WO2016200373A1

WO2016200373A1 - Generating further groups of events based on similarity values and behavior matching using a representation of behavior

Info

Publication number: WO2016200373A1
Application number: PCT/US2015/034906
Authority: WO
Inventors: Ming C. Hao; Felix Hamborg; Nelson L. Chang; Justin Aaron SCAGGS; Daniel Keim
Original assignee: Hewlett Packard Development Co LP
Current assignee: Hewlett Packard Development Co LP
Priority date: 2015-06-09
Filing date: 2015-06-09
Publication date: 2016-12-15
Anticipated expiration: 2017-12-09

Abstract

A representation of behavior of a selected group of events is obtained from a library, the representation including values corresponding to respective distributions of dimensions of the events. Similarity values indicating similarities between further events and the selected group of events are computed, the similarity values based on a combination of the representation of behavior and distances between the further events and the selected group of events. Further groups of the further events are computed based on the similarity values and behavior matching using the representation of behavior of the selected group of events. The further groups are visualized in a visualization.

Description

GENERATING FURTHER GROUPS OF EVENTS BASED ON SIMILARITY VALUES AND BEHAVIOR MATCHING USING A REPRESENTATION OF BEHAVIOR

Background

[0001] A large amount of data (such as network traffic and so forth) can be produced or received in an environment, such as a network environment that includes many machines (e.g. computers, storage devices, communication nodes, etc.), or other types of environments. As examples, data can be acquired by sensors or collected by applications. Other types of data can include security data, financial data, health-related data, sales data, human resources data, and so forth.

Brief Description Of The Drawings

[0002] Some implementations are described with respect to the following figures.

[0003] Fig. 1 is a flow diagram of an example pattern detection process, according to some implementations.

[0004] Fig. 2 is a flow diagram of an example process for an event behavior

representation generating (profiling) process for a selected group of events, according to some implementations.

[0005] Fig. 3 is a flow diagram of an example process of computing similarity values, according to some implementations.

[0006] Fig. 4 is a graph including example data points representing respective events, which can be used for determining similarities between events and a group of events, according to some implementations.

[0007] Fig. 5 is a flow diagram of an example process of generating further groups of events, according to some implementations. [0008] Fig. 6 illustrates an example graphical visualization including an input data set, a selected group of events, and further groups of events determined according to some implementations .

[0009] Fig. 7 is a block diagram of an example computer system according to some implementations .

Detailed Description

[0010] Activity occurring within an environment can give rise to events. An

environment can include a collection of machines and/or program code, where the machines can include computers, storage devices, communication nodes, and so forth. Events that can occur within a network environment can include receipt of data packets that contain corresponding addresses and/or ports, monitored measurements of specific operations (such as metrics relating to usage of processing resources, storage resources, communication resources, and so forth), or other events. Although reference is made to activity of a network environment in some examples, it is noted that techniques or mechanisms according to the present disclosure can be applied to other types of events in other environments, where such events can relate to financial events, health-related events, human resources events, sales events, and so forth.

[0011] Generally, an event can be generated in response to occurrence of a respective activity. An event can be represented as a data point (also referred to as a data record).

[0012] Each data point can include multiple dimensions (also referred to as attributes), where an dimension can refer to a feature or characteristic of an event represented by the data point. More specifically, each data point can include a respective collection of values for the multiple dimensions. In the context of a network environment, examples of dimensions of an event include a network address dimension (e.g. a source network address and/or a destination network address), a network subnet dimension (e.g. an identifier of a subnet), a port dimension (e.g. source port number and/or destination port number), and so forth. Data points that include a relatively large number of dimensions (dimensions) can be considered to be part of a high-dimensional data set. [0013] Finding patterns (such as patterns relating to failure or fault, unauthorized access, or other issues) in data points representing respective events can be difficult when there is a very large number of data points. For example, some patterns can indicate an attack on a network environment by hackers, or can indicate other security issues. Other patterns can indicate other issues that may have to be addressed.

[0014] For example, to identify security attack patterns in a high-dimensional data set collected for a network environment, analysts can use scatter plots for identifying patterns associated with security attacks. A scatter plot includes graphical elements representing data points, where positions of the data points in the scatter plot depend on values of a first dimension corresponding to an x axis of the scatter plot, and values of a second dimension corresponding to a y axis. In some examples, the first dimension can be time, while the second dimension can include a value of a port (e.g. destination port) that is being accessed.

