Visualization for Network Traffic Monitoring & Security

Size: px
Start display at page:

Download "Visualization for Network Traffic Monitoring & Security"

Transcription

1 Visualization for Network Traffic Monitoring & Security Erwan ISIT/KYUSHU, Supélec 2006

2 Plan Visualization Visualization Host based Network based Between networks Other prototypes Pre-processing PGVis PGVis3D

3 Introduction Network security Computer networks: targets of a large scale of attacks. Network traffic analysis and network traffic monitoring: a way to detect and maybe prevent these attacks. But, the data to process is really huge! A solution? To take advantage of human visual processing and pattern recognition.

4 Visualization techniques Several classifications By the data type and the task to perform with the data [Shneiderman, 1996]. By the data type and the steps to perform in order to create the visualization [Chi, 2000]. A mantra! "Overview first, zoom and filter, then details-on-demand".

5 Network traffic analysis Host based Network based Between networks Other prototypes Pre-processing Modus operandi Capture the raw traffic of the network through various kind of probes. Usually, automatic processing (optional), then text-based display of the data. For the visualization, quite the same: direct visualization or pre-processing. Classification of the visualization systems By the level from which they consider the network.

6 EtherApe Visualization Host based Network based Between networks Other prototypes Pre-processing

7 Host based Network based Between networks Other prototypes Pre-processing VISUAL [Ball et al., 2004]

8 Host based Network based Between networks Other prototypes Pre-processing NVisionIP [Lakkaraju et al., 2004]

9 Between networks Visualization Host based Network based Between networks Other prototypes Pre-processing Few prototypes... Visualization system based on BGP routing protocol analysis [Teoh et al., 2004].

10 Host based Network based Between networks Other prototypes Pre-processing PortVis [McPherson et al., 2004] Features Disclose as little information as possible on network topology. Data aggregation by TCP ports.

11 Host based Network based Between networks Other prototypes Pre-processing "Spinning cube of potential doom" [Lau, 2004]

12 PGVis PGVis3D PGVis Interactive grid system Two groups of two grids that represent several parts of the network. One group stands for the monitored network. The other group stands for the "outside" network. Grids are colored according to network activity. The network traffic is displayed by colored lines joining the different grids parts.

13 Common traffic Visualization PGVis PGVis3D

14 Portscan Visualization PGVis PGVis3D

15 PGVis PGVis3D BitTorrent traffic (two different BitTorrent files)

16 PGVis PGVis3D PGVis3D Some usability and scalability issues with PGVis... Try to combine 2D and 3D representations of the network to solve those issues extension of PGVis. 3D representation: textured cubes standing for selected network zones. 2D representation: interactive grids similar to the ones used in PGVis.

17 PGVis3D (common traffic) PGVis PGVis3D

18 Future work? Finalize the current prototypes. IPv6 mapping.

19 Questions-answers Visualization Any questions?

20 Appendix Bibliography Bibliography I Ball, R., Fink, G. A., and North, C. (2004). Home-centric visualization of network traffic for security administration. In VizSEC/DMSEC 04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, pages 55 64, New York, NY, USA. ACM Press. Chi, E. H. (2000). A taxonomy of visualization techniques using the data state reference model. In INFOVIS 00: Proceedings of the IEEE Symposium on Information Vizualization 2000, page 69, Washington, DC, USA. IEEE Computer Society. Lakkaraju, K., Yurcik, W., and Lee, A. J. (2004). Nvisionip: netflow visualizations of system state for security situational awareness. In VizSEC/DMSEC 04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, pages 65 72, New York, NY, USA. ACM Press. Lau, S. (2004). The spinning cube of potential doom. Commun. ACM, 47(6): McPherson, J., Ma, K.-L., Krystosk, P., Bartoletti, T., and Christensen, M. (2004). Portvis: a tool for port-based detection of security events. In VizSEC/DMSEC 04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, pages 73 81, New York, NY, USA. ACM Press.

21 Appendix Bibliography Bibliography II Shneiderman, B. (1996). The eyes have it: A task by data type taxonomy for information visualizations. In VL, pages Teoh, S. T., Ma, K.-L., Wu, S. F., and Jankun-Kelly, T. J. (2004). Detecting flaws and intruders with visual data analysis. IEEE Comput. Graph. Appl., 24(5):27 35.

An Adaptable Innovative Visualization For Multiple Levels of Users

An Adaptable Innovative Visualization For Multiple Levels of Users World Applied Sciences Journal 15 (5): 722-727, 2011 ISSN 1818-4952 IDOSI Publications, 2011 An Adaptable Innovative Visualization For Multiple Levels of Users Doris Hooi-Ten Wong and Sureswaran Ramadass

More information

A Visualization Technique for Monitoring of Network Flow Data

A Visualization Technique for Monitoring of Network Flow Data A Visualization Technique for Monitoring of Network Flow Data Manami KIKUCHI Ochanomizu University Graduate School of Humanitics and Sciences Otsuka 2-1-1, Bunkyo-ku, Tokyo, JAPAPN manami@itolab.is.ocha.ac.jp

