# US 2019/0173893 A1 · Method and system for generating an entities view with risk-level scoring for performing computer security monitoring

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173893 A1
- Document ID: US20190173893A1
- Status: Published application
- Kind: A1
- Application number: 16/264,514
- Filed: 2019-01-31
- Published: 2019-06-06
- Earliest claimed: 2015-08-31
- Assignees: Splunk Inc.
- Applicants: Splunk Inc.
- Inventors: Sudhakar Muddu; Christos Tryfonas
- Web page: https://patentgrep.com/patent/US20190173893A1

## CPC

- G06N 20/20: Ensemble learning
- G06F 3/0482: Interaction with lists of selectable items, e.g. menus
- G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
- G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence)
- G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
- G06F 16/24578: {using ranking}
- G06F 16/254: {Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses}
- G06F 16/285: {Clustering or classification}
- G06F 16/444: {Spatial browsing, e.g. 2D maps, 3D or virtual spaces}
- G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)}
- G06F 40/134: Hyperlinking
- G06N 5/022: Knowledge engineering; Knowledge acquisition
- G06N 5/04: Inference or reasoning models
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N 20/00: Machine learning
- G06V 10/225: {based on a marking or identifier characterising the area}
- H04L 41/0893: Assignment of logical groups to network elements
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 43/00: Arrangements for monitoring or testing data switching networks
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 43/062: related to network traffic
- H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 2463/121: Timestamp
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

## Claims

### Claim at position 1

1-30. (canceled)

### Claim 31

A computerized method comprising:
receiving event data associated with network activities entities that interact with a computer network;
identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and anomalies, the identified instances are associated with entities that participated in the network activities from which the instances were determined, and each threat is an automated determination based on one or more of the anomalies;
automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and/or type of identified instances of potential network compromise associated with the entity; and
causing display, in a graphical user interface, of an indication of a determined score, wherein:
the graphical user interface selectively provides a view identifying entities that participated in network activities that triggered determinations of potential network compromise, and
each entity listed in the view includes the associated score.

### Claim 32 (depends on 31)

The method of claim 31, wherein each entity listed in the view further includes a link which, upon selection by a user, causes the graphical user interface to generate a second view comprising additional data about the selected entity.

### Claim 33 (depends on 31)

The method of claim 31, wherein the view additionally lists, for each entity, the number of anomalies associated with the entity.

### Claim 34 (depends on 31)

The method of claim 31, wherein the view additionally lists, for each entity, the number of threats and anomalies associated with the entity.

### Claim 35 (depends on 31)

The method of claim 31, wherein the graphical user interface provides a prompt for filtering the view according to score, and
upon selection by a user of a score via the graphical user interface, filtering the view to include only the entities associated with scores corresponding to the user's selection.

### Claim 36 (depends on 31)

The method of claim 31, wherein the view comprises a listing of users in a computer network of an organization including the department in which the user is assigned in the organization.

### Claim 37 (depends on 31)

The method of claim 31, wherein the view comprises a listing of network users in a computer network of an organization and further includes, for each network user, the date of the most recent automated determination regarding the network user's involvement in a potential instance of network compromise.

### Claim 38 (depends on 31)

The method of claim 31, wherein the view comprises a listing of devices communicating on the network and associated with an instance of network compromise,
and further wherein the listing includes, for each device, the date of the most recent automated determination regarding the device's involvement in a potential instance of network compromise.

### Claim 39 (depends on 31)

The method of claim 31, wherein the view further includes, for each entity, the date of the most recent update regarding the entity's participation in a potential instance of network compromise, and
wherein the graphical user interface provides a prompt for filtering the view according to date, and
upon selection by a user of a temporal range via the graphical user interface, filtering the view to include only the entities associated with a date of most recent update falling within the selected temporal range.

### Claim 40 (depends on 31)

The method of claim 31, wherein the view comprises a listing of applications that have run on the network and are associated with an instance of network compromise, and, upon selection of an entry in the listing, providing a second view illustrating the relationship between the application and the at least one identified instance of potential network compromise associated with the application.

### Claim 41 (depends on 31)

The method of claim 31, further comprising:
upon selection by a user of an entity in the listing via the graphical user interface, generating a view of the entity providing additional information, including a trends graph illustrating any changes in the score associated with the entity over a period of time.

