over a time period; on a display of the computing device in a single view on a user interface, display a graph of the model to illustrate changes in the set of relationships during a user-selected first and second time period, the single view including a status change indicator corresponding to virtual machines with a selected status of interest to a user of the model; filter which virtual machines are displayed in the single view to depict an expanded depth of view of relationships and the selected status of interest pertaining to two or more virtual machines during the user-selected first and second time period; and hide at least one of the relationships based on receiving a selection of at least one user interface element depicted in the single view. 20. The non-transitory computer-readable storage medium of claim 19 , wherein the user interface enables changes to the first and second time periods are from a first interval to a second interval. 21. The non-transitory computer-readable storage medium of claim 20 , wherein the first interval is measured in hours and the second interval is measured in minutes.
comprising specially adapted graphical user interfaces [GUI] · CPC title
Computer systems status display (G06F11/327 takes precedence) · CPC title
where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title
using filtering, e.g. reduction of information by using priority, element types, position or time · CPC title
Discovery or management of network topologies · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.