Relationship-based conversion of cyber threat data into a narrative-like format

1. A method, in a data processing system, for displaying cyber threat data in a narrative format, the method comprising:

receiving a cyber threat information file, wherein the cyber threat information file comprises cyber threat data in a serialized format;

generating a tree data structure representing relationships between objects in the cyber threat data, wherein each node of the tree data structure represents an object in the cyber threat data and each edge in the tree data structure represents a relationship type between a parent object and a child object;

generating a user interface presenting the cyber threat data in a narrative format based on the tree data structure, wherein generating the user interface comprises performing a depth-first search of relationships between objects in the tree data structure and extracting context information pertinent to the relationships between the objects, wherein the narrative format presents the objects in the cyber threat data in a hierarchical format indicative of the relationships between parent objects and child objects based on the tree data structure, presents a relationship type for each child object, and presents the extracted context information for each object in the cyber threat data; and

presenting the user interface to an analyst.

2. The method of claim 1 , wherein generating the tree data structure comprises identifying objects in the cyber threat data and mapping relationships between objects in the cyber threat data.

3. The method of claim 1 , wherein the extracted context information includes a risk score represented as a graphical indicator.

4. The method of claim 1 , wherein the parent object represents a process and the child object represents a file run by the process.

5. The method of claim 1 , wherein the parent object represents a first process and the child object represents a second process created by the first process.

6. The method of claim 1 , wherein the parent object represents a process and the child object represents a connection opened by the process.

7. The method of claim 1 , wherein the parent object represents a connection and the child object represents a source address or a destination address.

8. The method of claim 1 , wherein the parent object represents a process and the child object represents a user account that created the process.

9. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

receiving a cyber threat information file, wherein the cyber threat information file comprises cyber threat data in a serialized format;

generating a tree data structure representing relationships between objects in the cyber threat data, wherein each node of the tree data structure represents an object in the cyber threat data and each edge in the tree data structure represents a relationship type between a parent object and a child object;

generating a user interface presenting the cyber threat data in a narrative format based on the tree data structure, wherein generating the user interface comprises performing a depth-first search of relationships between objects in the tree data structure and extracting context information pertinent to the relationships between the objects, wherein the narrative format presents the objects in the cyber threat data in a hierarchical format indicative of the relationships between parent objects and child objects based on the tree data structure, presents a relationship type for each child object, and presents the extracted context information for each object in the cyber threat data; and

presenting the user interface to an analyst.

10. The computer program product of claim 9 , wherein generating the tree data structure comprises identifying objects in the cyber threat data and mapping relationships between objects in the cyber threat data.

11. The computer program product of claim 9 , wherein the extracted context information includes a risk score represented as a graphical indicator.

12. An apparatus comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to:

receiving a cyber threat information file, wherein the cyber threat information file comprises cyber threat data in a serialized format;

generating a tree data structure representing relationships between objects in the cyber threat data, wherein each node of the tree data structure represents an object in the cyber threat data and each edge in the tree data structure represents a relationship type between a parent object and a child object;

generating a user interface presenting the cyber threat data in a narrative format based on the tree data structure, wherein generating the user interface comprises performing a depth-first search of relationships between objects in the tree data structure and extracting context information pertinent to the relationships between the objects, wherein the narrative format presents the objects in the cyber threat data in a hierarchical format indicative of the relationships between parent objects and child objects based on the tree data structure, presents a relationship type for each child object, and presents the extracted context information for each object in the cyber threat data; and

presenting the user interface to an analyst.

13. The computer program product of claim 9 , wherein the parent object represents a process and the child object represents a file run by the process.

14. The computer program product of claim 9 , wherein the parent object represents a first process and the child object represents a second process created by the first process.

15. The computer program product of claim 9 , wherein the parent object represents a process and the child object represents a connection opened by the process.

16. The computer program product of claim 9 , wherein the parent object represents a connection and the child object represents a source address or a destination address.

17. The computer program product of claim 9 , wherein the parent object represents a process and the child object represents a user account that created the process.

18. The apparatus of claim 12 , wherein the extracted context information includes a risk score represented as a graphical indicator.

19. The apparatus of claim 12 , wherein generating the tree data structure comprises identifying objects in the cyber threat data and mapping relationships between objects in the cyber threat data.