More information

NVisionIP: An Interactive Network Flow Visualization Tool for Security

NVisionIP: An Interactive Network Flow Visualization Tool for Security NVisionIP: An Interactive Network Flow Visualization Tool for Security Kiran Lakkaraju William Yurcik Ratna Bearavolu Adam J. Lee National Center for Supercomputing Applications (NCSA) University of Illinois,

More information

Flamingo: Visualizing Internet Traffic

Flamingo: Visualizing Internet Traffic Flamingo: Visualizing Internet Traffic Jon Oberheide, Michael Goff, Manish Karir Networking Research and Development Merit Network Inc. Ann Arbor, MI 48104 USA {jonojono,goffm,mkarir}@merit.edu Abstract

More information

NetBytes Viewer: An Entity-based NetFlow Visualization Utility for Identifying Intrusive Behavior

NetBytes Viewer: An Entity-based NetFlow Visualization Utility for Identifying Intrusive Behavior NetBytes Viewer: An Entity-based NetFlow Visualization Utility for Identifying Intrusive Behavior Teryl Taylor, Stephen Brooks and John McHugh Abstract NetBytes Host Viewer is an interactive visualization

More information

A Novel Visualization Method for Detecting DDoS Network Attacks

A Novel Visualization Method for Detecting DDoS Network Attacks A Novel Visualization Method for Detecting DDoS Network Attacks Jiawan Zhang 1, Guoqiang Yang 1, Liangfu Lu 2,*, Mao Lin Huang 3, 1. School of Computer Science and Technology, Tianjin University, Tianjin,P.R.China;

More information

Cyber Security Through Visualization

Cyber Security Through Visualization Cyber Security Through Visualization Kwan-Liu Ma Department of Computer Science University of California at Davis Email: ma@cs.ucdavis.edu Networked computers are subject to attack, misuse, and abuse.

More information

Interactive Visualization for Network and Port Scan Detection

Interactive Visualization for Network and Port Scan Detection Interactive Visualization for Network and Port Scan Detection Chris Muelder 1, Kwan-Liu Ma 1, and Tony Bartoletti 2 1 University of California, Davis 2 Lawrence Livermore National Laboratory Abstract.

More information

NVisionIP and VisFlowConnect-IP: Two Tools for Visualizing NetFlows for Security

NVisionIP and VisFlowConnect-IP: Two Tools for Visualizing NetFlows for Security NVisionIP and VisFlowConnect-IP: Two Tools for Visualizing NetFlows for Security William Yurcik National Center for Supercomputing Applications (NCSA) University of Illinois at

More information

Simplified Network Traffic Visualization for Real-Time Security Analysis

Simplified Network Traffic Visualization for Real-Time Security Analysis Simplified Network Traffic Visualization for Real-Time Security Analysis Matthew Dean and Lucas Vespa Department of Computer Science University of Illinois Springfield Springfield, IL 62703 Abstract Although

More information

Visual Support for Analyzing Network Traffic and Intrusion Detection Events using TreeMap and Graph Representations

Visual Support for Analyzing Network Traffic and Intrusion Detection Events using TreeMap and Graph Representations Visual Support for Analyzing Network Traffic and Intrusion Detection Events using TreeMap and Graph Representations Florian Mansmann 1 Fabian Fischer 1 Daniel A. Keim 1 Stephen C. North 2 1 University

More information

VisFlowConnect-IP: A Link-Based Visualization of NetFlows for Security Monitoring

VisFlowConnect-IP: A Link-Based Visualization of NetFlows for Security Monitoring VisFlowConnect-IP: A Link-Based Visualization of NetFlows for Security Monitoring William Yurcik National Center for Supercomputing Applications (NCSA) University of Illinois at Urbana-Champaign byurcik@ncsa.uiuc.edu

More information

A Framework for Effective Alert Visualization. SecureWorks 11 Executive Park Dr Atlanta, GA 30329 {ubanerjee, jramsey}@secureworks.

A Framework for Effective Alert Visualization. SecureWorks 11 Executive Park Dr Atlanta, GA 30329 {ubanerjee, jramsey}@secureworks. A Framework for Effective Alert Visualization Uday Banerjee Jon Ramsey SecureWorks 11 Executive Park Dr Atlanta, GA 30329 {ubanerjee, jramsey}@secureworks.com Abstract Any organization/department that

More information

Visual Firewall: Real-time Network Security Monitor

Visual Firewall: Real-time Network Security Monitor Visual Firewall: Real-time Network Security Monitor Chris P. Lee Georgia Tech CSC Jason Trost Georgia Tech CS Dept Nicholas Gibbs Georgia Tech CS Dept Raheem Beyah Georgia Tech CSC John A. Copeland Georgia

More information

Massachusetts Institute of Technology Department of Electrical Engineering and Computer Science. Master of Engineering Thesis Proposal

Massachusetts Institute of Technology Department of Electrical Engineering and Computer Science. Master of Engineering Thesis Proposal Massachusetts Institute of Technology Department of Electrical Engineering and Computer Science Master of Engineering Thesis Proposal Title: Submitted by: FireViz: A Personal Network Firewall Visualizing

