Abstract:
A method and system is provided for visualizing and navigating cybersecurity information. A hypertree is displayed on a display device of a computerized system. The hypertree includes a plurality of nodes linked by edges, one or more of the nodes representing cybersecurity incidents, and one or more of the nodes representing elements or artifacts of cybersecurity incidents, the edges representing a specific relationship between the nodes linked by the edges. The computerized system displays an interactive navigation aid to enable a user to navigate the hypertree, and receives a navigation command from the user through the interactive navigation aid. The computerized system modifies the displayed hyerptree in response to the navigation command. The navigation command comprises selective elimination or restoration of edges or nodes on the hypertree so as to enable the user to readily visualize interrelationships between the displayed nodes that are significant to a cybersecurity investigation or response.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This patent application claims the benefit of U.S. provisional patent application Ser. No. 62/033,543, filed Aug. 5, 2014, which is hereby incorporated herein by reference. 
     
    
     TECHNICAL FIELD 
       [0002]    The field of this invention generally relates to automated cybersecurity visualization and correlation, and more particularly to a correlation finder that retrieves, displays, and enables navigation of cybersecurity incidents and incident elements that match details of an incident under investigation, and to an artifacts correlator that enables display and navigation of incident element artifacts that have points of correlation with other incident element artifacts. 
       BACKGROUND 
       [0003]    The present invention may be implemented as a module to be added to an existing incident management system. For example, one such incident management system, to which the embodiments described herein may be added, is the DF Labs IncMan Suite, which is an incident management system that enables management of many kinds of information security incidents. This Suite is described in the IncMan Suite v. 2.2.3 User Manual, published by DF Labs, which manual is hereby incorporated herein by reference in its entirety. 
         [0004]    The IncMan Suite supports the entire incident management process for every type of incident, including cybersecurity incidents, by supporting digital forensics, case management, and incident response. Although the modules of the IncMan Suite are designed to ensure maximum integration, customers can choose to use only the modules that most appropriately cover their needs. 
         [0005]    The forensics and response section of the IncMan Suite is composed of two modules: the incident manager and the digital investigation manager. 
         [0006]    The incident manager module (“IMAN”) of the IncMan Suite manages and tracks security incidents during incident response operations, and manages information related to response to an incident. This tool covers all aspects of incident assessment, either simple or complex. The incident manager module provides help for tracking of incidents coming from external sources, including security alerts in syslog format, for creating a case related to the incident, for managing all information and data related to the case, including task assignments, and for generating incident reports compliant with rigorous security standards. (The “case” is a sort of virtual container of an incident that allows the user to assemble, organize, and catalog elements that are part of digital forensic operations or incident response.) The incident manager allows the insertion of dozens of different items of information related to an incident, organized according to theme areas: hosts involved in the incident; methods used to perpetrate the attack; identification of the assets involved and the respective economic impacts; attachments such as log files, reports produced by the security software, and other information; actions taken or to be taken for the resolution or containment of the incident; and the point of contact for coordination of operations. 
         [0007]    The digital investigation manager module (“DIM”) of the IncMan Suite manages digital evidence, and is designed to be used for managing information gathered during a forensics operation. The digital investigation manager supports investigators in performing case management, preparing notes, tracking evidence and records, creating clones of evidence with automatic upload of acquisition data, snapshots, and bookmarks, and generating chain of custody reports. This module can import data from all of the common computer forensic tools. The digital investigation manager module is designed to be used in information technology and investigative environments during incident response and forensic acquisition. This module enables the user to catalog all of the relevant information gathered and to generate reports. The digital investigation manager allows operations to be organized by case. Each case may contain an unlimited number of hosts (workstations, servers, laptops, etc.). Items of evidence are associated with each host (hard disk, optical disk, etc.). The digital investigation manager module makes it possible to describe the destination media and tools used in making forensic copies of the original stored media, as well as the log files generated by common computer forensic tools. One example of a digital investigation manager, which may be a module of existing incident management systems to which the embodiments described herein may be added, is described in Forte, U.S. patent application Ser. No. 11/784,794, filed Apr. 10, 2007, and published as US Patent Publication 2008/0098219, which is hereby incorporated herein by reference in its entirety. 
