1. A system that enables a reconstructing of user-viewable visual stimuli comprising:
a processing platform for: executing code capable of recording a user-viewable visual stimuli, verifying a change in the visual stimuli without requiring user specified information as an input, and creating a visual event as a result of a browser event that causes a change in the visual stimuli; and
a storage platform for storing at least the visual stimuli, wherein the storage platform is operably coupled to the processing platform;
wherein the processing platform is adapted to reconstruct at least one of:
the visual stimuli; and
the change in the visual stimuli, at a specific time that a user viewed the visual stimuli.
2. The system of claim 1 further comprising a user interaction device coupled to the processing platform.
3. The system of claim 1 wherein the processing platform executes code capable of recording a user-viewable stimuli, by:
detecting a visual event;
verifying that the visual event involves a parameter that changes a viewable stimuli; and
recording at least one parameter.
4. The system of claim 1 further comprising a browser coupled to the processing platform.
5. The system of claim 1 further comprising a browser interface coupled to the processing platform.
6. The system of claim 1 further comprising a network coupled to the processing platform.
7. The system of claim 1 wherein the storage platform comprises cached memory.
8. The system of claim 1 wherein the system is maintained in a Person Digital Assistant (PDA).
9. The system of claim 6 wherein the network is the internet.
10. The system of claim 6 further comprising a host computer coupled to the network, the host computer for communicating with the processing platform.
11. The system of claim 1 further comprising an eye-tracking device coupled to the processing platform.
12. The system of claim 11 wherein the eye-tracking device is enabled to monitor pupil dilation.
13. A system that enables a reconstructing of user-viewable visual stimuli comprising:
a processing platform for: executing code capable of recording a user-viewable visual stimuli, verifying a change in the visual stimuli, verifying a change in a user’s eye position, and creating a visual event as a result of a browser event that causes the change in the visual stimuli and to the change in the user’s eye position with respect to a portion of the visual stimuli; and
a storage platform for storing at least the visual stimuli, wherein the storage platform is operably coupled to the processing platform;
wherein the processing platform is adapted to visually reconstruct and display the change in the visual stimuli in association with the change in the user’s eye position with respect to a portion of the visual stimuli, at a specific time that a user viewed the visual stimuli.
14. The system of claim 13 further comprising a parameter related to the visual event, wherein the parameter is a network address of all online content immediately displayed within a browser window.
15. The system of claim 13 further comprising a parameter related to the visual event, wherein the parameter is a two-dimensional offset of the online content as it is displayed within a browser window.
16. The system of claim 1, wherein the change is caused by a user.
17. The system of claim 1, wherein the change is caused by a source of the visual stimuli.
18. The system of claim 1, wherein the change is caused by the processing platform.
19. A computer readable medium comprising instructions for:
correlating an eye position with a portion of the displayed visual stimuli;
verifying a change in the displayed visual stimuli resulting from a browser event that causes the change;
verifying a change in the eye position based on the change in the displayed visual stimuli; and
reconstructing the change in the displayed visual stimuli and the change in the eye position, at a specific time that a user viewed at least one of:
the displayed visual stimuli at an eye position;
the change in the displayed visual stimuli;
the change in the eye position; and
the change in the eye position based on the change in the displayed visual stimuli.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. In a computer system comprising hardware and software, the improvement comprising:
a transducer instrumented within the hardware or the software of the computer system that monitors the computer system as the computer system operates and in response thereto generates given program activity data, wherein the transducer is code that monitors transitions across defined points within the operating environment of the computer system;
a comparator that compares the given program activity data with data indicative of a normal operation of the computer system; and
a device for outputting a given indication based on the comparison between the given program activity data and the data indicative of the normal operation of the computer system;
wherein the given indication is indicative of an anomalous behavior resulting from a security violation in the computer system.
2. In the computer system as described in claim 1 wherein the defined points within the operating environment of the computer system comprise program module input or output events.
3. A computer system, comprising:
hardware;
software executable on the hardware;
a transducer instrumented within the hardware or the software that monitors an operating environment of the computer system as the computer system operates and in response thereto generates program execution trace data;
a comparator that compares the given program execution trace data with data indicative of a normal operation of the computer system; and
a device for outputting a given indication based on the comparison between the given program execution trace data and the data indicative of the normal operation of the computer system;
wherein the given indication is indicative of an anomalous behavior resulting from a security violation in the computer system.
4. A method of determining whether an intrusion has occurred at a given computer system having given hardware and given software, comprising:
instrumenting the given hardware or the given software;
using the instrumented hardware or software, monitoring an operating environment of the computer system as the computer system operates and in response thereto generating program execution trace data, wherein the monitoring step is performed remotely from the computer system;
comparing the given program execution trace data with data indicative of a normal operation of the computer system to determine whether an intrusion has occurred; and
based on the comparison that determines that an intrusion has occurred, outputting an alarm or updating data indicative of the normal operation of the computer system.