Patent Document ID: 8965981
Application ID: 12626309

Base Claim:
1. A method for botnet message analysis and visualization comprising: filtering network traffic comprised of messages; compiling a list of messages from the network traffic based on each message in the list of messages matching filtering criteria; tokenizing, by a processor, each message in the list of messages to generate tokenized messages; aggregating, by the processor, the tokenized messages into groups to generate aggregated groups of tokenized messages; identifying, by the processor, frequency changes in content and attributes of the tokenized messages in the aggregated groups of tokenized messages to generate identified frequency changes; grouping, by the processor, the identified frequency changes in the aggregated groups of tokenized messages; generating, by the processor, a user display of the aggregated groups of tokenized messages and of the identified frequency changes in the aggregated groups of tokenized messages as a function of time wherein each of the aggregated groups of identified frequency changes is displayed in a particular timeslot; displaying the aggregated groups of tokenized messages in a graph with columns representing timeslots based on a time each of the tokenized messages was originally sent; receiving user input requesting additional detail for messages received in a particular timeslot, by indicating a respective column on the graph, where each column is associated with a respective timeslot; displaying additional detail for messages contained in columns indicated by user input; receiving user input requesting a display of classifications for a single segment of a column associated with a timeslot; displaying the classifications for a single segment of a column associated with a timeslot in response to receiving user input requesting a display of classification for a single segment; displaying an icon indicating a change in frequency of an aggregated group of tokenized messages in a particular timeslot compared to a frequency of an aggregated group of tokenized messages in a previous timeslot; recording user input received while a user is interacting with the user display; modifying the filtering based on selected recorded user input received while the user is interacting with the user display; modifying the tokenizing based on selected recorded user input received while the user is interacting with the user display; separating the graph into subgraphs based on selected recorded user input received while the user is interacting with the user display; and refining the graph based on the modifying the filtering, modifying the tokenizing, and separating the graph into subgraphs.

---

Claim 5:
5. The method of claim 1 further comprising: receiving user input requesting modification of tokenization criteria; and modifying the tokenization criteria based on the user input requesting modification of the tokenization criteria.