[0015] If ports are scanned (accessed) sequentially by security attacks, the security attacks can be manifested as a visible diagonal pattern in the scatter plot. If the ports are accessed in randomized order, however, the network traffic (i.e., port scan) may not be visible in the scatter plot.

[0016] In accordance with some implementations according to the present disclosure, techniques or mechanisms are provided to allow users to identify patterns associated with issues of interest to the users, such as occurrence of security attacks in a network

environment, or other issues in other environments.

[0017] In some examples, a user can be presented with a graphical visualization including data points that represent respective events. Within the graphical visualization of the events, the user may see a pattern of interests, and can thus make an interactive selection of pixels (and more specifically, of a pattern of pixels) representing the data points associated with the pattern of interests. A "pattern of pixels" can refer to any collection of pixels that may be of interest to a user. The selected data points make up a selected group of events.

[0018] Fig. 1 is a flow diagram of an example process of identifying and visualizing further patterns that are similar to the pattern represented by the selected group of events. In some implementations, the further groups of events are identified based on both a distance criterion and a behavior matching criterion (which are discussed further below).

[0019] The process of Fig. 1 obtains (at 102) a representation of behavior of the selected group of events, where the representation can include values corresponding to respective distributions of dimensions of the events in the selected group. The representation of behavior of the selected group of events can be retrieved from a profile library, where the representation of behavior was previously stored.

[0020] Each data point representing a respective event can include multiple dimensions (also referred to as attributes). For example, a data point representing an event associated with data communications in a network can include the following dimensions (or attributes): source Internet Protocol (IP) address, source port number, destination IP address, destination port number, and so forth. For each given dimension, the different events of the selected group can have respective values of the given dimension. For example, if the given dimension is the source IP address, then the events of the selected group can have different values of the source IP address.

[0021] For the given dimension, the representation of behavior of the selected group of events can include a respective diversity value that represents the distribution of values of the given dimension of the events of the selected group. Generally, a diversity value provides an indication of the distribution of values of a given dimension (or of multiple dimensions). As an example, assume that there are N(N> 1) events in the selected group of events, and each data point representing a corresponding event of the selected group has M dimensions (xl , ... , x ). Then for each given dimension xj (j = 1 to M), the N events have N respective values of xj. Note that at least some of the N values of xj can be different and/or at least some of the N values of xj can be the same.

[0022] In some implementations of the present disclosure, a distribution of the values of xi in the selected group of events can be determined, and this distribution of values of xi can be used to produce the corresponding diversity value in the representation of behavior of the selected group of events. The representation of behavior of the selected group of events includes M diversity values, where each of the M diversity values represents the distribution of values of the dimension xj (j = 1 to M).

[0023] In some examples, the diversity values in the representation of the behavior of the selected group of events can include entropy values, where each entropy value is calculated for each respective dimension xz. The entropy value (or more specifically, a Shannon entropy value) can represent an expected value of information contained in each event. Entropy is zero when only a certain outcome is expected. As an example, for vertical network traffic (which can be an example of an attack against a network performed by a malicious entity in which a single IP address is scanned against multiple ports), the value of the destination IP address dimension stays the same across the events of the selected group, while the values of the destination port number dimension vary across the events of the selected group. Entropy characterizes uncertainty about a source (or sources) of information that give rise to the events; entropy increases for sources of greater randomness. In some examples, reference to "entropy" is the present discussion can be a reference to "normalized entropy," which can be entropy divided by information length.

[0024] In other examples, instead of using entropy values, the representation of the behavior of the selected group of events can include diversity values computed using other probability distribution statistical techniques, where values in the representation of the behavior are derived from statistical distributions of the dimensions.

[0025] In some examples of the present disclosure, the representation of behavior of the selected group of events can be in the form of a behavior feature vector, such as according to Table 1 below:

Table 1

[0026] In Table 1 above, four dimensions are included in data points representing the selected group of events. The four dimensions are: SRC (source IP address), SPT (source port number), DST (destination IP address), and DPT (destination port number). Each dimension is associated with a respective entropy value (0.66 for SRC, 0 for SPT, 0 for DST, and 1.0 for DPT). The foregoing entropy values are computed for each respective dimension based on the distribution of values of the respective dimension in the data points representing the events of the selected group. The four entropy values of the respective four dimensions make up a behavior profile, and these four values form a behavior feature vector in the described example.

