Security Event Visualization Selection via Importance Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity and volume of event information in computer security threat reports make it difficult to efficiently mine for critical information using existing Security Information and Event Management (SIEM) techniques.
Innovation Solution
Automatically selecting and ranking visualizations based on importance scores, using category assignment and prioritization algorithms, to present relevant event information effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional SIEM techniques are used to gather and present event information, then comprehensive security monitoring is achieved, but the complexity and volume of event information makes it difficult to efficiently mine for critical information
Solution Approach 1:
The patent extracts and separates event information into distinct categories (e.g., authentication events, file access events, registry events) before processing. This categorization extracts only the relevant portions of event data needed for specific security analyses, reducing the overall volume of information that needs to be manually mined while maintaining comprehensive monitoring coverage.
Solution Approach 2:
The system segments the event information processing into multiple independent components: event collection, categorization, visualization generation, and rendering. Each component handles specific aspects of event data independently, allowing efficient processing of large volumes of events without creating a single complex processing bottleneck.
2Adaptability or versatility
If event information is presented using multiple visualization types, then comprehensive analysis capability is improved, but the complexity of generating and selecting appropriate visualizations increases
Solution Approach 1:
The system automatically selects and generates appropriate visualizations based on the categorized event information without requiring manual intervention. The automated visualization generator consumes categorized event data and autonomously produces suitable visual representations, eliminating the complexity of manual visualization selection and generation while maintaining versatile analysis capabilities.
Solution Approach 2:
The patent changes the parameter of event information organization by introducing category labels as a new dimension for structuring data. This categorization parameter enables the system to automatically determine appropriate visualizations based on event types, simplifying the visualization selection process while expanding analysis versatility across different security domains.
3Ease of operation
If manual selection and customization of visualizations is performed, then user-specific information needs are met, but the time and effort required to generate reports increases
Solution Approach 1:
The automated visualization system serves itself by automatically selecting appropriate visualizations and generating reports based on categorized event information. This self-service approach eliminates the need for manual report generation while still providing user-specific customized views through automated filtering and selection processes.
Solution Approach 2:
The system performs preliminary categorization of event information before visualization generation. By pre-organizing events into categories in advance, the system prepares the data structure needed for automated visualization selection, significantly reducing the time required for report generation while maintaining user-specific customization capabilities.
Data Source
AI summary
Visualization for presenting event information indicative of a computer security threat is automatically selected from available visualizations. Event information received from data sources is assigned a category prior to being stored in an event log. The event log may be searched for relevant event information using the assigned categories. Visualizations applicable to the relevant event information are retrieved and given an importance score, which may be based on execution of prioritization algorithms using corresponding relevant event information. The retrieved visualizations are ranked based on their importance scores. One or more retrieved visualizations that have the best importance scores relative to other retrieved visualization are selected for rendering.