# US 2019/0379684 A1 · Systems and methods to show detailed structure in a security events graph

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0379684 A1
- Document ID: US20190379684A1
- Status: Published application
- Kind: A1
- Application number: 16/361,039
- Filed: 2019-03-21
- Published: 2019-12-12
- Earliest claimed: 2018-06-12
- Assignees: Netskope, Inc.
- Applicants: Netskope, Inc.
- Inventors: Nigel Derek Brown; Raymond Joseph Canzanese, JR.
- Web page: https://patentgrep.com/patent/US20190379684A1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The technology disclosed includes a system to reduce clutter during graph presentation for security incident analysis. The system includes logic to score nodes potentially collapsed by equivalence, of indicated interest for security incident analysis, to prevent aggregation. The system includes logic to aggregate and hide equivalent nodes that have matching degrees, that are connected to matching nodes by matching edge types, and that have scores below a first selected threshold. The system does not collapse nodes that are interesting for security analysis and keeps them visible. The technology disclosed identifies chains of at least three nodes having degrees of 1 or 2, without branching from any node in the chain. The identified chains are collapsed into chain-collapsed single nodes. Two different cases of chains including whisker chains ending in a leaf node and chains connected at both ends to two other nodes are presented.

## Claims

### Claim 1

A method of clutter reduction during graph presentation for security incident analysis of a computer network, including:
scoring nodes potentially collapsed by equivalence, of indicated interest for security incident analysis, to prevent aggregation; and
aggregating and hiding equivalent nodes that have matching degrees, that are connected to matching nodes by matching edge types, and that have scores below a first selected threshold, while leaving interesting nodes having scores above the first selected threshold visible.

### Claim 2 (depends on 1)

The method of claim 1, wherein the nodes in the graph of the computer network represent network resources in the computer network.

### Claim 3 (depends on 1)

The method of claim 1, further including scoring for a particular node by increasing the score for the particular node when the particular node is connected to an edge representing a security incident alert.

### Claim 4 (depends on 1)

The method of claim 1, further including, during a threat hunting alert analysis, scoring a particular node by increasing the score for the particular node when the node represents a user entity type, wherein the threat hunting analysis includes displaying nodes, representing users in a computer network, to a security analyst as potential threats.

### Claim 5 (depends on 1)

The method of claim 1, further including, during malware response alert analysis, scoring a particular node by increasing the score for the particular node when the node represents a server entity type.

### Claim 6 (depends on 4)

The method of claim 4, further including:
responsive to receiving a node pinning message for a node corresponding to a particular user in a computer network for whom the threat hunting alert was generated; and
increasing the score for the pinned node representing the particular user above the first selected threshold.

### Claim 7 (depends on 5)

The method of claim 5, further including:
responsive to receiving a node pinning message for a node corresponding to a particular server in a computer network for which the malware response alert was generated; and
increasing the score for the pinned node representing the particular server above the first selected threshold.

### Claim 8

A method of clutter reduction during graph presentation for security incident analysis, including:
identifying chains of at least three nodes having degrees of 1 or 2, without branching from any node in the chain; and
collapsing the identified chains into chain-collapsed single nodes.

### Claim 9 (depends on 8)

The method of claim 8, wherein at least one of the chains is a whisker chain having at least three nodes and ending in a leaf node of degree 1.

### Claim 10 (depends on 8)

The method of claim 8, further including:
scoring a plurality of the chain-collapsed nodes for further equivalence collapsing, of interest for security incident analysis, to prevent aggregation;
aggregating and hiding chain-collapsed nodes that are connected to matching nodes by matching edge types, and that have scores below a second selected threshold, while leaving interesting chain-collapsed nodes having scores above the second selected threshold visible.

### Claim 11 (depends on 10)

The method of claim 10, further including scoring a particular chain-collapsed node by increasing the score of the particular chain-collapsed node when a chain length of the particular chain-collapsed node does not match chain length of chain-collapsed nodes connected to the matching nodes, wherein the chain lengths of chain-collapsed nodes indicate number of nodes in respective chains.

### Claim 12

A non-transitory computer readable storage medium impressed with computer program instructions to reduce clutter during graph presentation for security incident analysis of a computer network, the instructions, when executed on a processor, implement a method comprising:
scoring nodes potentially collapsed by equivalence, of indicated interest for security incident analysis, to prevent aggregation;
aggregating and hiding equivalent nodes that have matching degrees, that are connected to matching nodes by matching edge types, and that have scores below a first selected threshold, while leaving interesting nodes having scores above the first selected threshold visible.

### Claim 13 (depends on 12)

The non-transitory computer readable storage medium of claim 12, implementing the method further comprising:
during a threat hunting alert analysis, scoring a particular node by increasing the score for the particular node when the node represents a user entity type, wherein the threat hunting analysis includes displaying nodes, representing users in a computer network, to a security analyst as potential threats.

### Claim 14 (depends on 12)

The non-transitory computer readable storage medium of claim 12, implementing the method further comprising:
during malware response alert analysis, scoring a particular node by increasing the score for the particular node when the node represents a server entity type.

### Claim 15 (depends on 13)

The non-transitory computer readable storage medium of claim 13, implementing the method further comprising:
responsive to receiving a node pinning message for a node corresponding to a particular user in a computer network for whom the threat hunting alert was generated; and
increasing the score for the pinned node representing the particular user above the first selected threshold.

### Claim 16 (depends on 12)

A system including one or more processors coupled to memory, the memory loaded with computer instructions from the non-transitory computer readable storage medium of claim 12.

### Claim 17 (depends on 16)

The system of claim 16, wherein the nodes in the graph of the computer network represent network resources in the computer network.

### Claim 18 (depends on 16)

The system of claim 16, further implementing the method comprising:
scoring for a particular node by increasing the score for the particular node when the particular node is connected to an edge representing a security incident alert.

### Claim 19 (depends on 16)

The system of claim 16, further implementing the method comprising:
during a threat hunting alert analysis, scoring a particular node by increasing the score for the particular node when the node represents a user entity type, wherein the threat hunting analysis includes displaying nodes, representing users in a computer network, to a security analyst as potential threats.

### Claim 20 (depends on 16)

The system of claim 16, further implementing the method comprising:
during malware response alert analysis, scoring a particular node by increasing the score for the particular node when the node represents a server entity type.