[0027] In some examples, the behavior feature vector can be stored in a profile library for later retrieval for the purpose of identifying further groups of events that are similar to the selected group of events. A "profile library" or more generally a "library" can refer to any collection of information that can be stored in a storage medium (or storage media).

[0028] The process of Fig. 1 further computes (at 104) similarity values indicating similarities between further events and the selected group of events. The further events can include events that are not part of the selected group of events. The similarity values are based on a combination of the representation of behavior of the selected group of events that is obtained at 102, and on distances between the further events and the selected group of events. Details regarding computation of the similarity values are provided below.

[0029] The process of Fig. 1 generates (at 106) further groups of the further events based on the similarity values and also based on behavior matching using the representation of behavior of the selected group of events. In some implementations, behavior matching includes a process of determining whether adding a further event to a particular further group would result in deviation from the representation of the selected group of events. Details regarding task 106 are discussed further below.

[0030] The process of Fig. 1 then visualizes (at 108) the further groups in a graphical visualization. A "graphical visualization" can refer to any viewable representation of information that can be displayed by a display device. More generally, the further groups can be visualized in a visualization such as in files or other entities. [0031] Fig. 2 is a flow diagram of an example process for determining the representation of behavior of the selected group of events. The process of Fig. 2 extracts (at 202) behavior for each respective dimension of the multiple dimensions associated with the events.

Extracting the behavior can include extracting the values of the respective dimension across the different events in the selected group.

[0032] The process of Fig. 2 analyzes (at 204) the dimension distribution for each dimension, to determine diversity of the respective dimension. As part of the analysis, the process of Fig. 2 can compute a value (such as an entropy value or other type of value). In some examples, an entropy value for a given dimension can be computed according to Eq. 1 below:

∑i P{Cj) - log(p(q)) (Eq. 1)

ENTROPY(C) =

[0033] In Eq. 1, the entropy value is represented as ENTROPY(C) , where C is a frequency distribution, q is the frequency of the z^'-th value of a given dimension, and p(q) represents is the probability of q. Stated differently, p(q) represents the relative frequency of q, where q is a specific value out of all values in C. As a specific example, assume there are 1,000 values for a given dimension, and let c₂₀ of a specific value {e.g. "100.1.150.2") be 30 {i.e. the value "100.1.150.2" occurs 30 times for the given dimension). Then, in this example, p(c₂₀) = 30 / 1,000.

[0034] Moreover, p(q) represents a sum over all p(q) values of a given dimension in the events of the selected group, and∑; q represents a sum over all q values of a given dimension in the events of the selected group.

[0035] From the values computed by the analyzing performed at 204, a behavior feature vector is constructed (at 206), such as the behavior feature vector of Table 1 discussed above. The behavior feature vector is stored (at 208) in the profile library.

[0036] Fig. 3 is a flow diagram of an example process to compute the similarity values as performed at 104 in Fig. 1, according to some implementations. In the following discussion, reference is also made to Fig. 4, which is a graph illustrating various data points that can be displayed in a graphical visualization. The horizontal axis of the graph of Fig. 4 can represent a first dimension (such as time), while the vertical axis can represent a second dimension (such as port number). In other examples, the horizontal and vertical axes can represent different dimensions.

[0037] In Fig. 4, a box 402 represents the selected group of events, as selected by a user or another entity (such as an application or a machine). Fig. 4 also depicts data points PI, P2, and P3 that represent further events. The calculation of the similarity values is between the further events represented by the data points PI, P2, and P3, and the events of the data points in the selected group 402.

[0038] The process of Fig. 3 calculates (at 302) distances between the further events and the selected group of events. As noted above, the similarity values computed at 104 in Fig. 1 are based on distances between the further events and the selected group of events, and also based on the representation of behavior (e.g. behavior feature vector) of the selected group of events.

[0039] The distance for dimension i between each data point Px_t representing a further event and each data point Py_t in the selected group 402 is calculated at 302. The distance can be computed in one of several different ways based on the type of dimension. If the dimension is a categorical dimension (a dimension that does not have numerical values, but rather, has values in different categories), then the distance is a categorical distance measure d(x, y), where d x,y) = 0 if x does not equal y, and d(x, y) = 1 if x equals y. For other types of dimensions, other techniques for computing the distance can be used, such as based on a difference between values of x and y.

