Network Security Alarm Event Timeline and Object Link Visualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in efficiently processing and analyzing security alarm notifications, particularly in visualizing the timeline of events and object relationships associated with these notifications.
Innovation Solution
A method and apparatus for network security-based page processing that displays an event timeline and an object link in an event display page corresponding to a target alarm notification. The event timeline is composed of event units with description information that includes association relationships between objects, sorted by occurrence time, while the object link features sub-links with object icons representing associated objects, showcasing their connection relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional security alarm notification processing is used, then the system structure remains simple, but the efficiency of processing and analyzing security alarm notifications is low
Solution Approach 1:
The patent segments the security alarm notification processing into distinct functional modules: alarm notification receiving module, event timeline generating module, object link generating module, and display module. Each module handles a specific aspect of the processing workflow, enabling parallel processing and improving overall efficiency without creating a monolithic complex system.
Solution Approach 2:
The patent introduces a temporal dimension through the event timeline, which displays security events chronologically. This adds a time-based perspective to the alarm analysis, allowing operators to understand the sequence and progression of events. Additionally, the object link dimension connects related security objects, creating a multi-dimensional visualization that enhances analysis capability.
2Loss of information
If detailed event information and object relationships are displayed, then the traceability and analysis capability are improved, but the information visualization complexity increases
Solution Approach 1:
The information is segmented into two distinct visualization components: event timeline for temporal sequencing and object link for relationship mapping. This segmentation allows each component to focus on specific aspects of traceability without overwhelming the user with all information simultaneously, reducing visualization complexity while maintaining comprehensive traceability.
Solution Approach 2:
The event timeline and object link serve as intermediary visualizations between the raw security alarm data and the operator's understanding. These intermediaries transform complex security event data into structured, visually intuitive representations, making traceability accessible without requiring direct interpretation of raw data.
3Loss of information
If event timeline and object link are displayed simultaneously, then the comprehensive understanding of events and connections is improved, but the page layout complexity increases
Solution Approach 1:
The display area is segmented into distinct regions for the event timeline and object link visualizations. This spatial segmentation allows both comprehensive views to coexist on the same page without overlapping or interfering with each other, maintaining layout simplicity while providing complete information.
Solution Approach 2:
The patent utilizes spatial dimensions of the display interface to accommodate multiple visualization types. By arranging the event timeline and object link in different spatial zones, the system provides comprehensive information without creating a cluttered or complex page layout, as each visualization occupies its own dimensional space.
Data Source
AI summary
Embodiments of the disclosure discloses a method, apparatus, device and storage medium for network security-based page processing, and relates to the technical field of computer. The method comprises displaying, in an event display page corresponding to a target alarm notification, an event timeline corresponding to the target alarm notification and an object link corresponding to the target alarm notification, the event timeline comprises a plurality of event units, an event unit comprises description information of an associated event of the target alarm notification, the description information comprises an association relationship between associated objects of the associated event, the plurality of event units is sorted and displayed based on occurrence time of associated events; the object link comprises a sub-link corresponding to an object unit, the sub-link comprises an object icon of an associated object, and a connection relationship between object icons corresponds to the association relationship.