Network Incident Visualization via Graph Scoring
Solution Overview
Problem
Existing cyber security incident reports often contain numerous entities and relationships, making it difficult for analysts to quickly identify key elements and understand complex incidents.
Innovation Solution
A network incident summarization and visualization tool that uses a graph structure to store entities and relationships, applying a scoring methodology to identify significant incidents and rendering a filtered graph that highlights the most important aspects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If incident reports contain detailed entities and relationships to capture complete incident information, then the completeness and accuracy of incident documentation is improved, but the complexity and difficulty of analysis increases
Solution Approach 1:
The patent segments incident reports into discrete entities (IP addresses, hosts, users, etc.) and relationships between them, organizing the complex data into structured components that can be individually analyzed and visualized in a graph format, resolving the contradiction between maintaining complete information and reducing analysis complexity
Solution Approach 2:
The patent introduces an intermediary visualization layer that translates complex structured incident data into intuitive graphical representations, serving as a mediator between the raw detailed data and the analyst, thereby maintaining information completeness while reducing perceived complexity
2Reliability
If incident reports include all entities and relationships to ensure comprehensive coverage, then the thoroughness of incident analysis is improved, but the time required to identify key elements increases
Solution Approach 1:
The patent applies visual encoding through color coding and graphical attributes to highlight significant entities and relationships, enabling analysts to quickly distinguish key elements from less important data without sacrificing analytical thoroughness, thus reducing time to identify key elements while maintaining comprehensive coverage
Solution Approach 2:
The patent transforms tabular incident data into a graphical dimension with visual properties (nodes, edges, layouts), adding a spatial and visual dimension to the analysis that enables faster comprehension of complex relationships while maintaining the完整性 of the incident data
3Device complexity
If incident reports are presented in tabular format to organize data systematically, then the structure and organization of information is improved, but the ability to follow the narrative decreases
Solution Approach 1:
The patent transitions from two-dimensional tabular data to a graphical visualization that preserves systematic organization while adding spatial relationships and visual connectivity, enabling analysts to follow the incident narrative more naturally through visual pathways while maintaining structured data organization
4Productivity
If abbreviated narratives are used to visualize full incident narratives, then the conciseness and quick readability is improved, but the completeness of the demonstrated narrative decreases
Solution Approach 1:
The patent creates a dynamic visualization system where the level of detail can be adjusted and explored interactively, allowing analysts to quickly grasp the abbreviated overview while having the ability to drill down into complete narrative details when needed, thus maintaining both quick readability and narrative completeness
Data Source
AI summary
A network incident summarization and visualization tool presents a summarized or filtered rendering of an analysis or narrative of a collection of events gathered from a stream of incident reports. A graph structure stores entities and relationships between network entities in a graph form based on temporal correspondence between different incidents. An evaluation of the entities and the relationships implements a scoring methodology that identifies the most significant incidents based on the entities and component groups of entities associated by a sequence of relationships. The scoring methodology provides a normalized score that is filtered based on a threshold that removes entities having little to no correspondence or effect. The resulting filtered rendering defines a graph of entities and relationships ordered by type and significance such that the most important aspects of the rendered narrative are apparent.