Geo visualization of network flows

Patent metadata

Field	Value
Publication number	US-2016359880-A1
Application number	US-201615173444-A
Country	US
Kind code	A1
Filing date	Jun 3, 2016
Priority date	Jun 5, 2015
Publication date	Dec 8, 2016
Grant date	—

Abstract

The present technology is directed to mapping flow data and overlaying it on a geographic map. Furthermore the geographical map can also display attacks and the flow of an attack from the source to a logical entity. The map additionally can be accompanied with a pie chart relating to the attacks and intensity of attacks. Normal flows can also be displayed on the map along with the attack flows.

First claim

1 . A system for arranging a graph representing a multi-tier application the system comprising:
a processor; and a non-transitory computer readable medium storing processor executable instructions, the instructions effective to cause the processor to:
identify a plurality of data flows matching received search criteria;
based on a source and destination data from the plurality of data flows matching the received search criteria, represent the plurality of data flows on a geographic map presented within a graphical user interface, wherein the graphical user interface includes user interface controls effective to adjust the plurality of flows represented in the geographic map.

2 . The system of claim 1 , wherein the user interface controls can filter flows that have been labeled as attack flows to only represent attack flows on the geographic map.

3 . The system of claim 1 , wherein the instructions are effective to:
present a chart along with the geographic map, the chart presenting categories of the plurality of data flows and statistics pertinent the categories of the plurality of data flows.

4 . The system of claim 3 , wherein the chart presenting categories of the plurality of data flows is interactive, and the instructions are effective to:
receive an input in the chart effective to select one or more categories of the plurality of data flows; and filter the plurality of flows represented on the geographic map to only display data flows of the selected one or more categories.

5 . The system of claim 3 , wherein the chart is a three dimensional chart, wherein a first pair of dimensions represents the categories of the plurality of data flows and the statistics pertinent the categories of the plurality of data flows, and the second pair of dimensions represents the categories of data flows and an intensity of the category.

6 . The system of claim 1 , wherein the plurality of data flows include data flows that have been labeled as an attack and data flows that have not been labeled as an attack.

7 . The system of claim 1 , wherein the user interface controls are configured to expand a radius of a source of the data flows.

8 . The system of claim 1 , wherein the user interface controls are configured to broaden the search criteria in at least one aspect.

9 . A non-transitory computer readable medium comprising instructions stored thereon, the instructions effective to cause the processor to:
identify a plurality of data flows matching received search criteria; based on a source and destination data from the plurality of data flows matching the received search criteria, represent the plurality of data flows on a geographic map presented within a graphical user interface, wherein the graphical user interface includes user interface controls effective to adjust the plurality of flows represented in the geographic map.

10 . The non-transitory computer readable medium of claim 9 , wherein the user interface controls can filter flows that have been labeled as attack flows to only represent attack flows on the geographic map.

11 . The non-transitory computer readable medium of claim 9 , wherein the instructions are effective to:
present a chart along with the geographic map, the chart presenting categories of the plurality of data flows and statistics pertinent the categories of the plurality of data flows.

12 . The non-transitory computer readable medium of claim 11 , wherein the chart presenting categories of the plurality of data flows is interactive, and the instructions are effective to:
receive an input in the chart effective to select one or more categories of the plurality of data flows; and filter the plurality of flows represented on the geographic map to only display data flows of the selected one or more categories.

13 . The non-transitory computer readable medium of claim 11 , wherein the chart is a three dimensional chart, wherein a first pair of dimensions represents the categories of the plurality of data flows and the statistics pertinent the categories of the plurality of data flows, and the second pair of dimensions represents the categories of data flows and an intensity of the category.

14 . The non-transitory computer readable medium of claim 9 , wherein the plurality of data flows include data flows that have been labeled as an attack and data flows that have not been labeled as an attack.

15 . The non-transitory computer readable medium of claim 9 , wherein the user interface controls are configured to expand a radius of a source of the data flows.

16 . The non-transitory computer readable medium of claim 9 , wherein the user interface controls are configured to broaden the search criteria in at least one aspect.

17 . A method comprising:
searching data analyzed by an analytics engine in response to a received query to visualize data flows; identifying a plurality of data flows matching the received query criteria; representing the plurality of data flows on a geographic map presented within a graphical user interface; receive input to expand geographic radius of attack point.

18 . The method of claim 17 , further comprising:
searching for flows from the expanded geographic radius; and displaying all flows matching expanded search.

19 . The method of claim 19 , wherein the all flows include normal flow and attack flows.

20 . The method of claim 17 , comprising:
presenting a three dimensional chart, wherein a first pair of dimensions represents the categories of the plurality of data flows and the statistics pertinent the categories of the plurality of data flows, and the second pair of dimensions represents the categories of data flows and an intensity of the category.

Assignees

• Cisco Tech Inc

Inventors

• Pang Jackson Ngoc Ki
• Watts Michael Standish
• Parandehgheibi Ali
• Prasad Rohit Chandra
• Malhotra Varun Sagar
• Nguyen Hoang Viet

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04W72/54

  based on quality criteria · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L43/0841

  Round trip packet loss · CPC title

• G06F2221/2105

  Dual mode as a secondary aspect · CPC title