Security Event Timeline Analytics for Abnormal Event Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing monitoring systems lack the ability to intelligently present events in a way that highlights their importance and abnormality, making it difficult for users to understand and analyze security data effectively.
Innovation Solution
An analysis engine that weights events based on importance and abnormality, generating a graphical timeline with enhanced visualization of event density and abnormality, and provides associated monitoring system data upon user request.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If monitoring systems store and present all detected events, then completeness of security data is improved, but usability and ease of analysis deteriorates due to information overload
Solution Approach 1:
The system extracts and separates abnormal events from the complete set of security events. By identifying and isolating events that deviate from learned normal patterns, the system presents only the most relevant information to users, reducing information overload while maintaining analytical completeness.
Solution Approach 2:
The system applies different presentation qualities to different types of events. Normal events are presented in a standard manner, while abnormal events receive enhanced visualization and prioritized display. This differential treatment allows users to quickly identify important events without being overwhelmed by the volume of all events.
2Loss of information
If monitoring systems provide detailed security event data, then information completeness is improved, but understanding and interpretation by users deteriorates due to complexity
Solution Approach 1:
The system introduces an analysis engine as an intermediary between the raw security event data and the user. This intermediary learns normal patterns of system operation and automatically identifies abnormal events, translating complex security data into meaningful insights that are easier for users to understand and act upon.
Solution Approach 2:
The analysis engine performs self-learning by automatically analyzing historical security events and establishing baseline patterns of normal operation. This self-service capability allows the system to continuously improve its ability to identify abnormal events without requiring manual configuration or user intervention, thereby maintaining information completeness while improving interpretability.
Data Source
AI summary
Techniques are described for presenting events detected by a monitoring system. A system receives a selection of a particular time period, identifies security events detected by a monitoring system during the selected time period, and classifies a subset of the identified security events as abnormal events. The system further generates a density of the identified security events over the selected time period, generates a density of the subset of the identified security events classified as abnormal events, and identifies monitoring system data associated with the selected time period. The system additionally generates a graphical representation of the density of the identified security events, the density of the subset of the identified security events classified as abnormal events, and the identified monitoring system data, and provides the graphical representation for display.