An observation paradigm that works with a collection of the abovementioned
elements, to provide a way of observing information infrastructures and
data movement in a chosen time frame. The user (human observer) is
provided sophisticated controls and interaction mechanisms that will make
it easier for them to detect computer network intrusion and critical
security management events in real time as well as allow them to better
analyze past events. Embodiments may include various combinations of a
framework for "intelligent agents"; an event handling system and a
high-performance multi-layer observation facility presenting the user
with a semantically dense depiction of an information source under
consideration, such as a computer network.