Graphical representation of aggregated data

A method for enabling graphical representation of aggregated data is provided. The method includes accessing aggregated data retrieved from a plurality of on-line sources and receiving selection of a portion of the data through a graphical user interface. The method further includes identifying attributes associated with the portion of the data and generating a graphical representation of the portion of the data.

BACKGROUND

Software security is closely monitored to help prevent security problems. At any time, numerous viruses and/or malware attempt to attack known and unknown public and private vulnerabilities. Software security management is an essential part of elevating software reliability and quality.

To help organize software vulnerability information, many vendors provide an on-line bulletin board for posting related fixes and alerts. In addition to vendor specific security bulletin boards, other sites have been created, mostly by IT administrators, which enable software users to post vulnerabilities and/or fixes to vulnerabilities. In addition, some sites or mailing lists allow users to discuss software security related technologies.

One problem is that the information is not always accurate and/or latest. Furthermore, to find specific vulnerabilities and/or fixes, a user may need to perform an extensive search before finding the right content.

The various locations for software vulnerabilities and un-trusted information can lead to complications with user interaction with these sites.

SUMMARY

A method for enabling graphical representation of aggregated data is provided. The method includes accessing aggregated data retrieved from a plurality of on-line sources and receiving selection of a portion of the data through a graphical user interface. The method further includes identifying attributes associated with the portion of the data and generating a graphical representation of the portion of the data.

DETAILED DESCRIPTION

Reference will now be made in detail to embodiments of the present technology for enabling graphical representation of software security data, examples of which are illustrated in the accompanying drawings. While the technology for enabling graphical representation of software security data will be described in conjunction with various embodiments, it will be understood that they are not intended to limit the present technology for enabling graphical representation of software security data to these embodiments. On the contrary, the presented technology for enabling graphical representation of software security data is intended to cover alternatives, modifications and equivalents, which may be included within the spirit and scope the various embodiments as defined by the appended claims.

Furthermore, in the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the present technology for enabling graphical representation of software security data. However, the present technology for enabling graphical representation of software security data may be practiced without these specific details. In other instances, well known methods, procedures, components, and circuits have not been described in detail as not to unnecessarily obscure aspects of the present embodiments.

Unless specifically stated otherwise as apparent from the following discussions, it is appreciated that throughout the present detailed description, discussions utilizing terms such as “mapping”, “segmenting”, “routing”, interfacing”, “recognizing”, “representing”, “emulating”, “detecting”, “exposing”, “converting”, “authenticating”, “communicating”, sharing”, “receiving”, “performing”, “generating”, “displaying”, “enabling”, “aggregating”, “highlighting”, “presenting”, “configuring”, “identifying”, “reporting”, “ensuring”, “suppressing”, “disabling”, “ending”, “providing”, and “accessing” or the like, refer to the actions and processes of a computer system, or similar electronic computing device. The computer system or similar electronic computing device manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission, or display devices. The present technology for enabling graphical representation of software security data is also well suited to the use of other computer systems such as, for example, optical and mechanical computers.

Example Computer System Environment

With reference now toFIG. 1, portions of the technology for enabling graphical representation of software security data are composed of computer-readable and computer-executable instructions that reside, for example, in computer-usable media of a computer system. That is,FIG. 1illustrates one example of a type of computer that can be used to implement embodiments, which are discussed below, of the present technology for enabling graphical representation of software security data.

FIG. 1illustrates an exemplary computer system100used in accordance with embodiments of the present technology for enabling graphical representation of software security data. It is appreciated that system100ofFIG. 1is exemplary only and that the present technology for enabling graphical representation of software security data can operate on or within a number of different computer systems including general purpose networked computer systems, embedded computer systems, routers, switches, server devices, consumer devices, various intermediate devices/artifacts, stand alone computer systems, and the like. As shown inFIG. 1, computer system100ofFIG. 1is well adapted to having peripheral computer readable media102such as, for example, a floppy disk, a compact disc, and the like coupled thereto.