         [0008]    The “ITILity” module of the IncMan Suite is built on the Information Technology Infrastructure Library (ITIL) framework, which is a set of best practices for the management of operations and IT incidents. This troubleshooting and help desk module is available for companies that need also to manage the IT incident under the ITIL standard. 
         [0009]    The compliance and risk manager module (CoRM) of the IncMan suite is a module to enforce, track, document, and support compliance with IT regulations to gain law conformity and maintain a secure and productive business. With the compliance and risk manager module it is possible to upload all relevant compliance documents, create hierarchies of controls built on the compliance documents, assign controls to the various assets in an organization, create assessments on the various controls and assets, assign these assessments to the relevant responsible persons in the organization, and track their answers. The compliance and risk manager module provides a centralized repository for tracking compliance levels and managing risks related to an organization&#39;s assets. 
       SUMMARY 
       [0010]    It is an object of the invention to provide a correlation finder and an artifacts correlator that can be added as at least one module to an incident management system such as the IncMan Suite. 
         [0011]    The invention features a method and apparatus for visualizing and navigating cybersecurity information. A hypertree is displayed on a display device of a computerized system. The hypertree includes a plurality of nodes linked by edges. One or more of the nodes represent cybersecurity incidents. One or more of the nodes represent elements or artifacts of cybersecurity incidents. The edges represent a specific relationship between the nodes linked by the edges. An interactive navigation aid is displayed, through the computerized system, to enable a user to navigate the hypertree. A navigation command is received at the computerized system from the user through the interactive navigation aid. The computerized system modifies the displayed hyerptree in response to the navigation command. The navigation command includes selective elimination or restoration of edges or nodes on the hypertree so as to enable the user to readily visualize interrelationships between the displayed nodes that are significant to a cybersecurity investigation or response. 
         [0012]    The visualization capabilities provided by the navigation commands according to the invention guarantee flexibility to the user during incident response operations and allow better granularity during an incident response investigation, reducing possible false positives and enabling the user quickly and efficiently to focus the scope of the potential common incident elements or artifacts, due to the ability to selectively eliminate or restore edges or nodes. These advantages are especially important in cybersecurity investigations because time is often of critical importance in cybersecurity investigations, with reduced investigation time leading to reduced response time. 
         [0013]    In certain embodiments of the invention one or more of the nodes represent elements of cybersecurity incidents including evidence, hosts, forensic images, and e-discovery objects. In other embodiments one or more the nodes represent artifacts of cybersecurity incidents. 
         [0014]    In some embodiments of the invention the computerized system enables the user to select an alikeness ratio defining a minimum alikeness that the nodes representing artifacts must have with respect to other nodes in the hypertree, and the computerized system, in response to the user selecting an alikeness ratio, re-plots the hyerptree to include nodes representing artifacts that are connected with other nodes by edges that exceed the alikeness ratio selected by the user. This particular capability can dramatically reduce the time required for an incident investigation and, consequentially, can dramatically reduce reaction time. 
         [0015]    The computerized system may enable the user to navigate the hypertree by selecting a node of the hypertree as a selected node. The interactive navigation aid may include a mechanism to enable the user to eliminate or restore the selected node in the displayed hypertree. 
         [0016]    In certain embodiments of the invention the computerized system modifies the displayed hypertree in response to the user selecting a node of the hypertree as the selected node, at least by re-centering the displayed hypertree around the selected node. The automatic re-centering of the hypertree gives the user a more organic view of incidents and artifacts and makes it possible for the user to focus only on the incident elements and artifacts that are truly relevant to a cyber-incident operation. 
         [0017]    The interactive navigation aid may list active connections between a selected node of the hypertree and other nodes of the hypertree, together with options for the user to eliminate or restore edges representing the active connections listed in the navigation aid or nodes linked by the active connections. The interactive navigation aid may include a table of nodes having active connections with the selected node. 