More information

Preserving the Big Picture: Visual Network Traffic Analysis with TNV

Preserving the Big Picture: Visual Network Traffic Analysis with TNV Preserving the Big Picture: Visual Network Traffic Analysis with TNV John R. Goodall Wayne G. Lutters Penny Rheingans Anita Komlodi University of Maryland, Baltimore County ABSTRACT When performing packet-level

More information

Preserving the Big Picture: Visual Network Traffic Analysis with TNV

Preserving the Big Picture: Visual Network Traffic Analysis with TNV Preserving the Big Picture: Visual Network Traffic Analysis with TNV John R. Goodall Wayne G. Lutters Penny Rheingans Anita Komlodi University of Maryland, Baltimore County ABSTRACT When performing packet-level

More information

Flexible Web Visualization for Alert-Based Network Security Analytics

Flexible Web Visualization for Alert-Based Network Security Analytics Flexible Web Visualization for Alert-Based Network Security Analytics Lihua Hao Department of Computer Science North Carolina State University lhao2@ncsu.edu Christopher G. Healey Department of Computer

More information

Applying Information Visualization to Computer Security Applications

Applying Information Visualization to Computer Security Applications Utah State University DigitalCommons@USU All Graduate Theses and Dissertations Graduate Studies, School of 5-1-2010 Applying Information Visualization to Computer Security Applications Robert Bruce Whitaker

More information

Visualization of Host Behavior for Network Security

Visualization of Host Behavior for Network Security Visualization of Host Behavior for Network Security Florian Mansmann, Lorenz Meier, and Daniel A. Keim Abstract Monitoring host behavior in a network is one of the most essential tasks in the fields of

More information

A Visualization Methodology for Characterization of Network Scans

A Visualization Methodology for Characterization of Network Scans A Visualization Methodology for Characterization of Network Scans Chris Muelder University of California, Davis Kwan-Liu Ma University of California, Davis Tony Bartoletti Lawrence Livermore National Laboratory

More information

Focusing on Context in Network Traffic Analysis

Focusing on Context in Network Traffic Analysis Focusing on Context in Network Traffic Analysis John R. Goodall, Wayne G. Lutters, Penny Rheingans, and Anita Komlodi University of Maryland, Baltimore County With network size and complexity continuously

More information

Cisco IOS Flexible NetFlow Technology

Cisco IOS Flexible NetFlow Technology Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application

More information

Visualization of Host Behavior for Network Security

Visualization of Host Behavior for Network Security Visualization of Host Behavior for Network Security Florian Mansman, Lorenz Meier, and Daniel A. Keim Abstract Monitoring host behavior in a network is one of the most essential tasks in the fields of

More information

VIAssist: Visual Analytics for Cyber Defense

VIAssist: Visual Analytics for Cyber Defense VIAssist: Visual Analytics for Cyber Defense John R. Goodall, Member, IEEE and Mark Sowul Abstract Analysis of voluminous computer network data has become a common practice for cyber defense, but few tools

More information

Visual Correlation of Host Processes and Network Traffic

Visual Correlation of Host Processes and Network Traffic Visual Correlation of Host Processes and Network Traffic Glenn A. Fink 1, Paul Muessig 2, and Chris North 3 Dept. of Computer Science, Virginia Polytechnic Institute and State University Blacksburg, Virginia,

More information

VisFlowCluster-IP: Connectivity-Based Visual Clustering of Network Hosts

VisFlowCluster-IP: Connectivity-Based Visual Clustering of Network Hosts VisFlowCluster-IP: Connectivity-Based Visual Clustering of Network Hosts Xiaoxin Yin, William Yurcik, and Adam Slagell National Center for Supercomputing Applications (NCSA) University of Illinois at Urbana-Champaign

More information

Visual Network Forensic Techniques and Processes

Visual Network Forensic Techniques and Processes Visual Network Forensic Techniques and Processes Robert F. Erbacher, Member IEEE, Kim Christiansen, Amanda Sundberg Department of Computer Science, Utah State University, Logan, UT 84322 Abstract Network

More information

A Visualization Paradigm for Network Intrusion Detection

A Visualization Paradigm for Network Intrusion Detection Proceedings of the 2005 IEEE Workshop on Information Assurance and Security United States Military Academy, West Point, NY, 17 19 June 2005 A Visualization Paradigm for Network Intrusion Detection Yarden

More information

Flow Analysis. Make A Right Policy for Your Network. GenieNRM

Flow Analysis. Make A Right Policy for Your Network. GenieNRM Flow Analysis Make A Right Policy for Your Network GenieNRM Why Flow Analysis? Resolve Network Managers Challenge as follow: How can I know the Detail and Real-Time situation of my network? How can I do

More information

Visual Exploration of Malicious Network Objects Using Semantic Zoom, Interactive Encoding and Dynamic Queries

Visual Exploration of Malicious Network Objects Using Semantic Zoom, Interactive Encoding and Dynamic Queries Visual Exploration of Malicious Network Objects Using Semantic Zoom, Interactive Encoding and Dynamic Queries Gregory Conti, Julian Grizzard, Mustaque Ahamad and Henry Owen Georgia Institute of Technology