System100ofFIG. 1includes an address/data bus104for communicating information, and a processor106A coupled to bus104for processing information and instructions. As depicted inFIG. 1, system100is also well suited to a multi-processor environment in which a plurality of processors106A,106B, and106C are present. Conversely, system100is also well suited to having a single processor such as, for example, processor106A. Processors106A,106B, and106C may be any of various types of microprocessors. System100also includes data storage features such as a computer usable volatile memory108, e.g. random access memory (RAM), coupled to bus104for storing information and instructions for processors106A,106B, and106C.

System100also includes computer usable non-volatile memory110, e.g. read only memory (ROM), coupled to bus104for storing static information and instructions for processors106A,106B, and106C. Also present in system100is a data storage unit112(e.g., a magnetic or optical disk and disk drive) coupled to bus104for storing information and instructions. System100also includes an optional alphanumeric input device114including alphanumeric and function keys coupled to bus104for communicating information and command selections to processor106A or processors106A,106B, and106C. System100also includes an optional cursor control device116coupled to bus104for communicating user input information and command selections to processor106A or processors106A,106B, and106C. System100of the present embodiment also includes an optional display device118coupled to bus104for displaying information.

Referring still toFIG. 1, optional display device118ofFIG. 1may be a liquid crystal device, cathode ray tube, plasma display device or other display device suitable for creating graphic images and alphanumeric characters recognizable to a user.

System100may also include a graphical representation controller module245for enabling generation of graphical representations of portions of aggregated on-line security information from a plurality of sources.

Optional cursor control device116allows the computer user to dynamically signal the movement of a visible symbol (cursor) on display device118. Many implementations of cursor control device116are known in the art including a trackball, mouse, touch pad, joystick or special keys on alpha-numeric input device114capable of signaling movement of a given direction or manner of displacement. Alternatively, it will be appreciated that a cursor can be directed and/or activated via input from alpha-numeric input device114using special keys and key sequence commands.

System100is also well suited to having a cursor directed by other means such as, for example, voice commands. System100also includes an I/O device120for coupling system100with external entities. For example, in one embodiment, I/O device120is a modem for enabling wired or wireless communications between system100and an external network such as, but not limited to, the Internet.

Referring still toFIG. 1, various other components are depicted for system100. Specifically, when present, an operating system122, applications124, modules126, and data128are shown as typically residing in one or some combination of computer usable volatile memory108, e.g. random access memory (RAM), and data storage unit112. In one embodiment, the present technology for enabling graphical representation of software security data, for example, is stored as an application124or module126in memory locations within RAM108and memory areas within data storage unit112.

The computing system100is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the present technology. Neither should the computing environment100be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary computing system100.

Overview

The on-line information about software security and vulnerabilities, including message boards, mailing lists and web sites, is much valuable to security researchers, system administrators, software vendors, IT professionals, and anyone who is interested in software protection. The volume of such information and the endless sources for such information leads to challenges in accessing the right information easily.

It is appreciated that embodiments of the present technology are well suited for accessing and aggregating any type of information related to software. In one embodiment, the security information includes but is not limited to software vulnerabilities, advisories, discussions, documents, virus/worm related information, security event reporting and/or discussions, etc.

Embodiments of the present technology collect and organize software security data from numerous sources where it can then be analyzed. In other words, the information is aggregated from multiple sources into a single and user friendly place where it can be analyzed according to user specified metrics. The present technology enables access to on-line software security information in an efficient and easy to understand layout. Furthermore, an in-depth study can be performed to mine the data according to a specific user goal.

In one embodiment, the present technology provides a “snap-shot” of what is happening in the security community. For example, the “snap-shot” may show important developments and/or identified software risks, and the average number of message postings for the day, week, month, etc. related to a particular security topic. In one embodiment, the snap-shot data can be compared to historical data to identify trends.

In addition to the security snap-shot, in-depth analysis can be performed on the aggregated information. For example, if a user is interested in a particular security topic, they may want to view message postings related to the particular topic. Embodiments of the technology enable a user to have access to related security information in a single place wherein the data may be aggregated from multiple sources.

Users may also be interested in learning the vulnerabilities of a particular software product. Embodiments of the present technology enable a user to access information related to a particular piece of software at a single place that may be compiled and aggregated from multiple sources. This enables a quick and easy understanding of all security issues related to a product without having to visit multiple sources and perform multiple searches.

