Swim Lane Visualization for Concurrent Event Pattern Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Businesses face challenges in identifying patterns and correlations within large amounts of data, such as machine data and Web logs, which are crucial for understanding user behavior and detecting security threats, but existing methods often fail to visualize these patterns effectively, leading to missed strategic insights.
Innovation Solution
The system provides a visualization method using swim lanes along a time axis, where each lane represents a specific event type, with color or shading indicating the number of events, allowing for the comparison of event timing across different types and facilitating the identification of correlations and patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple non-identical time-based search queries are executed to analyze different event types, then the ability to detect patterns and correlations improves, but the complexity of visualizing and comparing results across different time scales worsens
Solution Approach 1:
The patent introduces a new dimension for visualization by displaying events from multiple search queries with different time ranges on a single synchronized timeline. Each swim lane represents a different event type with its own time-based scaling, allowing patterns to be detected across diverse time scales without requiring separate visualizations for each query
Solution Approach 2:
The visualization is segmented into multiple swim lanes, each dedicated to a specific event type from a particular search query. This segmentation allows each event type to be analyzed independently while maintaining the ability to compare patterns across all event types through the synchronized timeline structure
2Measurement precision
If events are grouped into time buckets for visualization, then the ability to identify patterns and correlations improves, but the loss of detailed event timing information worsens
Solution Approach 1:
The patent applies partial aggregation by grouping events into time buckets for visualization purposes while preserving the complete original event data with precise timing information. The buckets provide a simplified visual representation for pattern identification, but the underlying detailed event data remains intact and accessible for further analysis
Solution Approach 2:
Time buckets serve as an intermediary representation between the raw detailed event data and the visual display. They provide a simplified view that facilitates pattern recognition while the system maintains the ability to access and display the complete detailed event information when needed
3Ease of operation
If swim lanes are used to represent different event types, then the ease of comparing event timing across types improves, but the device complexity increases
Solution Approach 1:
The swim lane structure serves multiple functions simultaneously: it separates different event types for independent analysis, provides a unified synchronized timeline for comparison, and allows flexible configuration of different time ranges for each event type. This multi-functionality reduces the need for multiple separate visualization tools
Data Source
AI summary
A visualization can include a set of swim lanes, each swim lane representing information about an event type. An event type can be specified, e.g., as those events having certain keywords and/or having specified value(s) for specified field(s). The swim lane can plot when (within a time range) events of the associated event type occurred. Specifically, each such event can be assigned to a bucket having a bucket time matching the event time. A swim lane can extend along a timeline axis in the visualization, and the buckets can be positioned at a point along the axis that represents the bucket time. Thus, the visualization may indicate whether events were clustered at a point in time. Because the visualization can include a plurality of swim lanes, the visualization can further indicate how timing of events of a first type compare to timing of events of a second type.