         [0018]    The interactive navigation aid may also include a mechanism to enable the user to eliminate or restore all edges connected to the selected node in the displayed hypertree. By performing this action, users are able to save critical time during their investigation and to perform more automated and focused response actions. The possibility of performing a “restore” can also allow users to repeat any investigative actions, anytime, in order to simulate alternative correlations. 
         [0019]    In certain embodiments of the invention the hypertree displays links differentiated by color and the interactive navigation aid enables the user to selectively eliminate or restore edges by color. This differentiation technique helps the user in better refining the scope of the current investigation and automatically finding eventual points in common with other incidents and artifacts included in a given knowledge base. 
         [0020]    In certain embodiments, the computerized system enables the user to enable or disable nodes in the hypertree representing cybersecurity incidents other than a cybersecurity incident being investigated by the user. In response to instruction from the user to enable or disable the nodes representing the other cybersecurity incidents, the computerized system re-plots the displayed hypertree. 
         [0021]    The interactive navigation aid may list active connections between a selected node of the hypertree and other nodes of the hypertree and may include a mechanism to enable the user to view details of any node listed in the interactive navigation aid. 
         [0022]    The computerized system may enable the user to zoom onto a portion of the displayed hyerptree. Using the zoom in the hypertree can help the user in identifying single artifacts, responsible for a particular type of intrusion or attack, and perform further chained correlation. 
         [0023]    The details of various embodiments of the invention are set forth in the accompanying drawings and the description below. Numerous other features and advantages of the invention will be apparent from the description, the drawings, and the claims. 
     
    
     
       DESCRIPTION OF THE DRAWINGS 
         [0024]      FIG. 1  is a schematic diagram of the hardware forming an exemplary embodiment of a computer system that operates in accordance with the present invention. 
           [0025]      FIGS. 2A and 2B  are a flowchart diagram of steps that a user of the correlation finder according to the invention might perform in interacting with the interface provided by the correlation finder 
           [0026]      FIGS. 3-24  are screen displays corresponding to the steps of the flowchart of  FIG. 2 . 
           [0027]      FIGS. 25A and 25B  are a flowchart diagram of steps that a user of the artifact correlator according to the invention might perform in interacting with the interface provided by the artifact correlator. 
           [0028]      FIGS. 26-47  are screen displays corresponding to the steps of the flowchart of  FIG. 2 . 
       
    
    
     DETAILED DESCRIPTION 
       [0029]    The present invention provides a correlation module that may be incorporated into or used in conjunction with an incident management system that provides data to the correlation module pertaining to cybersecurity incidents, incident elements, and incident artifacts. 
         [0030]      FIG. 1  is a schematic diagram of the hardware forming an exemplary embodiment of a computer system  100  that operates in accordance with the present invention and employs and executes the correlation module of the present invention and the incident management system with which the correlation module is associated. This figure portrays only one variation of the myriad of possible network configurations. The present invention can function in a variety of computing environments; such as, a distributed computer system, a centralized computer system, a stand-alone computer system, or the like. One skilled in the art will appreciate that computing system  100  may or may not contain all the components listed below. 
         [0031]    The computer system  100  comprises a plurality of client computers  102   1 ,  102   2  . . .  102   n , which may connect to one another through a conventional data communications network  104 . A host server  106  is coupled to the communication network  104  to supply application and data services as well as other resource services to the clients  102   1 ,  102   2  . . .  102   n . The communication network  104  is coupled to host server  106  via communication link  108 . Similarly, systems  110   1 ,  110   2  . . .  110   n  are coupled to the communication network  104  via communication links  108   1 ,  108   2  . . .  108   n . The communication link  108   1 ,  108   2  . . .  108   n  may be a physical link, a wireless link, a combination there of, or the like. Systems  110   1 ,  110   2  . . .  110   n  may be another computer system, another communication network, a wireless device, or the like. 