Embodiments of the present technology use real-time crawlers to access and retrieve the security data from multiple locations. The information is then compiled and aggregated into a single location where it can be manipulated and researched according to attributes identified from the data. The attributes may include but are not limited to product name, product version, date, security researcher, security site, manufacturer site, news articles, number of message positing, etc. In one embodiment, information is rated for accuracy and how helpful it is. A trust rating can be assigned to various pieces of data. This enables a user to quickly identify and distinguish good data from bad data.

Graphical presentation of the data is an important aspect of the present technology. For example, embodiments of the present technology use graphs, charts, color coding, numerical ratings, etc. for describing key elements in the security community and relationships between different key elements, including products, security researchers, security domain specific keywords, documents, messages, etc. It is appreciated that documents and messages can be the same thing in accordance with embodiments of the present technology.

Embodiments of the present technology focus on visualization of data on a flat table with multiple columns and rows. The overall concept is to enable visualization of portions of data in an easy to use fashion. Embodiments of the technology enable visualization and graphical representation of large scale and multi-dimensional data. In one embodiment, user interaction with the data generates customized graphical representations, based on the user selection of portions of data.

Embodiments of the present technology are described in the context of software security data. However, it is appreciated that embodiments of the present technology are also well suited to be used for aggregating and analyzing other types of data. The present technology is useful for aggregating and visualizing any type of large scale and multi-dimensional data in a way that enables a user to analyze the data through a graphical user interface. The embodiments described below are in the context of software security data for purposes of illustration and are not intended to limit the scope of the technology.

Architecture

FIG. 2is a block diagram of an exemplary network environment200where software security data is accessed from a plurality of locations and aggregated at a single location in accordance with embodiments of the present technology for enabling graphical representation of software security data. The software security data access enabler module245crawls sites202and204over network260for security data222. The security data from sites202and204is aggregated and stored in a single location260.

It is appreciated that the on-line security sites202and204may be web sites, data bases, message boards, or any other on-line source for software security information. The network260may be the Internet, however, it is appreciated that network260could be any network capable of communicatively coupling the on-line sources202and204to the software security data access enabler module245.

The software security data access enabler module245may be part of a computer system such as a web server. However, it is appreciated that the software security data access enabler module245could be part of any computer system capable of aggregating software security data from a plurality of sources.

FIG. 3is a block diagram of an exemplary software security access enabler module245in accordance with embodiments of the present technology for enabling graphical representation of software security data.

Data collector310collects the software security data from a plurality of locations. In one embodiment, data collector310includes or is coupled with a web crawler. The web crawler navigates the on-line sites for any new or changed data. The data is then aggregated by the software security data compiler320. It is appreciated that any number of methods and systems could be used to crawl the on-line sites for the software security data in accordance with the present technology for enabling access to aggregated on-line software security data.

An attribute identifier330identifies attributes from the data collected from the plurality of sites. The attribute identifier may enable organization of the data according to the identified attributes. For example, if a piece of data is identified as a message board posting, it may be stored along with other message board postings.

A relationship determiner340determines relationships between different pieces of data. For example, the relationship determiner340could identify two or more messages related to the same topic. In another embodiment, the relationship determiner340identifies two software products related to the same vulnerabilities and/or security issues. The relationship determiner340may also identify products with one or more keywords. In one embodiment, the keywords are retrieved from message postings associated with the product. In one embodiment, the relationship is quantified in the form of a rating. For example, the higher the rating, the more related the data is. In another embodiment, the rating is color coded. When data is highly related, a particular color is used. It is appreciated that the relationship determiner340can perform many different statistical calculations and complex mathematical calculations that can be used to determine relationships between two or more pieces of data.

In one embodiment, the relationship determiner generates a graphical representation that can be displayed on a graphical user interface. For example, the relationship determiner could generate a graph showing the number of related messages within the last week. In one embodiment, the relationship determiner may provide data to the UI generator399so that the UI generator399can generate the graphical representation that is provided to the graphical user interface.