More information

Visual Exploration of Malicious Network Objects Using Semantic Zoom, Interactive Encoding and Dynamic Queries

Visual Exploration of Malicious Network Objects Using Semantic Zoom, Interactive Encoding and Dynamic Queries Visual Exploration of Malicious Network Objects Using Semantic Zoom, Interactive Encoding and Dynamic Queries Gregory Conti, Julian Grizzard, Mustaque Ahamad and Henry Owen Georgia Institute of Technology

More information

Visualizing Repertory Grid Data for Formative Assessment

Visualizing Repertory Grid Data for Formative Assessment Visualizing Repertory Grid Data for Formative Assessment Kostas Pantazos 1, Ravi Vatrapu 1, 2 and Abid Hussain 1 1 Computational Social Science Laboratory (CSSL) Department of IT Management, Copenhagen

More information

A User Centered Approach for the Design and Evaluation of Interactive Information Visualization Tools

A User Centered Approach for the Design and Evaluation of Interactive Information Visualization Tools A User Centered Approach for the Design and Evaluation of Interactive Information Visualization Tools Sarah Faisal, Paul Cairns, Ann Blandford University College London Interaction Centre (UCLIC) Remax

More information

Safely Sharing Data Between CSIRTs: The SCRUB* Security Anonymization Tool Infrastructure

Safely Sharing Data Between CSIRTs: The SCRUB* Security Anonymization Tool Infrastructure Safely Sharing Data Between CSIRTs: The SCRUB* Security Anonymization Tool Infrastructure William Yurcik* Clay Woolam, Greg Hellings, Latifur Khan, Bhavani Thuraisingham University

More information

Security Visualization Past, Present, Future

Security Visualization Past, Present, Future Security Visualization Past, Present, Future Greg Conti West Point @cyberbgone http://dl.acm.org/citation.cfm?id=2671501 http://link.springer.com/chapter/10.1007%2f978-3-540-85933-8_11 http://images.cdn.stuff.tv/sites/stuff.tv/files/styles/big-image/public/25-best-hacker-movies-ever-the-matrix.jpg?itok=kiwtknw1

More information

Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA

Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA What is ReporterAnalyzer? ReporterAnalyzer gives network professionals insight into how application traffic is impacting network performance.

More information

Data Visualization Principles: Interaction, Filtering, Aggregation

Data Visualization Principles: Interaction, Filtering, Aggregation Data Visualization Principles: Interaction, Filtering, Aggregation CSC444 Acknowledgments for today s lecture: What if there s too much data? Sometimes you can t present all the data in a single plot (Your

More information

Flexible Web Visualization for Alert-Based Network Security Analytics

Flexible Web Visualization for Alert-Based Network Security Analytics Flexible Web Visualization for Alert-Based Network Security Analytics Lihua Hao 1, Christopher G. Healey 1, Steve E. Hutchinson 2 1 North Carolina State University, 2 U.S. Army Research Laboratory lhao2@ncsu.edu

More information

Conceptual Integration of Flow-based and Packet-based Network Intrusion Detection

Conceptual Integration of Flow-based and Packet-based Network Intrusion Detection Conceptual Integration of Flow-based and Packet-based Network Intrusion Detection Gregor Schaffrath, Burkhard Stiller Department of Informatics IFI, University of Zürich Communication Systems Group CSG

More information

Visual Data Exploration Techniques for System Administration. Tam Weng Seng

Visual Data Exploration Techniques for System Administration. Tam Weng Seng Visual Data Exploration Techniques for System Administration Tam Weng Seng Abstract The objective of this paper is to study terminology used in visual data exploration and to apply them to projects in

More information

Intelligent Classification and Visualization of Network Scans

Intelligent Classification and Visualization of Network Scans UCRL-CONF-228878 Intelligent Classification and Visualization of Network Scans L. Chen, C. Muelder, K. Ma, A. Bartoletti March 9, 2007 ACM SIGKDD 2007 San Jose, CA, United States August 12, 2007 through

More information

Monitoring Network Traffic with Radial Traffic Analyzer

Monitoring Network Traffic with Radial Traffic Analyzer Monitoring Network Traffic with Radial Traffic Analyzer Daniel A. Keim Florian Mansmann Jörn Schneidewind Tobias Schreck Databases and Visualization Group University of Konstanz, Germany {keim,mansmann,schneide,schreck}@inf.uni-konstanz.de

More information

1 Log visualization at CNES (Part II)

1 Log visualization at CNES (Part II) 1 Log visualization at CNES (Part II) 1.1 Background For almost 2 years now, CNES has set up a team dedicated to "log analysis". Its role is multiple: This team is responsible for analyzing the logs after

