Real-Time Security Event Display Prioritization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the number of computing devices connected to a network increases, security events become overwhelming, leading to unreliable and unreadable real-time monitoring on graphical user interfaces, where critical events may be missed due to a constant flow of scrolling alerts or periodic refreshes.
Innovation Solution
A system with an administrator device and client devices, featuring a preferences module and an event rate adapter module, which allows network security administrators to set preferences for displaying real-time security events, prioritizing critical events to remain on the screen longer and adjusting the scrolling rate to ensure discernibility, ensuring critical events are not missed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security events are displayed in real-time scrolling format, then monitoring coverage is improved, but readability and reliability deteriorate due to constant flow making events unreadable
Solution Approach 1:
The system dynamically adjusts the display mode based on event criticality. Critical events are held stationary on the screen for extended periods, while non-critical events continue to scroll. This dynamic differentiation resolves the contradiction by making critical events readable (stationary) while maintaining comprehensive monitoring coverage (continuous scrolling of all events).
Solution Approach 2:
Different display qualities are applied to different types of security events. Critical events receive enhanced display treatment (stationary, longer duration) while non-critical events receive standard treatment (scrolling). This local quality differentiation allows the system to prioritize readability for important events while maintaining overall monitoring reliability.
2Productivity
If scrolling rate is increased to show more events, then monitoring coverage is improved, but event discernibility deteriorates
Solution Approach 1:
The scrolling rate is dynamically adjusted based on event criticality. Critical events are displayed at a slower rate or held stationary, while non-critical events scroll at higher rates. This dynamic rate adjustment maintains high productivity by displaying many events while ensuring critical events remain discernible.
Solution Approach 2:
The system changes the display parameter (scrolling speed) based on event characteristics. By varying the scroll rate parameter for different event types, the system achieves both high overall display throughput and sufficient discernibility for critical events.
3Device complexity
If all security events are treated equally, then system simplicity is maintained, but critical event detection deteriorates due to overwhelming volume
Solution Approach 1:
The system applies different handling qualities to different events based on criticality. Critical events receive prioritized treatment (stationary display, extended duration) while non-critical events receive standard processing. This local differentiation improves critical event detection reliability without significantly increasing overall system complexity.
Solution Approach 2:
The system changes display parameters (duration, position, scrolling behavior) based on event criticality parameters. This parameter-based differentiation allows the system to reliably detect critical events while maintaining relatively simple event handling logic through rule-based parameter adjustment.
Data Source
AI summary
A system and method for displaying a number of real-time security events comprises a number of client devices and an administrator device communicatively coupled to the client devices. The administrator device may comprise a preferences module and an event rate adapter module communicatively coupled to the preferences module. The preferences module receives input describing how to display a number of security events on the screen of a graphical user interface the event rate adapter module displays a number of real-time scrolling security events for a relatively longer period of time than other security events.