Persistent Event Visualization via Temporal Overlay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Investigators lack adequate tools to effectively identify and analyze persistent software-related events, such as user sessions, which can lead to overlooked critical events during security breaches or malware execution, due to the lack of visualization tools for events extending over time.
Innovation Solution
A system and method to identify and visualize persistent state information by comparing software-related events with timestamps, displaying information about persistent events and other events occurring during their timeframe, using a method that includes sorting timestamps chronologically and creating metadata objects for user sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If investigators use traditional event analysis tools, then discrete events can be identified, but persistent events extending over time are not readily apparent and may be overlooked
Solution Approach 1:
The patent introduces a temporal dimension to event visualization by displaying events on a timeline and overlaying persistent state information (such as user sessions) that extends across multiple timestamps. This dimensional addition allows investigators to simultaneously view discrete events and persistent states in their temporal context, making persistent events apparent without losing discrete event detection capability
Solution Approach 2:
The system introduces persistent state information as an intermediary layer that mediates between discrete events and temporal context. By overlaying persistent states (e.g., user sessions, process states) onto the event timeline, the system creates a contextual framework that helps investigators identify which discrete events occurred during specific persistent states, thereby revealing persistent events that would otherwise be overlooked
2Loss of information
If investigators analyze individual events separately, then detailed event information can be examined, but the ability to correlate events with persistent context is reduced
Solution Approach 1:
The patent merges discrete event information with persistent state information in a unified visualization display. The system combines detailed event data (timestamps, event types, sources) with persistent context (user sessions, state durations) into a single integrated view, allowing investigators to examine both individual event details and their correlation with persistent states simultaneously without switching between separate analysis tools
3Quantity of substance
If traditional event logging is used, then events can be recorded with timestamps, but events extending over time periods are not readily apparent
Solution Approach 1:
The system dynamically processes and visualizes event data by continuously analyzing timestamps and identifying patterns that indicate persistent states. The visualization adapts to show both individual events and aggregated persistent states, allowing investigators to detect persistent events regardless of the volume of underlying event data through automated temporal pattern recognition
Data Source
AI summary
A system and method operable to identify and analyze persistent state information among a plurality of software-related events, and present persistent state information in a unified fashion.