[0040] The average distance, dm(i) (Px_£j Py ), per dimension i is then calculated (at 304) across each data point representing a further event and the data points in the selected group 402. A weighted distance, DISTANCE_WEIGHTED(Px, Py), for a data point Px representing a further event is then calculated (at 306) according to Eq. 2, with the entropy values across the dimensions used as weighting factors. DISTANCE_WEIGHTED(Px, Py) =∑i W dm{i){Px Py_t). (Eq. 2)

[0041] In Eq. 2, w_£ is the weight for dimension i, where w_£ is derived from the entropy value in the behavior feature vector for dimension i. In some examples, w_£ can be set equal to the entropy value for dimension i. In other examples, w_£ can be calculated based on the entropy value and at least another factor. There is one weighted distance calculated for each data point {e.g. PI, P2, or P3 in Fig. 4) representing a further event.

[0042] In some examples, the weighted distance, D I STAN C E_WE I GH TE D (Px, Py), can be normalized to a value between 0 and 1 by dividing the weighted distance by the sum of all weights w_£ . In some examples, the normalized weighted distance can be used as the similarity value computed at 104. Alternatively, the non-normalized weighted distance can be used as the similarity value computed at 104.

[0043] The further events are sorted (at 308) by the similarity values (the normalized or non-normalized weighted distances). The sorted data points are thus arranged in order of their similarity values.

[0044] Fig. 5 is a flow diagram of an example process to generate the further groups at 106 in Fig. 1, using the sorted data points that have been sorted according to the similarity values. The process of Fig. 5 has multiple iterations for multiple further groups and multiple further events that are to be added to a respective further group.

[0045] The process of Fig. 5 can start with an initial further group (which can be empty to start with) and can iterate to identify additional further groups until no further groups can be generated. For a current further group (502), the process of Fig. 5 considers a current further event (504). The current further event can start with the further event that is most similar to the selected group of events (i.e. the further event with the smallest weighted distance to the selected group of events). The process performs (at 506) a distance check for the current further event with respect to the current further group. More specifically, the distance check includes checking if the distance between the current further event and the last event of the current further group is less than a specified threshold. The "last" event in the current further group is the event of the current further group that is farthest away from the selected group of events.

[0046] If the distance check does not pass (as determined at 508), in other words, the distance between the current further event and the last event of the current further group is not less than the specified threshold, then the process of Fig. 5 iterates (at 510) to the next current further group and re-iterates through the process of Fig. 5. Note that the current further event is not added to the current further group in this scenario.

[0047] However, if the distance check passes (as determined at 508), then the process of Fig. 5 performs (at 512) behavior matching using the diversity values of the representation of behavior of the selected group of events (e.g. entropy values of the behavior feature vector discussed above).

[0048] The following describes an example using entropy values, although other types of diversity values can be used in other examples.

[0049] The behavior matching is performed for each dimension of multiple dimensions of the events. For each dimension i, the behavior matching sets a target entropy, E_t, equal to the entropy value of the behavior feature vector for dimension i.

[0050] In addition, the behavior matching calculates a current entropy, CE_t, for dimension i, for the current further group without the current further event included in the current further group. In addition, the behavior matching calculates a new entropy, NE_t, for dimension i for {current further group, current further event}, in other words, the expanded current further group with the current further event added. The computation of the new entropy or the current entropy is based on use of Eq. 1.

[0051] The behavior matching then computes a current entropy difference according to Eq. 3:

CURRENT_ENTR0PY_DIFFERENCE(7£^' _i, CE_t) = \TE_t - CE_t \. (Eq. 3)

[0052] The behavior matching then computes a new entropy difference according to Eq. 4: NEW_ENTROPY_DIFFERENCE(7^,£^' _i, ΝΕι) = \TE_t - NE_t \. (Eq. 4)

[0053] If the new entropy difference is less than the current entropy difference, then the behavior matching is determined (at 514) to have passed. However, if the new entropy difference is not less than the current entropy difference, then the behavior matching is determined (at 514) to not have passed.

[0054] If the behavior matching is determined to not have passed, then the process of Fig. 5 iterates to the next further group. However, if the behavior matching is determined to have passed, then the process adds (at 516) the current further event to the current further group, and iterates (at 518) to the next current further event.

