Browse Prior Art Database

Method and Apparatus for Incremental Augmentation and Visual Indication of Event Context Information Disclosure Number: IPCOM000033098D
Original Publication Date: 2004-Nov-25
Included in the Prior Art Database: 2004-Nov-25
Document File: 5 page(s) / 112K

Publishing Venue



Interactive Event Monitoring, and in particular the monitoring of events from multiple network security sensors (such as IDS: Intrusion Detection Systems) is a challenging task for the operators. Operators have to review many thousand events per hour and identify those events that require an in-depth investigation and indicate a potential problem. To best support this task events would be augmented with "context information" such as the operating system of the involved machine and previously identified vulnerabilities. The context information should further indicate whether one knows of problems originating from a source-IP in the past (over an extended period of time, e.g. during the last 10 days). Providing such context information is a time-consuming task as it involves searching through potentially large databases of known vulnerabilities and of prior traffic. Therefore, it is typically not possible to display such context information in real time. As operators need to react to urgent security events as quickly as possible, they cannot wait for this context information to become available. State-of-the-art consoles for online monitoring system therefore perform only minimal pre-processing and the supporting infrastructure does not perform any computation-intensive operations for augmenting event information.

This text was extracted from a PDF file.
At least one non-text object (such as an image or picture) has been suppressed.
This is the abbreviated version, containing approximately 36% of the total text.

Page 1 of 5

Method and Apparatus for Incremental Augmentation and Visual Indication of Event Context Information

The optimal support system would provide detailed context information while guaranteeing real-time delivery of event information. A method for asynchronous delivery of context information is presented in this publication. In this solution un-augmented event information is forwarded immediately to the operator for review. At the same time one or more parallel processes are started to collect event context information. Once new pieces of event context information become available they are added to the current event information. Visual markers on events are used to convey the status and the result of the parallel search for context information.

In particular the solution uses the architecture described in Figure 1 below and follows the following steps to achieve the results described above.

I. To distribute the tasks of event information augmentation and long-term event correlation to dedicated computers in the network

(C1 & C2 in Fig. 1 with information being distributed in step 3).
II. To display information about the un-augmented and uncorrelated events immediately to the operators (Fig. 1 steps 1, 2 & 4)
III. To receive augmentation information for already displayed events as the results of the potentially long computations become available. (Fig. 1, step 5a & 5b).
IV. Use the augmentation information in the console to re-classify and otherwise post-process the augmented events.
V. Update the operators' console event display to indicate (if necessary) the newly learned information about the events.

     Events that have been classified as unproblematic need to get redisplayed for a second evaluation by the operator.


Page 2 of 5

Figure 1: System Architecture

Iconic Display of Context-based Event Classification

The user interface design challenge stems from the fact that context information incrementally becomes available after the base event data has already been displayed. Thus, the operator needs to see whether the search for context information for an event is underway. In case a critical piece of information has been discovered, the operator needs to be informed of this fact, even if the related event has possibly been classified as harmless already. Thus, re-classification of events might become necessary when relevant context information becomes available.

Calculation of the context information is relatively "expensive". Therefore, operators need to maximize the utility of this information. For example, it should be possible to sort all events into classes of discovered context information. On the other hand, context information must be displayed using little space, and without distracting from the main task as much as possible .

Context information display is provided in the form of a context-class icon in a separate column in the event list. Context classes may be very specific to an application domain and security installation. T...