Method and apparatus for correlating network activity through visualizing network data

摘要

Correlating network activity through visualizing network data and with identifying entities associated with targeted activities and correlating therewith other activities from those entities. Network traffic is classified into a number of conceptual views of network traffic, each instantiating view objects that are a representation of network traffic that satisfies a set of conditions. Configuration files define a hierarchy, the structure of the hierarchy, and its makeup. Any point on the hierarchy can be accessed using its Graphical Request Language (GRL) designation. Further GRL designations are used to label views associated with a point. A plurality of view objects are linked to corresponding view object databases. Define new view objects using one or more GRL does correlation and combining using logical operators. Generate a new list of addresses from the GRL address lists and place all current and subsequent traffic for those machines in the new view object.