[0055] More generally, the behavior matching determines a first representation of behavior (e.g. behavior feature vector of entropy values) (the first representation containing first diversity values) of the current further group including the current further event, and based on at least one value of the representation of behavior of the current further group and at least one corresponding value of the representation of behavior of the selected group of events, the behavior matching decides whether to add the current further event to the further group.

[0056] In addition, a second representation of behavior (e.g. behavior feature vector of entropy values) (the second representation containing second diversity values) of the current further group without the given further event is determined. A first difference (e.g. according to Eq. 4) between a value of the first representation of behavior and a corresponding value of the representation of behavior of the selected group of events is computed. A second difference (e.g. according to Eq. 3) between a value of the second representation of behavior and a corresponding value of the representation of behavior of the selected group of events is computed. The first difference and the second difference are compared, where deciding whether to add the current further event to the current further group is in response to the comparing.

[0057] Once the further groups of further events have been determined using techniques or mechanisms according to some implementations, at least two of the further groups of further events may be combined based on a relationship between the at least two further groups.

[0058] Fig. 6 illustrates an example graphical visualization that includes a representation 602 of the entire data set of data points. Since there are a large number of data points in the representation 602, it can be difficult to identify patterns that are similar to a particular pattern. Within the representation 602 of the entire data set, a user can notice a particular pattern of interest, and can make an interactive selection of the data points of the particular pattern— this interactive selection produces the selected group of events discussed above.

[0059] In Fig. 6, a representation 604 of the selected group of events of the particular pattern of interest is depicted. Using techniques or mechanisms according to the present disclosure as discussed above, further groups can be identified and represented with respective representations 606, 608, 610, 612, and 614 in the graphical visualization of Fig. 6.

[0060] It is noted that data points can be represented as pixels in each of the

representations 602 to 614. A pixel can be assigned a visual indicator, such as a respective color, based on the value of a particular dimension of the event represented by the pixel. Each of the representations 602 to 614 has a respective color scale (e.g. 616) that has different colors to indicate different values of the particular dimension.

[0061] In some examples, interactive control elements can be provided in the graphical visualization to allow a user to interactively combine or split further groups identified using techniques or mechanisms according to some implementations.

[0062] In some examples, the representations 606, 608, 610, 612, and 614 can be marked with visual indicators (e.g. different colors) to rank how similar the respective further groups are to the selected group of events (represented by representation 604).

[0063] Using techniques or mechanisms according to the present disclosure, a user can more easily identify multiple groups of events that may be similar to a selected group of events that is of interest to the user. [0064] Fig. 7 is a block diagram of an example computer system 700 according to some implementations. The computer system 700 can include one computer, or a distributed arrangement of multiple computers (where different tasks of techniques according to some implementations can be executed in different computers of the distributed arrangement). The computer system 700 includes a processor (or multiple processors) 702. A processor can include a microprocessor, a microcontroller, a physical processor module or subsystem, a programmable integrated circuit, a programmable gate array, or a physical control or computing device.

[0065] The processor(s) 702 can be coupled to a non-transitory machine-readable or computer-readable storage medium (or storage media) 704, which can store various machine- executable instructions, including instructions 706 to generate a representation of behavior of a selected group of events (such as according to tasks 202-206 of Fig. 2), instructions 708 to compute similarity values (such as according to task 104 in Fig. 1 and tasks 302-308 of Fig. 3), and instructions 710 to generate further groups of further events (such as according to task 106 in Fig. 1 and tasks 502-518 of Fig. 5), and other machine-readable instructions to perform other tasks as discussed above.

[0066] The storage medium (or storage media) 704 can include one or multiple different forms of memory including semiconductor memory devices such as dynamic or static random access memories (DRAMs or SRAMs), erasable and programmable read-only memories (EPROMs), electrically erasable and programmable read-only memories (EEPROMs) and flash memories; magnetic disks such as fixed, floppy and removable disks; other magnetic media including tape; optical media such as compact disks (CDs) or digital video disks (DVDs); or other types of storage devices. Note that the instructions discussed above can be provided on one computer-readable or machine-readable storage medium, or alternatively, can be provided on multiple computer-readable or machine-readable storage media distributed in a large system having possibly plural nodes. Such computer-readable or machine-readable storage medium or media is (are) considered to be part of an article (or article of manufacture). An article or article of manufacture can refer to any manufactured single component or multiple components. The storage medium or media can be located either in the machine running the machine-readable instructions, or located at a remote site from which machine -readable instructions can be downloaded over a network for execution.