### Claim 42 (depends on 31)

The method of claim 31, further comprising:
upon selection by a user of an entity in the listing via the graphical user interface, generating a view of the entity providing additional information, including an illustration of the relationship between the entity and the associated at least one instance of potential network compromise.

### Claim 45 (depends on 31)

The method of claim 31, further comprising:
upon selection by a user of an entity in the listing via the graphical user interface, generating a view of the entity providing additional information including, if relevant event data is available, an illustration of how recent network activities associated with the entity has varied from a baseline of activity.

### Claim 46 (depends on 31)

The method of claim 31, further comprising:
upon selection by a user of an entity in the listing via the graphical user interface, generating a view of the entity including a prompt for a user to tag the selected entity for future tracking; and
upon receiving a selection by a user of a tag, associating the tag with the selected entity such that the tag is included in the additional data provided in response to subsequent requests to generate the view of the selected entity.

### Claim 47 (depends on 31)

The method of claim 31, further comprising:
upon selection by a user of an entity in the listing via the graphical user interface, generating a view of the entity including additional information concerning the entity; and
upon receiving a selection by a user, via the graphical user interface, of a link in the detailed view, generating a view listing instances of potential network compromise that are associated with the entity.

### Claim 48 (depends on 31)

The method of claim 31, wherein, upon selection by a user of an entity in the listing via the graphical user interface, generating a view of the entity including additional information concerning the entity, and
upon receiving a selection by a user, via the graphical user interface, of a link in the view of the entity, generating a view listing instances of potential network compromise that are associated with the entity,
wherein each listed instance includes a link to a view of that instance.

### Claim 49

A non-transitory, computer-readable storage medium storing instructions, an execution of which in a computer system causes the computer system to perform operations comprising:
A computerized method comprising:
receiving event data associated with network activities entities that interact with a computer network;
identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and anomalies, the identified instances are associated with entities that participated in the network activities from which the instances were determined, and each threat is an automated determination based on one or more of the anomalies;
automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and/or type of identified instances of potential network compromise associated with the entity; and
causing display, in a graphical user interface, of an indication of a determined score, wherein:
the graphical user interface selectively provides a view identifying entities that participated in network activities that triggered determinations of potential network compromise, and
each entity listed in the view includes the associated score.

### Claim 50 (depends on 49)

The computer-readable storage medium of claim 49, wherein each entity listed in the view includes the associated score and a link which, upon selection by a user, causes the graphical user interface to generate a view comprising additional data about the selected entity.

### Claim 51 (depends on 49)

The computer-readable storage medium of claim 49, wherein the view lists, for each entity, the number of anomalies associated with the entity.

### Claim 52 (depends on 49)

The computer-readable storage medium of claim 49, wherein the view lists, for each entity, the number of threats and anomalies associated with the entity.

### Claim 53 (depends on 49)

The computer-readable storage medium of claim 49, wherein the graphical user interface provides a prompt for filtering the view according to score, and
upon selection by a user of a score via the graphical user interface, filtering the view to include only the entities associated with scores corresponding to the user's selection.

### Claim 54 (depends on 49)

The computer-readable storage medium of claim 49, wherein the view comprises a listing of users in a computer network of an organization including, if known, the department in which the user is assigned in the organization.

### Claim 55 (depends on 49)

The computer-readable storage medium of claim 49, wherein the view comprises a listing of network users in a computer network of an organization,
and further includes, for each network user, the date of the most recent automated determination regarding the network user's participation in a potential instance of network compromise.

### Claim 56

A computer system comprising:
computer memory for storing machine data; and
a processor for:
receiving event data associated with network activities entities that interact with a computer network;
identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and anomalies, the identified instances are associated with entities that participated in the network activities from which the instances were determined, and each threat is an automated determination based on one or more of the anomalies;
automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and/or type of identified instances of potential network compromise associated with the entity; and
causing display, in a graphical user interface, of an indication of a determined score, wherein:
the graphical user interface selectively provides a view identifying entities that participated in network activities that triggered determinations of potential network compromise, and
each entity listed in the view includes the associated score.

### Claim 57 (depends on 56)

The computer system of claim 56, wherein each entity listed in the view further includes a link which, upon selection by a user, causes the graphical user interface to generate a detailed view comprising additional data about the selected entity.

### Claim 58 (depends on 56)

The computer system of claim 56, wherein the view lists, for each entity, the number of anomalies associated with the entity.