         [0032]    The host server  106  comprises at least one central processing unit (CPU)  112 , support circuits  114 , and memory  116 . The CPU  112  may comprise one or more conventionally available microprocessors. The microprocessor may be an application specific integrated circuit (ASIC). The support circuits  114  are well known circuits used to promote functionality of the CPU  112 . Such circuits include, but are not limited to, a cache, power supplies, clock circuits, input/output (I/O) circuits and the like. The memory  116  contained within the host server  106  may comprise random access memory, read only memory, removable disk memory, flash memory, and various combinations of these types of memory. The memory  116  is sometimes referred to main memory and may, in part, be used as cache memory or buffer memory. The memory  116  generally stores the operating system  118  of the host server  106 . In addition, the memory  116  stores database software  108 , various forms of application software  120 , such as correlation module  122  of the present invention, and database software  124 . Application software  120  may also include all of the modules of an incident management system such as the DF Labs IncMan Suite described above. The operating system may be one of a number of commercially available operating systems. The database software  124  may comprise a relational database. 
         [0033]    The communications network  106  may be coupled to the input/output (I/O) ports  126  of the host server  106 . The I/O ports  126  are coupled to the storage volume  128 . The storage volume  128  generally comprises one or more disk drives, or disk drive arrays, that may be used as a mass storage device for the host server  106  or systems  110   1 ,  110   2  . . .  110   n . The storage volume  124  may support a plurality of host servers  106  (only one of which is depicted). 
         [0034]    To support the operation and functionality of the present invention, the memory  116  may be partially used as cache memory to temporarily store cached information. The correlation module of the present invention may use the memory  116  for evidence control functions, such as, storing, viewing, editing, and the like. 
         [0035]    Under normal operation, the host server  106  supports application programs  120 , such as, the correlation module  122  of the present invention. In one embodiment, the correlation module  122  allows for correlation finding and artifacts correlation on the host server  106 . In addition, the correlation module  122  enables a plurality of client computers  102   1 ,  102   2  . . .  102   n , in different locations, to perform correlation finding and artifacts correlation. 
         [0036]    Correlation module  122  includes a correlation finder and an artifacts correlator. The correlation finder allows an incident investigator and manager to retrieve all incidents and incident elements that match some of the most important details of the incident. The correlation finder puts into a graphical, easy-to-read and easy-to-use interface all of the information derived from a correlation algorithm. 
         [0037]    With reference to  FIGS. 2A and 2B , there is shown a flowchart diagram of steps that a user of the correlation finder might perform in interacting with the interface provided by the correlation finder. This flowchart diagram illustrates only one particular sequence of steps that a user might perform, and it will be appreciated that the steps shown in the flowchart might alternatively be performed in a different order, or with certain steps omitted, etc.  FIGS. 3-24  are screen displays corresponding to various steps in the flowchart diagram of  FIGS. 2A and 2B . 
         [0038]    In order to use the correlation finder, the user first logs in to the incident management system by entering a user name and password and clicking on a “login” button (step  200 ;  FIG. 3 ). Then, the user switches to the incident response section of the incident management system by selecting “incident response” from a drop-down menu (step  202 ;  FIG. 4 ). Next, the user selects an incident to be investigated by selecting an incident from a list displayed on a screen (step  204 ;  FIG. 5 ). In  FIG. 5 , the user selects “DEMOCASE_NG — 2014” as the incident to be investigated. The user clicks an “open case” button on the screen display to enter the incident investigation section of the incident management system (step  206 ;  FIG. 6 ). Next, the user selects “correlation finder” from a panel menu on the display (step  208 ;  FIG. 7 ). A correlation diagram is then loaded and displayed (step  210 ;  FIGS. 8 and 9 ). 