More information

A LITERATURE REVIEW OF NETWORK MONITORING THROUGH VISUALISATION AND THE INETVIS TOOL

A LITERATURE REVIEW OF NETWORK MONITORING THROUGH VISUALISATION AND THE INETVIS TOOL A LITERATURE REVIEW OF NETWORK MONITORING THROUGH VISUALISATION AND THE INETVIS TOOL Christopher Schwagele Supervisor: Barry Irwin Computer Science Department, Rhodes University 29 July 2010 Abstract Network

More information

Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization

Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization Sven Krasser, Member, IEEE; Gregory Conti, Member, IEEE; Julian Grizzard, Member, IEEE; Jeff Gribschaw, Member,

More information

A Software Tool for Multi-Field Multi-Level NetFlows Anonymization. University of Texas at Dallas

A Software Tool for Multi-Field Multi-Level NetFlows Anonymization. University of Texas at Dallas A Software Tool for Multi-Field Multi-Level NetFlows Anonymization William Yurcik Clay Woolam, Latifur Khan, Bhavani Thuraisingham University of Texas at Dallas

More information

Visual Analysis of Complex Firewall Configurations

Visual Analysis of Complex Firewall Configurations Visual Analysis of Complex Firewall Configurations Florian Mansmann University of Konstanz Florian.Mansmann@unikonstanz.de Timo Göbel University of Konstanz timo.goebel@timogoebel.eu William Cheswick ches@cheswick.com

More information

TEXT-FILLED STACKED AREA GRAPHS Martin Kraus

TEXT-FILLED STACKED AREA GRAPHS Martin Kraus Martin Kraus Text can add a significant amount of detail and value to an information visualization. In particular, it can integrate more of the data that a visualization is based on, and it can also integrate

More information

Tudumi: Information Visualization System for Monitoring and Auditing Computer Logs

Tudumi: Information Visualization System for Monitoring and Auditing Computer Logs Tudumi: Information Visualization System for Monitoring and Auditing Computer Logs Tetsuji Takada Satellite Venture Business Lab. University of Electro-Communications zetaka@computer.org Hideki Koike Graduate

More information

Identifying Patterns in DNS Traffic

Identifying Patterns in DNS Traffic Identifying Patterns in DNS Traffic Pieter Lexis System and Network Engineering Thu, Jul 4 2013 Reflection and Amplification Attacks DNS abused as DDoS Tool Spamhaus hit with 300 Gigabit/second DDoS Reflected

More information

Real-Time Interactive Visual Port Monitoring and Analysis

Real-Time Interactive Visual Port Monitoring and Analysis Real-Time Interactive Visual Port Monitoring and Analysis Robert F. Erbacher 1 and Menashe Garber 2 1 Utah State University, Dept. of Computer Science, UMC 4205, Logan, UT 84322, Phone: 435-797-3291, Fax:

More information

Efficiently Managing Firewall Conflicting Policies

Efficiently Managing Firewall Conflicting Policies Efficiently Managing Firewall Conflicting Policies 1 K.Raghavendra swamy, 2 B.Prashant 1 Final M Tech Student, 2 Associate professor, Dept of Computer Science and Engineering 12, Eluru College of Engineeering

More information

Interactive Information Visualization of Trend Information

Interactive Information Visualization of Trend Information Interactive Information Visualization of Trend Information Yasufumi Takama Takashi Yamada Tokyo Metropolitan University 6-6 Asahigaoka, Hino, Tokyo 191-0065, Japan ytakama@sd.tmu.ac.jp Abstract This paper

More information

D H T WONG et al: AN AUTOMATED ALGORITHM IN DATA VISUALIZATION...

D H T WONG et al: AN AUTOMATED ALGORITHM IN DATA VISUALIZATION... An Automated Algorithm In Data Visualization For Large Network Data: A Review And An Initial Study Doris Hooi-Ten Wong National Advanced IPv6 Centre (NAv6) Universiti Sains Malaysia 11800, Penang, MALAYSIA

More information

SpiralView: Towards Security Policies Assessment through Visual Correlation of Network Resources with Evolution of Alarms

SpiralView: Towards Security Policies Assessment through Visual Correlation of Network Resources with Evolution of Alarms SpiralView: Towards Security Policies Assessment through Visual Correlation of Network Resources with Evolution of Alarms Enrico Bertini University of Fribourg Patrick Hertzog NEXThink S.A. Denis Lalanne

More information

P3D: A Parallel 3D Coordinate Visualization for Advanced Network Scans

P3D: A Parallel 3D Coordinate Visualization for Advanced Network Scans P3D: A Parallel 3D Coordinate Visualization for Advanced Network Scans Troy Nunnally, Penyen Chi, Kulsoom Abdullah, A. Selcuk Uluagac, John A. Copeland, and Raheem Beyah CSC Lab., The School of ECE GT

More information

Visual Analysis of Network Flow Data with Timelines and Event Plots

Visual Analysis of Network Flow Data with Timelines and Event Plots Visual Analysis of Network Flow Data with Timelines and Event Plots Doantam Phan, John Gerth, Marcia Lee, Andreas Paepcke, Terry Winograd Department of Computer Science, Stanford University Abstract This

