公开(公告)号：US10778712B2

公开(公告)日：2020-09-15

申请号：US16264561

申请日：2019-01-31

Applicant: Splunk Inc

Inventor： Vijay Chauhan ,  Cary Noel ,  Wenhui Yu ,  Luke Murphey ,  Alexander Raitz ,  David Hazekamp

IPC: H04L29/06 ,  G06F3/0484 ,  G06F16/25 ,  G06F16/248 ,  G06F16/2458 ,  H04L12/26 ,  G06F40/169 ,  G06F21/62

Abstract: Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines.

公开(公告)号：US10460519B2

公开(公告)日：2019-10-29

申请号：US16049622

申请日：2018-07-30

Applicant: SPLUNK INC.

Inventor： Roy Arsan ,  Alexander Raitz ,  Clark Allan ,  Cary Glen Noel

IPC: G06T19/00 ,  G06T15/04 ,  G06T19/20 ,  G06T15/20 ,  G06T11/20 ,  G06T15/00 ,  G06F9/50

Abstract: Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object's data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

公开(公告)号：US09990769B2

公开(公告)日：2018-06-05

申请号：US15498436

申请日：2017-04-26

Applicant: Splunk Inc.

Inventor： Roy Arsan ,  Alexander Raitz ,  Clark Allan ,  Cary Glen Noel

IPC: G06T15/00 ,  G06T19/00 ,  G06T15/20

CPC classification number: G06T19/003 ,  G06T11/206 ,  G06T15/005 ,  G06T15/20 ,  G06T19/00

Abstract: Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object's data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

公开(公告)号：US09848008B2

公开(公告)日：2017-12-19

申请号：US15339952

申请日：2016-11-01

Applicant: Splunk Inc

Inventor： Vijay Chauhan ,  Cary Noel ,  Wenhui Yu ,  Luke Murphey ,  Alexander Raitz ,  David Hazekamp

IPC: H04L29/06 ,  G06F17/30 ,  G06F3/0484 ,  H04L12/26 ,  G06F17/24 ,  G06F21/62

CPC classification number: H04L63/1425 ,  G06F3/0484 ,  G06F17/241 ,  G06F17/30551 ,  G06F17/30554 ,  G06F17/30557 ,  G06F21/629 ,  G06F2221/2151 ,  H04L43/06

Abstract: Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines.

公开(公告)号：US20170301136A1

公开(公告)日：2017-10-19

申请号：US15498436

申请日：2017-04-26

Applicant: Splunk Inc.

Inventor： Roy Arsan ,  Alexander Raitz ,  Clark Allan ,  Cary Glen Noel

IPC: G06T19/00 ,  G06T15/20 ,  G06T15/00

CPC classification number: G06T19/003 ,  G06T11/206 ,  G06T15/005 ,  G06T15/20 ,  G06T19/00

Abstract: Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object's data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

公开(公告)号：US20160057162A1

公开(公告)日：2016-02-25

申请号：US14929321

申请日：2015-10-31

Applicant: Splunk Inc.

Inventor： Munawar Monzy Merza ,  John Coates ,  James M Hansen ,  Lucas Murphey ,  David Hazekamp ,  Michael Kinsley ,  Alexander Raitz

IPC: H04L29/06

CPC classification number: H04L63/1425 ,  G06F17/30551 ,  G06F21/552 ,  G06F2221/2151 ,  H04L63/1408 ,  H04L63/1416

Abstract: A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

Abstract translation: 为表征计算通信或对象的一组事件中的每个事件确定度量值。 例如，度量值可以包括事件中的URL或代理字符串的长度。 生成子集标准，使得子集内的度量值与群体的中心（例如，分布尾部）相对分开。 将标准应用于度量值产生一个子集。 该子集的表示呈现在交互式仪表板中。 该表示可以包括子集中的唯一值和相应事件发生的计数。 客户端可以选择表示中的特定元素，以便相对于子集中的特定值对应的各个事件来呈现更多的细节。 因此，客户可以使用他们的知识系统操作和遵守价值频率和基础事件来识别异常度量值和潜在的安全威胁。

公开(公告)号：US20150035823A1

公开(公告)日：2015-02-05

申请号：US14266523

申请日：2014-04-30

Applicant: Splunk Inc.

Inventor： Roy Arsan ,  Alexander Raitz ,  Clark Allan ,  Cary Glen Noel

IPC: G06T15/00

CPC classification number: G06T19/003 ,  G06F9/50 ,  G06T11/206 ,  G06T15/005 ,  G06T15/04 ,  G06T15/20 ,  G06T15/205 ,  G06T19/00 ,  G06T19/20 ,  G06T2215/16

Abstract: Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object's data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

Abstract translation: 根据各种实施例的系统和方法使得用户能够从第一人的观点来观看3D环境内的数据对象（“节点”）的三维表示。 该系统可以被配置为允许用户通过将虚拟相机移动通过3D环境与节点进行交互。 节点可以具有分别对应于数据对象的数据字段内的特定静态或动态值的一个或多个属性。 属性可以包括节点的物理方面，例如颜色，大小或形状。 系统可以将3D环境内的相关数据对象分组为使用一个或多个聚类指示符分离的群集，其可以是包含相关数据对象的圆顶或类似特征的形式。 该系统可以使多个用户能够同时访问3D环境，或者记录与3D环境的交互。

公开(公告)号：US20150035822A1

公开(公告)日：2015-02-05

申请号：US14266511

申请日：2014-04-30

Applicant: Splunk Inc.

Inventor： Roy Arsan ,  Alexander Raitz ,  Clark Allan ,  Cary Glen Noel

IPC: G06T19/00 ,  G06F3/01

CPC classification number: G06T19/006 ,  G06F3/011

Abstract: A system and method that allows a user to view objects in a three-dimensional environment, where one or more of the objects have a data display (e.g., a data billboard, etc.) that shows data about the object. To enhance user experience and to provide relevant contextual data as the user navigates through the three-dimensional environment, the system calculates a location for the user and a location for each object and determines if a relationship between the user frame of reference and each object location satisfies a first criterion. If the first criterion is satisfied, the system is configured to move the data display to the bottom of a viewing area of the three-dimensional environment (e.g. docking the data display to the bottom of the viewing area, etc.). The system may also arrange the data displays in the same order as the objects are perceived by the user in the three-dimensional environment.

Abstract translation: 一种允许用户在三维环境中查看对象的系统和方法，其中一个或多个对象具有显示关于对象的数据的数据显示（例如，数据广告牌等）。 为了增强用户体验并在用户通过三维环境导航时提供相关的上下文数据，系统计算用户的位置和每个对象的位置，并确定用户参照系和每个对象位置之间的关系 满足第一个标准。 如果满足第一标准，则系统被配置为将数据显示移动到三维环境的观看区域的底部（例如，将数据显示器对准观看区域的底部等）。 系统还可以按照用户在三维环境中感知对象的顺序相同的顺序排列数据显示。