A trend determiner350identifies trends in the compiled data. For example, the trend determiner may determine whether the number of posts related to a particular topic are increasing or decreasing over a predetermined period of time. The trend determiner350could also identify the trends associated with a particular product. For example, the trend identifier350could determine whether the number of vulnerabilities associated with a piece of software are increasing or decreasing. It is appreciated that the trend determiner350can perform many different statistical calculations and complex mathematical calculations that can be used to determine trends.

In one embodiment, the trend determiner350generates a graphical representation that can be displayed on a graphical user interface. For example, the trend determiner could generate a graph showing the number of messages within the last week that are related to a particular topic. In one embodiment, the relationship determiner may provide data to the UI generator399so that the UI generator399can generate the graphical representation that is provided to the graphical user interface.

A key word accessor360can be used to identify data that is associated with a keyword. In one embodiment, the key word accessor is a user interface that can be used to search data that includes the specified keyword. However, in another embodiment, the keyword accessor is “smart” and can determine words that are closely related to a keyword. In this embodiment, the keyword accessor retrieves data that is related to a particular keyword, even data that may not actually include the specified keyword. It is appreciated that the keyword accessor may communicate with other modules, such as the relationship determiner340to perform such operations. On another embodiment, a character recognizer387is used to determine relationships between data.

In one embodiment, an algorithm is used to extract keywords from documents and/or messages. In one embodiment, the algorithm is used to determine a topic or theme of the particular document or message. In one embodiment, the algorithm recognizes abbreviations, aliases, misspellings, etc. Extracting keywords and/or part of keywords may be preformed by or in conjunction with the character recognizer387.

For example, the character recognizer387may include a data base of words and related words. In one embodiment, the character recognizer recognizes a misspelled word because it recognizes a particular portion of the word. In addition to spelling errors, the character recognizer recognizes that different versions of a particular product are related to each other even though the names of the products may be different.

A data ranker355can be used to rank particular sets of data. For example, data can be ranked according to a trust level determined by trust determiner377. The ranker can also be used to rank how closely a set of data matches, for instance a specified key word. Exact matches would be ranked higher than ones identified by the character recognizer that may not be an exact match to the specified keyword.

The trust determiner377maintains a record of how trustworthy a particular piece of data is. For example, there are many sites that have user ratings. The user ratings can be used to determine a level of trust associated with a particular site. Information accessed from sites that have higher ratings is assigned higher trust ratings than information accessed from sites that are not as trusted.

It is appreciated that the ratings may not be site specific. It is appreciated that any number of metrics could be used to rate the data and determine a level of trust. For example, a person who posts information frequently on message boards may have a higher trust rating than a person making a first post.

Operation

FIG. 4is a block diagram of an exemplary graphical user interface in accordance with embodiments of the present technology for enabling access to aggregated on-line software security data. The software security data access enabler module245collects data from data sources499. The graphical user interface420can be used to present analysis of the aggregated software security data260. It is appreciated that the modules ofFIG. 4could be any graphical representation and/or analysis of the data accessed from a plurality of locations in accordance with embodiments of the present technology for enabling access to security data.

In one embodiment, the graphical user interface420includes a dashboard portion422, an in-depth study portion424, an info browsing portion426and a search portion428. In one embodiment, the user can select the modules to manipulate and study software security data visually.

These four portions provide different levels of information to the user. For example, the dashboard422provides an overview of what's going on in the security community. The in-depth study424allows users to drill down to a specific area of the security community, such as researching a specific software product. Info-browsing426allows a user to reference organized raw data, such as message postings. The search portion428enables a user to search any terms in the security domain and presents the search results in a well organized way.

The dashboard422can be used to present the snap-shot that was described above. The dashboard422is intended to provide a quick update as to what is going on in the on-line software security community. Specifics of the dashboard422are provided in conjunction with the description ofFIG. 6.

The in-depth study424can be used to perform statistical and mathematical operations on the data to analyze the data collected from various sources. The in-depth study424is intended to analysis of what is going on in the on-line software security community. Specifics of the in-depth study are provided in conjunction with the description ofFIG. 7.

The info browsing portion426enables a user to navigate the raw data collected from the various sites. For example, by selecting the info-browsing portion of the graphical user interface420, a user can browse messages according to data source, software product, security researcher, topic, keyword, etc.