More information

Visual Correlation of Network Alerts

Visual Correlation of Network Alerts Visualization for Cybersecurity Visual Correlation of Network Alerts Stefano Foresti, James Agutter, Yarden Livnat, and Shaun Moon University of Utah Robert Erbacher Utah State University Society s dependence

More information

Network Stack Diagnosis and Visualization Tool

Network Stack Diagnosis and Visualization Tool Network Stack Diagnosis and Visualization Tool Krist Wongsuphasawat, Pornpat Artornsombudh, Bao Nguyen, and Justin McCann University of Maryland, College Park, MD 20742 kristw@cs.umd.edu, apornpat@umd.edu,

More information

RiskLab. Discussion: Peter Sarlin. Visual Network Analysis in the Regulation of Financial Systemic Risk

RiskLab. Discussion: Peter Sarlin. Visual Network Analysis in the Regulation of Financial Systemic Risk Discussion: Visual Network Analysis in the Regulation of Financial Systemic Risk The Application of Visual Analytics to Financial Stability Monitoring Peter Sarlin Goethe University Frankfurt and European

More information

Enhancing Visual Analysis of Network Traffic Using a Knowledge Representation

Enhancing Visual Analysis of Network Traffic Using a Knowledge Representation Enhancing Visual Analysis of Network Traffic Using a Knowledge Representation Ling Xiao* John Gerth* Pat Hanrahan* Stanford University ABSTRACT This paper presents a network traffic analysis system that

More information

Sharing Intelligence is our Best Defense: Cyber Security Today Is a bit Like the Keystone Cops

Sharing Intelligence is our Best Defense: Cyber Security Today Is a bit Like the Keystone Cops Sharing Intelligence is our Best Defense: Incentives That Work versus Disincentives That Can Be Solved William Yurcik* Adam Slagell Jun Wang NCSA Security Research (NCSA) University of Illinois at Urbana-Champaign

More information

Overview. Security System Administration

Overview. Security System Administration Better Tools for System Administration: Enhancing the Human-Computer Interface with Visualization Bill Yurcik Manager, NCSA Security Research National Center for Advanced Secure

More information

Security visualisation

Security visualisation Security visualisation This thesis provides a guideline of how to generate a visual representation of a given dataset and use visualisation in the evaluation of known security vulnerabilities by Marco

More information

Abstract. Introduction

Abstract. Introduction CODATA Prague Workshop Information Visualization, Presentation, and Design 29-31 March 2004 Abstract Goals of Analysis for Visualization and Visual Data Mining Tasks Thomas Nocke and Heidrun Schumann University

More information

Network Monitoring and Traffic CSTNET, CNIC

Network Monitoring and Traffic CSTNET, CNIC Network Monitoring and Traffic Analysis in CSTNET Chunjing Han Aug. 2013 CSTNET, CNIC Topics 1. The background of network monitoring 2. Network monitoring protocols and related tools 3. Network monitoring

More information

Hadoop Technology for Flow Analysis of the Internet Traffic

Hadoop Technology for Flow Analysis of the Internet Traffic Hadoop Technology for Flow Analysis of the Internet Traffic Rakshitha Kiran P PG Scholar, Dept. of C.S, Shree Devi Institute of Technology, Mangalore, Karnataka, India ABSTRACT: Flow analysis of the internet

More information

131-1. Adding New Level in KDD to Make the Web Usage Mining More Efficient. Abstract. 1. Introduction [1]. 1/10

131-1. Adding New Level in KDD to Make the Web Usage Mining More Efficient. Abstract. 1. Introduction [1]. 1/10 1/10 131-1 Adding New Level in KDD to Make the Web Usage Mining More Efficient Mohammad Ala a AL_Hamami PHD Student, Lecturer m_ah_1@yahoocom Soukaena Hassan Hashem PHD Student, Lecturer soukaena_hassan@yahoocom

More information

Visualizing NetFlows for Security at Line Speed: The SIFT Tool Suite

Visualizing NetFlows for Security at Line Speed: The SIFT Tool Suite Visualizing NetFlows for Security at Line Speed: The SIFT Tool Suite William Yurcik National Center for Supercomputing Applications (NCSA) ABSTRACT The first step in improving Internet security is measurement

More information

The Use of Information Visualization to Support Software Configuration Management *

The Use of Information Visualization to Support Software Configuration Management * The Use of Information Visualization to Support Software Configuration Management * Roberto Therón 1, Antonio González 1, Francisco J. García 1, Pablo Santos 2 1 Departamento de Informática y Automática,

More information

Vincent F. Mancuso College of Information Sciences and Technology The Pennsylvania State University vfm105@ist.psu.edu

Vincent F. Mancuso College of Information Sciences and Technology The Pennsylvania State University vfm105@ist.psu.edu Large Scale Network Security Visualization Nicklaus A. Giacobe College of Information Sciences and Technology The Pennsylvania State University nxg13@ist.psu.edu Vincent F. Mancuso College of Information

More information

VisFlowConnect: NetFlow Visualizations of Link Relationships for Security Situational Awareness

VisFlowConnect: NetFlow Visualizations of Link Relationships for Security Situational Awareness VisFlowConnect: NetFlow Visualizations of Link Relationships for Security Situational Awareness Xiaoxin Yin National Center for Supercomputing Applications (NCSA) University of Illinois at Urbana-Champaign

More information

PolicyVis: Firewall Security Policy Visualization and Inspection

PolicyVis: Firewall Security Policy Visualization and Inspection PolicyVis: Firewall Security Policy Visualization and Inspection Tung Tran, Ehab Al-Shaer, and Raouf Boutaba University of Waterloo, Canada ABSTRACT Firewalls have an important role in network security.

