Graphical temporal graph pattern editor
An interactive display system enables a user to compose a graph pattern for a temporal graph on a display screen. The system comprises a canvas that provides an interactive editing surface. The editor receives an input a set of user interactions, such as the drawing of lines and boxes, the specifying of attributes, and the like, that together compose a graph pattern. During the graph pattern composition, the user may retrieve other graph patterns (e.g., from a data store) and integrate them into the pattern being composed. Once the graph pattern is composed (or as it is being composed), the system converts the graphical pattern into a text-based representation, such as a computer program in a particular graph programming language, which is then used for subsequent processing and matching in a cybersecurity threat discovery workflow. The pattern (program code) also is stored to disk, from which it may be retrieved and converted back into its graphical view on the screen, e.g., for further editing and revision.
1. A method for network threat analysis, comprising:
providing a display interface with a two-dimensional (2D) grid, wherein a first axis of the grid represents time, and a second axis of the grid represents space;
responsive to user inputs received on the display interface, the user inputs specifying one or more entities, one or more events associated with the one or more entities, and attributes associated to the entities and events, recording a graph pattern;
automatically processing the graph pattern into a text-based representation; and
performing a threat discovery operation using the text-based representation, wherein performing the threat discovery operation includes:
iteratively computing a closure over a set of subgraphs in the graph pattern; and
identifying a subgraph of the set that describes a security threat.
2. The method as described in claim 1 wherein the processing serializes the graph pattern into program code.
3. The method as described in claim 1 further including saving the text-based representation for reuse.
4. The method as described in claim 3 further including:
retrieving the text-based representation;
de-serializing the retrieved text-based representation to re-generate the graph pattern; and
providing the re-generated graph pattern for rendering on the display interface.
5. The method as described in claim 1 wherein a user input is one of: a straight line that represents an entity, a straight line with one or more interconnections that represent a set of events related to an entity, a box that represents a set of entities and events, a curved line that represents a multi-step connection among entities and events, and a label that represents an attribute or argument variable.
6. The method as described in claim 1 further including incorporating into the graph pattern one or more other graph patterns.
7. An apparatus, comprising:
a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions configured to perform network threat analysis, the computer program instructions comprising program code configured to:
provide a display interface with a two-dimensional (2D) grid, wherein a first axis of the grid represents time, and a second axis of the grid represents space;
responsive to one or more user inputs received on the display interface, the user inputs specifying one or more entities, one or more events associated with the one or more entities, and attributes associated to the entities and events, record a graph pattern;
automatically process the graph pattern into a text-based representation; and
perform a threat discovery operation using the text-based representation, wherein the program code configured to perform the threat discovery operation includes program code configured to:
iteratively compute a closure over a set of subgraphs in the graph pattern; and
identify a subgraph of the set that describes a security threat.
8. The apparatus as described in claim 7 wherein the program code to process the graph pattern further includes program code configured to serialize the graph pattern into program code.
9. The apparatus as described in claim 7 wherein the program code is further configured to save the text-based representation for reuse.
10. The apparatus as described in claim 9 wherein the program code is further configured to:
retrieve the text-based representation;
de-serialize the retrieved text-based representation to re-generate the graph pattern; and
provide the re-generated graph pattern for rendering on the display interface.
11. The apparatus as described in claim 7 wherein a user input is one of: a straight line that represents an entity, a straight line with one or more interconnections that represent a set of events related to an entity, a box that represents a set of entities and events, a curved line that represents a multi-step connection among entities and events, and a label that represents an attribute or argument variable.
12. The apparatus as described in claim 7 further including program code configured to incorporate into the graph pattern one or more other graph patterns.
13. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to perform network threat analysis, the computer program instructions comprising program code configured to:
provide a display interface with a two-dimensional (2D) grid, wherein a first axis of the grid represents time, and a second axis of the grid represents space;
responsive to one or more user inputs received on the display interface, the user inputs specifying one or more entities, one or more events associated with the one or more entities, and attributes associated to the entities and events, record a graph pattern; automatically process the graph pattern into a text-based representation; and
perform a threat discovery operation using the text-based representation, wherein the program code configured to perform the threat discovery operation includes program code configured to:
iteratively compute a closure over a set of subgraphs in the graph pattern; and
identify a subgraph of the set that describes a security threat.
14. The computer program product as described in claim 13 wherein the program code to process the graph pattern further includes program code configured to serialize the graph pattern into program code.
15. The computer program product as described in claim 13 wherein the program code is further configured to save the text-based representation for reuse.
16. The computer program product as described in claim 15 wherein the program code is further configured to:
retrieve the text-based representation;
de-serialize the retrieved text-based representation to re-generate the graph pattern; and
provide the re-generated graph pattern for rendering on the display interface.
17. The computer program product as described in claim 13 wherein a user input is one of: a straight line that represents an entity, a straight line with one or more interconnections that represent a set of events related to an entity, a box that represents a set of entities and events, a curved line that represents a multi-step connection among entities and events, and a label that represents an attribute or argument variable.
18. The computer program product as described in claim 13 further including program code configured to incorporate into the graph pattern one or more other graph patterns.