         [0039]    As is shown in  FIGS. 8 and 9 , the correlation finder uses a correlation algorithm to provide a hypertree  300 . In hypertree  300  the books (“DEMOCASE_NG — 20 . . . ,” “CASE 1,” “CASE 2,” “DFL2014193,” “622”) represent incidents, the hard disks (“ 10902 *NG host . . . ,” “ 10710 *NG host . . . ,”) represent evidence related to an incident, the monitors (“NG host 2014.0 . . . ,” “10902,”qaz “) represent a host involved in an incident, the hard disks with arrows (“10902 10902 NG . . . ”) represent forensic images of evidence, and the right arrows(“ediscovery”) represent e-discovery objects created in connection with an incident. Thus, in hypertree  300 , the nodes represent the incident itself and elements of the incident (evidence, hosts, forensic images, e-discovery objects), linked by edges to any incident and incident element related to the single node by meaningful objects details. The hypertree shows the nodes that are linked by edges to the node representing the current incident, as well as the nodes that are in turn linked by edges to those aforementioned nodes that are linked by edges to the node representing the current incident. The different edges to the node representing the current incident are colored differently from each other when there are differences in the nature of the relationships of the node representing the current incident to the other nodes, and colored similarly to each other when the nature of the relationship of the node representing the current incident to the other nodes is the same. Thus, some of the edges to the node representing the current incident might be colored the same while simultaneously other edges to the node representing the current incident might be colored differently. Similar color coding techniques are used with respect to the other nodes displayed in the hypertree. As used herein, the term “colored” also encompasses methods of differentiation such as differences in line thickness, dashed or dotted lines as opposed to continuous lines, etc., even if actual differences in color hue are not shown. A table  302  on the screen display identifies the node representing the current incident and lists the connections to the node representing the current incident, by the names of the nodes linked to the node representing the current incident, and by the respective color of the edges linking the respective nodes to the node representing the current incident. Thus, table  302  provides a summary about the selected node and lists all the active connections between the selected node and other nodes. The user can zoom in on a portion of the hypertree by selecting a zoom feature under the “view options” button. 
         [0040]    In step  212 , the user navigates the displayed hypertree by clicking on one of the nodes, causing the hypertree to be re-centered around the clicked node, in this case “NG host 2014.0 . . . ” The hypertree  300  is re-centered around the clicked node, and the edges to the clicked node are lengthened while the edges to the original node, in this case “DEMOCASE_NG — 2014,” are shortened, as is shown in  FIGS. 10 and 11 . The table  302  on the screen display identifies the clicked node and lists the connections to the clicked node, by the names of the nodes linked to the clicked node, and by the respective color of the edges linking the respective nodes to the clicked node. 
         [0041]    In step  214 , the user hides or shows a single node connection by clicking on a one of a set of colorboxes  304  on the table  302  corresponding to respective connections to the clicked node ( FIGS. 12 and 13 ). In this case, the user clicks on the colorbox corresponding to the connection between “NG host 2014.0 . . . ” and “DEMOCASE_NG — 2014,” and the edge between these two nodes is omitted from the displayed hypertree. Underneath the table  302  is a set of colorboxes  306  that can be clicked by the user to hide or show all links of the same color, and an “All” icon  318  that can be clicked by the user to hide or show all links regardless of their color. 
         [0042]    Next, the user might remove the current, clicked node from the hypertree diagram by clicking on an “X” icon  308  adjacent to the identification of the current, clicked node, and the hypertree is displayed with the current, clicked node and the edges connecting it with other nodes omitted from the hypertree (step  216 ;  FIGS. 14 and 15 ). The user might restore the current node by clicking on a “restore” icon  310  adjacent to the identification of the current node, and the hypertree is displayed with the omitted nodes and edges restored (step  218 ;  FIGS. 16 and 17 ). 
         [0043]    In step  220 , the user removes from the hypertree diagram nodes linked to the current node, by clicking on an “X” icon  312  in the rows of table  302  that list the respective nodes connected the current node, and the hypertree is displayed with those nodes and the edges connecting those nodes with other nodes omitted from the hypertree ( FIGS. 18 and 19 ). 
         [0044]    In step  224 , the user can open details of any node listed in table  302  by clicking on a “details” icon  314  in the table. 
