Abstract: The technology disclosed includes a system to reduce clutter when displaying a security analysis graph of nodes and edges. Simple chains of nodes do not have branches and are equivalent when they have the same length, connection types and endpoints. First, second and potentially more simple chains can be aggregated for display. A third and potentially more simple chains can be excluded from aggregation based on an accumulated risk analysis score. The excluded simple chain can readily be called to an analyst's attention.

Abstract: The technology disclosed includes a system to reduce clutter during graph presentation for security incident analysis. The system includes logic to score nodes potentially collapsed by equivalence, of indicated interest for security incident analysis, to prevent aggregation. The system includes logic to aggregate and hide equivalent nodes that have matching degrees, that are connected to matching nodes by matching edge types, and that have scores below a first selected threshold. The system does not collapse nodes that are interesting for security analysis and keeps them visible. The technology disclosed identifies chains of at least three nodes having degrees of 1 or 2, without branching from any node in the chain. The identified chains are collapsed into chain-collapsed single nodes. Two different cases of chains including whisker chains ending in a leaf node and chains connected at both ends to two other nodes are presented.

Abstract: The technology disclosed includes a system to reduce clutter during graph presentation for security incident analysis. The system includes logic to score nodes potentially collapsed by equivalence, of indicated interest for security incident analysis, to prevent aggregation. The system includes logic to aggregate and hide equivalent nodes that have matching degrees, that are connected to matching nodes by matching edge types, and that have scores below a first selected threshold. The system does not collapse nodes that are interesting for security analysis and keeps them visible. The technology disclosed identifies chains of at least three nodes having degrees of 1 or 2, without branching from any node in the chain. The identified chains are collapsed into chain-collapsed single nodes. Two different cases of chains including whisker chains ending in a leaf node and chains connected at both ends to two other nodes are presented.

Abstract: A method for operating a binary executable in which some of the data or code is to be protected includes the step of pruning the binary executable of the code andor data to be protected. Nonfunctional code is substituted for the code pruned from the binary executable, to form a pruned executable which does not contain the code to be protected. The code pruned from the binary executable is loaded into a code injection service or program (CIS). The binary executable is placed in memory as with any application. Invoking the pruned executable alone results in crash. The CIS is made part of the operating system service, and is loaded into RAM when the computer starts. When the pruned executable is invoked, the CIS detects its presence, and as the pruned executable runs, the CIS substitutes the actual data or code into the pruned executable, whereby it operates normally.