Anonymizing machine data events

Patent metadata

Field	Value
Publication number	US-9836623-B2
Application number	US-201514611155-A
Country	US
Kind code	B2
Filing date	Jan 30, 2015
Priority date	Jan 30, 2015
Publication date	Dec 5, 2017
Grant date	Dec 5, 2017

Abstract

Components of a system for generating anonymized data from timestamped event data are disclosed. The generation of anonymized data is performed in accordance with an anonymization configuration. The anonymization configuration includes information regarding the source of the event data, particulars about the anonymization process that transforms the clear event data from the source into an anonymized form, and particulars about the destination and characteristics for the output dataset. A graphical user interface permits development of anonymization configurations in an interactive, iterative way. The configured anonymizer employs methods and options to produce anonymized data with superior usability as a substitute for real world data, including a mode to effectively emulate live data streams.

First claim

The invention claimed is:

1. A method comprising:
causing a graphical user interface (GUI) to display information related to one or more events and to enable the user to specify anonymization configuration information including a timestamp-type anonymization type and an associated time value for determining a time offset, each of the one or more events comprising a timestamp and a portion of raw machine data having latent field data, and wherein the displayed information related to the one or more events, for each event, includes at least some of the portion of raw machine data of the respective event; and
causing the GUI to display information related to at least one of the one or more events in anonymized form, wherein the anonymized form is determined at least in part by user input received from the GUI for specifying anonymization configuration information.

2. The method of claim 1 further comprising transforming at least some of the information related to one or more events into the anonymized form using an extraction rule.

3. The method of claim 1 wherein the anonymized form is determined at least in part by replacing a source value for a field in the information related to at least one of the one or more events, the source value for the field located using an extraction rule.

4. The method of claim 1 further comprising receiving event data from a search query of an event processing system, and wherein the received event data is a source of the information related to one or more events.

5. The method of claim 1 further comprising receiving event data from a search query, the received event data matching a selection criteria for event data of an event processing system, the selection criteria being based at least in part on user input received via the GUI, and wherein the received event data is a source of the information related to one or more events.

6. The method of claim 1 further comprising storing an anonymization configuration in an anonymization configuration data store, the anonymization configuration based at least in part on user input received from the GUI for specifying anonymization configuration information.

7. The method of claim 1 wherein the causing the GUI to display information related to one or more events includes causing the GUI to display a list of events.

8. The method of claim 1 wherein the causing the GUI to display information related to one or more events includes causing the GUI to display, for a particular event, information including rule-identified data and other non-rule-identified data, and wherein the visual appearance of the rule-identified data is different than the visual appearance of the non-rule-identified data.

9. The method of claim 1 wherein causing the GUI to display information related to one or more events includes causing the GUI to display raw data associated with the particular event, wherein the displayed raw data associated with the particular event includes a segment of rule-identified data, and wherein the user is enabled to interact distinctly with the displayed segment of rule-identified data.

10. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to specify an anonymization type for association with an extraction rule in an anonymization configuration.

11. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to identify an extraction rule by interacting with displayed machine data identified using the extraction rule, and causing the GUI to enable the user to specify an anonymization type for association with the extraction rule in an anonymization configuration.

12. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to identify an extraction rule by interacting with displayed machine data identified using the extraction rule, and causing the GUI to enable the user to specify script, static, timestamp, list, or map as an anonymization type for association with the extraction rule in an anonymization configuration.

13. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to identify an extraction rule by interacting with displayed machine data identified using the extraction rule, and causing the GUI to enable the user to specify an anonymization type for association with the extraction rule in an anonymization configuration, and wherein the anonymization type is specified by choosing one from among at least random, script, static, timestamp, list, and map.

14. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to identify an extraction rule by interacting with displayed machine data identified using the extraction rule, and causing the GUI to enable the user to specify, for association with the extraction rule in an anonymization configuration:
an anonymization type, and
information for directing the performance of anonymization in accordance with the anonymization type.

15. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to specify a list-type anonymization type and an associated anonymization list having a plurality of values.

16. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to specify a script-type anonymization type and an associated anonymization script having computer language script for determining an anonymized value.

17. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to specify a map-type anonymization type and associated anonymization map information including at least one value and a corresponding anonymized value.

18. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to specify a random-type anonymization type and information for determining a set of values available for random substitution.

19. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to specify a list of one or more terms for exclusion from change by an anonymization.

20. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to specify information about an output dataset.

21. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enable the user to specify information about an output dataset including specifying that the output dataset is an active dataset produced by one or more iterations over a set of event data.

22. The method of claim 1 wherein causing the GUI to enable the user to specify anonymization configuration information includes causing the GUI to enabl

Assignees

• Splunk Inc
• Splunk Inc

Inventors

• Carasso David

Classifications

• G06F3/0484

  for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range · CPC title

• G06F3/0482

  Interaction with lists of selectable items, e.g. menus · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• G06F21/6254 Primary

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• G06F16/2322

  using timestamps · CPC title