The search portion428enables input of query terms. In one embodiment, related advisories, related posts, related security researchers and related posters are returned along with the query results of the search term. It is appreciated that any number of results could be returned in response to a specific search term in accordance with embodiments of the present technology for enabling access to aggregated on-line software security data.

FIG. 5is a block diagram of an exemplary dashboard422in accordance with embodiments of the present technology for enabling access to aggregated on-line software security information. In one embodiment, the portions of dashboard422can be customized according to what is important to the user. It is appreciated that the portions of the dashboard422could be graphical representations and/or analysis of the data aggregated from a plurality of sources in accordance with the present technology for enabling access to security data.

As stated previously, the dashboard is intended to provide overview information quickly. It provides a snap shot of what is happening in the on-line software security community. For example, the dashboard may include a snap shot of what has happened in the past week502. The past week502may include, for example, the top five topics from the past week. The past week502could also include the most relevant or important message postings from the past week. The past week portion502may include any number of graphs or other graphical representations of data so that the user can easily understand and comprehend vast amounts of data associated with what has happened in the past week quickly and easily.

Accordingly, the dashboard also includes a portion that indicates important data from the past month504. It provides a more in-depth study of what has been going on in the past month compared to the snap shot described above. The past month504may include, for example, the top five topics from the past month. The past month504could also include the most relevant or important message postings from the past month. The past month504may also include a daily trend of security messages posted. The past month portion504may include any number of graphs or other graphical representations of data so that the user can easily understand and comprehend vast amounts of data associated with what has happened in the past month quickly and easily.

The dashboard may also include a long-term trend portion506. The long-term trend portion can be used to analyze data that is older than one month. The long-term trend portion508enables a user to see trends in the on-line security environment that may not show up in the past week portion502or the past month portion504. In one embodiment, the past week502data, past month504data, daily trends data can be compared to the long-term data.

In one embodiment, included with the past week info502, past month info504or long-term info508is a daily trend portion for identifying what is going on in the on-line software community that day. The daily trend may show data such as the number of postings for the day, the top topics of the day, the number of persons visiting security sites, etc. The daily trend portion may include any number of graphs or other graphical representations of data so that the user can easily understand and comprehend vast amounts of data associated with what has happened in a day quickly and easily.

FIG. 6is a block diagram of an exemplary in-depth study424in accordance with embodiments of the present technology for enabling access to aggregated on-line software security information. The in-depth study424can be used to perform statistical operations on the data according to particular attributes of the data which enables a user to drill down to specific detail information associated with specific software products or security researchers or security domain-specific key words. It also enables a user to navigate among relationship graphs of key elements of the security community. It is appreciated that the portions of the in-depth study424could be graphical representations of the data and/or analysis of the data aggregated from a plurality of sources in accordance with the present technology for enabling access to security data.

For example, the in-depth study portion enables temporal analysis602of the data aggregated from a plurality of sources. The temporal analysis602enables a user to see the overall trend of the number of messages associated with a particular topic, keyword, researcher, product, etc. It also enables a user to navigate among relationship graphs of key elements of the security community. It is appreciated that the temporal analysis can be used to perform statistical and mathematical operations on any number of data attributes. The analysis can be used to generate a graphical representation of the temporal analysis results in a clear and easy to understand format.

The in-depth study also includes a security visualizer604. The security visualizer604enables a user to gain an overall understanding of all related issues of a product easily and quickly. The security visualizer604enables a user to drill down through the aggregated data to see all advisories, postings, related messages, etc. associated with specific search terms and/or attributes.

The in-depth study also includes a security relationship visualizer606. The security relationship visualizer606enables a user to gain an overall understanding of all security relationships of key security elements (such as a product, a researcher, a domain-specific keyword) easily and quickly and be able to navigate from one element to another related security element and view all relationships of the new selected element. The security relationship visualizer606enables a user to drill down through the aggregated data to see all advisories, postings, related messages, etc. associated with keywords and documents. The security relationship visualizer606can generate graphical representations of the security relationships.