[0067] In the foregoing description, numerous details are set forth to provide an understanding of the subject disclosed herein. However, implementations may be practiced without some of these details. Other implementations may include modifications and variations from the details discussed above. It is intended that the appended claims cover such modifications and variations.

Claims

What is claimed 1. A method comprising:

obtaining, by a system comprising a processor from a library, a representation of behavior of a selected group of events, the representation including values corresponding to respective distributions of dimensions of the events;

computing, by the system, similarity values indicating similarities between further events and the selected group of events, the similarity values based on a combination of the representation of behavior and distances between the further events and the selected group of events;

generating, by the system, further groups of the further events based on the similarity values and behavior matching using the representation of behavior of the selected group of events; and

visualizing, by the system, the further groups in a visualization.

2. The method of claim 1, wherein the generating of a first further group of the further groups comprises, for a given further event:

determining a first representation of behavior of the first further group including the given further event;

based on at least one a value of the first representation of behavior of the first further group and at least one corresponding value of the representation of behavior of the selected group of events, decide whether to add the given further event to the first further group.

3. The method of claim 2, wherein the generating of the first further group further comprises, for the given further event:

determining a second representation of behavior of the first further group without the given further event;

computing a first difference between a value of the first representation of behavior and a corresponding value of the representation of behavior of the selected group of events; computing a second difference between a value of the second representation of behavior and a corresponding value of the representation of behavior of the selected group of events;

comparing the first difference and the second difference,

wherein deciding whether to add the given further event to the first further group is in response to the comparing.

4. The method of claim 1, wherein the generating of a first further group of the further groups comprises, for a given further event:

determining whether a distance between the given further event and an event in the first further group is less than a specified threshold; and

adding the given further event to the first further group in response to the determining.

5. The method of claim 1, further comprising sorting the further events according to the similarity values, wherein the generating of the further groups uses the sorted further events.

6. The method of claim 1 , wherein the values in the representation of behavior of the selected group of events comprises entropy values.

7. The method of claim 1 , wherein the values in the representation of behavior of the selected group of events are based on statistical distributions of the dimensions.

8. The method of claim 1, further comprising receiving interactive user selection in a visualization of a pattern of pixels representing events in the selected group of events.

9. The method of claim 1, wherein computing the similarity values comprises:

computing distances between the further events and the selected group of events; and applying weights to the computed distances, the weights including values of the representation of behavior of the selected group of events.

10. The method of claim 1, further comprising combining at least two of the further groups according to relationships between the at least two further groups.

11. A system comprising:

at least one processor to:

determine a distribution of values of each dimension of a plurality of dimensions of events in a selected group of events;

generate diversity values in a representation of behavior of the selected group of events based on the distributions of values of the respective dimensions;

compute similarity values indicating similarities between further events and the selected group of events, the similarity values computed using the diversity values and distances between the further events and the selected group of events; and

generate further groups of the further events based on the similarity values and behavior matching using the representation of the behavior of the selected group of events.

12. The system of claim 11 , wherein the behavior matching comprises using the representation of behavior of the selected group of events to decide whether to add a respective further event to one of the further groups.

13. The system of claim 12, wherein the behavior matching further comprises:

generating first diversity values for a given further group of the further groups with a given further event included in the given further group;

generating second diversity values for the given further group without the given further event included in the given further group; and

deciding whether or not to add the given further event to the given further group using the first and second diversity values and using the diversity values of the representation of behavior of the selected group of events.

14. The system of claim 13, wherein the at least one processor is to further:

compute a distance between the given further event and the given further group, wherein deciding whether or not to add the given further event to the given further group is further based on the computed distance.

15. An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:

obtain, from a library, a representation of behavior of a selected group of events interactively selected in a visualization, the representation including values corresponding to respective distributions of dimensions of the events;

compute similarity values indicating similarities between further events and the selected group of events, the similarity values based on distances between the further events and the selected group of events, and on the representation of behavior;

sort the further events according to the similarity values; and

generate further groups of the further events using the sorted further groups and according to behavior matching using the representation of behavior of the selected group of events; and

cause visualization of the further groups.