Methods and systems for cyber-monitoring and visually depicting cyber-activities

A method for cyber-monitoring and visually depicting cyber-activities, said method comprising:

• a) tracking cyber-activities derived from event stream(s);
• b) extracting, building or extracting and building one or more entities and one or more entity-relations from said tracked cyber-activities, wherein each of said entity is a representative component of a particular cyber-activity;
• c) characterizing the entities from step b) as normally-occurring, unknown or anomalous;
• d) excluding entities which are normally-occurring from further review;
• and
• e) reviewing any unknown or anomalous entity(ies) by:
• (i) displaying on a panel of a graphical user interface (GUI) a set of relational stack representations where each stack represents a different level of granularity;
• each stack comprising cells in a chronological order, where each cell represents an entity from the one or more entities not excluded in step d);
• and wherein each cell comprises information regarding the entity the cell represents that can be visualized in response to user input;
• (ii) selecting an entity from step e)(1) to visualize across levels of granularity;
• (iii) displaying, automatically or in response to a user action, links between the selected entity in neighboring stacks to provide a pathway following the selected entity across levels of granularity and thereby produce a pattern of relations for said selected entity across said levels of granularity;
• and
• (iv) characterizing said selected entity as normal or anomalous based on said pattern of relations.