More information

Hierarchical Data Visualization. Ai Nakatani IAT 814 February 21, 2007

Hierarchical Data Visualization. Ai Nakatani IAT 814 February 21, 2007 Hierarchical Data Visualization Ai Nakatani IAT 814 February 21, 2007 Introduction Hierarchical Data Directory structure Genealogy trees Biological taxonomy Business structure Project structure Challenges

More information

TOWARDS CLASSIFYING AND SELECTING APPROPRIATE SECURITY VISUALIZATION TECHNIQUES

TOWARDS CLASSIFYING AND SELECTING APPROPRIATE SECURITY VISUALIZATION TECHNIQUES TOWARDS CLASSIFYING AND SELECTING APPROPRIATE SECURITY VISUALIZATION TECHNIQUES by David Barrera A thesis submitted to the Faculty of Graduate Studies and Research in partial fulfillment of the requirements

More information

OverFlow: An Overview Visualization for Network Analysis

OverFlow: An Overview Visualization for Network Analysis OverFlow: An Overview Visualization for Network Analysis Joel Glanfield glanfield@cs.dal.ca Stephen Brooks sbrooks@cs.dal.ca Teryl Taylor teryl@cs.dal.ca Diana Paterson paterson@cs.dal.ca Christopher Smith

More information

NAVSEC : A Recommender System for 3D Network Security Visualizations

NAVSEC : A Recommender System for 3D Network Security Visualizations NAVSEC : A Recommender System for 3D Network Security Visualizations Troy Nunnally CAP Group troy.nunnally@gatech.edu Kulsoom Abdullah CAP Group kulsoom@gatech.edu John A. Copeland CSC Lab jcopeland@ece.gatech.edu

More information

NfSen Plugin Supporting The Virtual Network Monitoring

NfSen Plugin Supporting The Virtual Network Monitoring NfSen Plugin Supporting The Virtual Network Monitoring Vojtěch Krmíček krmicek@liberouter.org Pavel Čeleda celeda@ics.muni.cz Jiří Novotný novotny@cesnet.cz Part I Monitoring of Virtual Network Environments

More information

Understanding Complex Network Attack Graphs through Clustered Adjacency Matrices

Understanding Complex Network Attack Graphs through Clustered Adjacency Matrices Understanding Complex Network Attack Graphs through Clustered Adjacency Matrices Steven Noel and Sushil Jajodia Center for Secure Information Systems, George Mason University {snoel, jajodia}@gmu.edu Abstract

More information

Graph Drawing for Security Visualization

Graph Drawing for Security Visualization Graph Drawing for Security Visualization Roberto Tamassia 1, Bernardo Palazzi 1,2,3, and Charalampos Papamanthou 1 1 Brown University, Department of Computer Science, Providence, RI, USA {rt,bernardo,cpap}@cs.brown.edu

More information

DAEDALUS-VIZ: Novel Real-time 3D Visualization for Darknet Monitoring-based Alert System

DAEDALUS-VIZ: Novel Real-time 3D Visualization for Darknet Monitoring-based Alert System DAEDALUS-VIZ: Novel Real-time 3D Visualization for Darknet Monitoring-based Alert System Daisuke Inoue dai@nict.go.jp Koei Suzuki koei@nict.go.jp Mio Suzuki mio@nict.go.jp Masashi Eto eto@nict.go.jp Koji

More information

Modifying first person shooter games to perform real time network monitoring and control tasks

Modifying first person shooter games to perform real time network monitoring and control tasks Modifying first person shooter games to perform real time network monitoring and control tasks Warren Harrop, Grenville Armitage {wazz,garmitage}@swin.edu.au Outline The problem Previous work Metaphors

More information

Histogram Matrix: Log File Visualization for Anomaly Detection

Histogram Matrix: Log File Visualization for Anomaly Detection Histogram Matrix: Log File Visualization for Anomaly Detection Adrian Frei Zurich University of Applied Sciences Institute of Applied Information Technology 8401 Winterthur, Switzerland af2364@columbia.edu

More information

Interactive Wormhole Detection in Large Scale Wireless Networks

Interactive Wormhole Detection in Large Scale Wireless Networks Interactive Wormhole Detection in Large Scale Wireless Networks Weichao Wang University of Kansas Aidong Lu University of North Carolina at Charlotte Abstract Wormhole attacks in wireless networks can

More information

Passive Measurement in CSTNET

Passive Measurement in CSTNET Passive Measurement in CSTNET Chunjing Han Aug. 2013 CSTNET, CNIC Topics 1. Passive measurement systems introduction in CSTNET 2. Large - scale distributed traffic analysis system in IPv6 1, Passive measurement