Similar to the security relationship visualizer, the in-depth study424also includes a trust visualizer608. The trust visualizer608enables a user to see a trust rating associated with particular security data. The trust level could be conveyed, for example, with a numerical or color coded rating. It is appreciated that the trust information could be incorporated into one of the other portions described above.

User Interface for Analyzing portions of Software Security Data

FIG. 7is an illustration of an exemplary graphical representation700of a portion of software security data aggregated from a plurality of locations in accordance with embodiments of the present technology for enabling graphical representation of software security data.

Embodiments of the present technology provide an interactive graphical representation of data that can be used to analyze portions of data and drill down to details associated with a specific range of data.

Graphical representation700includes a first chart portion720that shows visually the trend of message counts associated with a particular software security security for a specific period of time. The example, inFIG. 7Ashows message count data from the year 2000 to the year 2006.

Range controllers730and740enable a user to select a specific time period within the time period described by chart720. For example, the range controllers730and740can be used to analyze a portion of data from chart720. In the example shown, the selected time period is from Apr. 13, 2005 to Dec. 23, 2005 which is 254 days in length.

A second chart750is generated in response to the range selection described above. The second chart750shows a detailed message count for the range selected from chart720. The second chart750is more detailed for the selected range than the first chart720. The second chart shows message count trends for a smaller time period while the first chart720shows a more historical trend over a larger time period.

In addition to the second chart750, column layouts710,711,712and713are generated in response to the selected range of chart720. For example, column data710describes the top keywords that are associated with the software security messages for the selected range. Column data710includes a count of how many times the key word occurs in the specified range.

Column data713shows the top researchers associated with the messages for the specified range. In addition to the name entries in the column data713, a count is provided adjacent to the researcher name that describes the number of times the name of each researcher occurs in the specified range. The count could also be the number of messages posted from each researcher within the specified range.

Column data712shows the top message posters associated with the messages for the specified range. In addition to the name entries in the column data712, a count is provided adjacent to the poster's name that describes the number of times the name of each poster occurs in the specified range. The count could also be the number of messages posted from each poster within the specified range.

Column data711shows the top websites associated with the messages for the specified range. In addition to the site name entries in the column data711, a count is provided adjacent to the site name that describes the number of times the name of each site occurs in the specified range. The count could also be the number of messages accessed from each site.

In one embodiment, the graphical representation700can be any kind of chart with a range controller to enable a user to select a data range they are interested in. In one embodiment, a vertical diagram is presented that shows the selected range on one side and corresponding data adjacent to the selected range. The chart could also be a pie shaped chart. In one embodiment, selecting data with the range selector enables a user to access related data to the specified range. In one embodiment, the chart controller includes color coding for non-numerical data overview.

Enabling Access to Aggregated On-Line Software Security Information

FIG. 8is a data flow diagram of an exemplary method800for enabling graphical representation of software security data in accordance with embodiments of the present technology for enabling graphical representation of software security data.

At802,800includes accessing aggregated data associated with software vulnerabilities retrieved from a plurality of on-line sources. In one embodiment, a crawler performs real-time data acquisitions from a plurality of on-line sites. Embodiments of the present technology aggregate data from a plurality of sources and enable access to the data at a single location where a user can quickly and easily examine the data and perform analysis of the data. In one embodiment, the aggregated is presented in a graphical fashion to the user through a graphical user interface.

At804,800includes receiving a selection of a portion of the data through a graphical user interface. In one embodiment, a graphical range controller enables a user to select a portion of data to perform a more in-depth analysis on. In one embodiment, the range of data is time based. For example, the range is between a first date and a second date.

At806,800includes identifying attributes associated with the data. In one embodiment, the attribute identification includes a full text search of the data. For example, a keyword query search can be performed to identify data that includes the keyword or other words that are related to the keyword. It is appreciated that any number of attributes could be identified from the aggregated data. In one embodiment, the attributes are identified and quantified for a particular range of data.

At808,800includes generating a graphical representation of the portion of data. In one embodiment, the graphical representation shows trends associated with various attributes of the portion of data. As stated above, numerous operations can be performed on the data including generating a snapshot, performing a search, performing temporal analysis, etc.