         [0045]    After having modified the hypertree diagram by removing nodes or links or both, the user might choose to re-plot the hypertree diagram without the removed nodes or links, and centered on the node representing the incident being investigated (in this case “DEMOCASE_NG — 2014”) by clicking on a “re-plot diagram” button  316  (step  226 ;  FIG. 20 ). The user might open the “view options” panel by clicking on a “view options” button  320  (step  228 ;  FIG. 21 ), and in the “view options” panel the user might enable or disable related incident nodes (step  230 ;  FIG. 22 ). Then the re-plotted hypertree diagram is displayed, in this case without the related incident nodes “CASE 1,” “CASE 2,” “DFL2014193,” “622”) displayed because they were not disabled by the user in step  230  ( FIGS. 23 and 24 ). Note that in the re-plotted hypertree diagram, the edge between “NG host 2014.0 . . . ” and “622” is omitted, because the user previously omitted “622” from the hypertree in step  220 . In  FIGS. 23 and 24 , the user has hidden all the current node connections by clicking on the “All” icon  318  under the table  302  (step  232 ). 
         [0046]    With reference to  FIGS. 25A and 25B , there is shown a flowchart diagram of steps that a user of the artifacts correlator according to the invention might perform in interacting with the interface provided by the artifacts correlator. The artifacts correlator displays and allows navigation of artifacts that have points of correlation with incidents or other incident element artifacts. This feature uses an interface similar to the one described above with respect to the correlation finder, but using an artifacts correlation algorithm that returns all the incident element artifacts, available from a local or remote data repository, that have some point of correlation with other incident element artifacts. This flowchart diagram illustrates only one particular sequence of steps that a user might perform, and it will be appreciated that the steps shown in the flowchart might alternatively be performed in a different order, or with certain steps omitted, etc.  FIGS. 3-6  and  26 - 47  are screen displays corresponding to various steps in the flowchart diagram of  FIG. 25 . 
         [0047]    In order to use the artifacts correlator, the user first logs in to the incident management system by entering a user name and password and clicking on a “login” button (step  400 ;  FIG. 3 ). Then, the user switches to the incident response section of the incident management system by selecting “incident response” from a drop-down menu (step  402 ;  FIG. 4 ). Next, the user selects an incident to be investigated by selecting an incident from a list displayed on a screen (step  404 ;  FIG. 5 ). In  FIG. 5 , the user selects “DEMOCASE_NG — 2014” as the incident to be investigated. The user clicks an “open case” button on the screen display to enter the incident investigation section of the incident management system (step  406 ;  FIG. 6 ). Next, the user selects “artifacts correlation” from a panel menu on the display (step  408 ;  FIG. 26 ). An artifact correlation diagram is then loaded and displayed (step  410 ;  FIGS. 27 and 28 ). 
         [0048]    As is shown in  FIGS. 27 and 28 , the artifacts correlator uses an artifacts correlation algorithm that matches artifacts elements using an alikeness ratio as a cutoff threshold so that only artifacts elements having an alikeness exceeding the alikeness ratio are displayed in a hypertree  500 . In hypertree  500  the books (“DEMOCASE_NG — 20 . . . ,”) represent incidents, and all other elements are “artifacts,” which represent vulnerabilities, means used to conduct an attack, etc. In hypertree  500  the nodes linked by edges to the node representing the current incident, “DEMOCASE_NG — 20,” are artifacts having an alikeness exceeding the alikeness ratio with respect to “DEMOCASE_NG — 20.” The hypertree shows the nodes that are linked by edges to the “DEMOCASE_NG — 20,” as well as the nodes that are in turn linked by edges to those aforementioned nodes that are linked by edges to “DEMOCASE_NG — 20.” The different edges to the node representing the current incident are colored differently from each other when there are differences in the nature of the relationships of the node representing the current incident to the other nodes, and colored similarly to each other when the nature of the relationship of the node representing the current incident to the other nodes is the same. Thus, some of the edges to the node representing the current incident might be colored the same while simultaneously other edges to the node representing the current incident might be colored differently. Similar color coding techniques are used with respect to the other nodes displayed in the hypertree. A table  502  on the screen display identifies the node representing the current incident and lists the connections to the node representing the current incident, by the names of the nodes linked to the node representing the current incident, and by the respective color of the edges linking the respective nodes to the node representing the current incident. The user can zoom in on a portion of the hypertree by selecting a zoom feature under the “view options” button. 