More information

Visualization in 4D Construction Management Software: A Review of Standards and Guidelines

Visualization in 4D Construction Management Software: A Review of Standards and Guidelines 315 Visualization in 4D Construction Management Software: A Review of Standards and Guidelines Fadi Castronovo 1, Sanghoon Lee, Ph.D. 1, Dragana Nikolic, Ph.D. 2, John I. Messner, Ph.D. 1 1 Department

More information

Home-Centric Visualization of Network Traffic for Security Administration

Home-Centric Visualization of Network Traffic for Security Administration Home-Centric Visualization of Network Traffic for Security Administration Robert Ball rgb6@cs.vt.edu Glenn A. Fink finkga@vt.edu Department of Computer Science Virginia Polytechnic Institute and State

More information

InetVis: a Graphical aid for the Detection and Visualisation of Network Scans

InetVis: a Graphical aid for the Detection and Visualisation of Network Scans InetVis: a Graphical aid for the Detection and Visualisation of Network Scans Barry V.W. Irwin and Jean-Pierre van Riel Abstract This paper presents an investigative analysis of network scans and scan

More information

Towards Visualizing mobile network data

Towards Visualizing mobile network data Towards Visualizing mobile network data Stavros Papadopoulos and Dimitrios Tzovaras Abstract This paper presents the research directions that the visualization in the NEMESYS project will follow, so as

More information

VAST: Visualizing Autonomous System Topology

VAST: Visualizing Autonomous System Topology VAST: Visualizing Autonomous System Topology Jon Oberheide Networking Research and Development Merit Network Inc. Ann Arbor, MI 48105 jonojono@umich.edu Manish Karir Networking Research and Development

More information

PolicyVis: Firewall Security Policy Visualization and Inspection

PolicyVis: Firewall Security Policy Visualization and Inspection PolicyVis: Firewall Security Policy Visualization and Inspection Tung Tran, Ehab Al-Shaer, and Raouf Boutaba University of Waterloo, Canada ABSTRACT Firewalls have an important role in network security.

More information

Crucial Nodes Centric Visual Monitoring and Analysis of Computer Networks

Crucial Nodes Centric Visual Monitoring and Analysis of Computer Networks 2012 ASE International Conference on Social Informatics (SocialInformatics 2012) / 2012 ASE International Conference on Cyber Security (CyberSecurity 2012 2012) International / 2012 ASE Conference International

More information

EFFECTIVE IMPLEMENTATION OF DYNAMIC CLASSIFICATION FOR NETWORK FORENSIC AND TRAFFIC ANALYSIS

EFFECTIVE IMPLEMENTATION OF DYNAMIC CLASSIFICATION FOR NETWORK FORENSIC AND TRAFFIC ANALYSIS EFFECTIVE IMPLEMENTATION OF DYNAMIC CLASSIFICATION FOR NETWORK FORENSIC AND TRAFFIC ANALYSIS Manu Bansal Assistant Professor Department of IT University Institute of Engineering & Technology Panjab University,

More information

Network Visualisation

Network Visualisation Network Visualisation Andreas Lodde Abstract Todays network managers and system administrators are challenged by a rapidly growing mass of status information and an increasing volume of data sent through

More information

A VISUALIZATION TOOL FOR SITUATIONAL AWARENESS OF TACTICAL AND STRATEGIC SECURITY EVENTS ON LARGE AND COMPLEX COMPUTER NETWORKS

A VISUALIZATION TOOL FOR SITUATIONAL AWARENESS OF TACTICAL AND STRATEGIC SECURITY EVENTS ON LARGE AND COMPLEX COMPUTER NETWORKS A VISUALIZATION TOOL FOR SITUATIONAL AWARENESS OF TACTICAL AND STRATEGIC SECURITY EVENTS ON LARGE AND COMPLEX COMPUTER NETWORKS R. Bearavolu K. Lakkaraju W. Yurcik H. Raje National Center for Supercomputing

More information

IDENTIFYING AND INVESTIGATING INTRUSIVE SCANNING PATTERNS BY VISUALIZING NETWORK TELESCOPE TRAFFIC IN A 3-D SCATTER-PLOT

IDENTIFYING AND INVESTIGATING INTRUSIVE SCANNING PATTERNS BY VISUALIZING NETWORK TELESCOPE TRAFFIC IN A 3-D SCATTER-PLOT IDENTIFYING AND INVESTIGATING INTRUSIVE SCANNING PATTERNS BY VISUALIZING NETWORK TELESCOPE TRAFFIC IN A 3-D SCATTER-PLOT Jean-Pierre van Riel and Barry Irwin Security and Networks Research Group Department

More information

Graph Drawing for Security Visualization

Graph Drawing for Security Visualization Graph Drawing for Security Visualization Roberto Tamassia 1, Bernardo Palazzi 123, and Charalampos Papamanthou 1 1 Brown University, Department of Computer Science, Providence, RI, USA {rt,bernardo,cpap}@cs.brown.edu

More information