         [0049]    In step  412 , the user navigates the displayed hypertree by clicking on one of the nodes, causing the hypertree to be re-centered around the clicked node, in this case “Suspicious Arp . . . ” The hypertree  500  is re-centered around the clicked node, and the edges to the clicked node are lengthened while the edges to the original node, in this case “DEMOCASE_NG — 20 . . . ,” are shortened, as is shown in  FIGS. 29 and 30 . The table  502  on the screen display identifies the clicked node and lists the connections to the clicked node, by the names of the nodes linked to the clicked node, and by the respective color of the edges linking the respective nodes to the clicked node. 
         [0050]    In step  414 , the user hides or shows a single node connection by clicking on one of a set of colorboxes  504  on the table  502  corresponding to respective connections to the clicked node ( FIGS. 31 and 32 ). In this case, the user clicks on the colorbox corresponding to the connection between “Suspicious Arp . . . ” and “107VII+2014-20,” and the edge between these two nodes is omitted from the displayed hypertree. Underneath the table  502  is a set of colorboxes  506  that can be clicked by the user to hide or show all links of the same color, and an “All” icon  518  that can be clicked by the user to hide or show all links regardless of their color. 
         [0051]    Next, the user might remove the current, clicked node from the hypertree diagram by clicking on an “X” icon  508  adjacent to the identification of the current, clicked node, and the hypertree is displayed with the current, clicked node and the edges connecting it with other nodes omitted from the hypertree (step  416 ;  FIGS. 33 and 34 ). The user might restore the current node by clicking on a “restore” icon  510  adjacent to the identification of the current node, and the hypertree is displayed with the omitted nodes and edges restored (step  418 ;  FIGS. 35 and 36 ). 
         [0052]    In step  420 , the user removes from the hypertree diagram nodes linked to the current node, by clicking on an “X” icon  512  in the rows of table  502  that list the respective nodes connected the current node, and the hypertree is displayed with those nodes and the edges connecting those nodes with other nodes omitted from the hypertree ( FIGS. 37 and 38 ). 
         [0053]    In step  424 , the user can open details of any node listed in table  502  by clicking on a “details” icon  514  in the table. 
         [0054]    After having modified the hypertree diagram by removing nodes or links or both, the user might choose to re-plot the hypertree diagram without the removed nodes or links, and centered on the node representing the incident being investigated (in this case “DEMOCASE_NG — 20 . . . ”) by clicking on a “re-plot diagram” button  516  (step  426 ;  FIG. 39 ). The user might open the “view options” panel by clicking on a “view options” button  520  (step  428 ;  FIG. 40 ), and in the “view options” panel the user might enable or disable related incident nodes and select an artifact alikeness ratio expressed as a percent number (step  430 ;  FIG. 41 ). Then the re-plotted hypertree diagram is shown (step  432 ), displaying all artifacts having an alikeness that exceeds the user-selected alikeness threshold with respect to “DEMOCASE_NG — 20” or with respect to artifacts connected to DEMOCASE_NG — 20” ( FIGS. 42 and 43 ). The alikeness ratio allows the user to refine the displayed result to have a more loose or more precise representation of similarities. 
         [0055]    The user can navigate the hypertree diagram by clicking on the nodes (step  434 ;  FIGS. 44 and 45 ). For example, in  FIGS. 44 and 45 , the user has clicked on “Suspicious Arp . . . ” and so the diagram is centered around that particular node. 
         [0056]    In  FIGS. 46 and 47 , the user has hidden all the current node connections by clicking on the “All” icon  518  under the table  502  (step  436 ). 
         [0057]    There has been described a system and method for automated cybersecurity visualization and correlation. While several particular forms of the invention have been illustrated and described, it will be apparent that various modifications and combinations of the invention detailed in the text and drawings can be made without departing from the spirit and scope of the invention. Accordingly, it is not intended that the invention be limited, except as by the appended claims.