MonitoringNetworkTraffic withradialtrafficanalyzer DanielA.KeimFlorianMansmannJörnSchneidewindTobiasSchreck IEEESymposiumonVisualAnalyticsScienceandTechnology,2006 StefanHeinz SeminarVisualAnalytics SummerTerm2008
Motivation Internethasbecometheinformationmediumoffirst resort Eachhostonthenetworkfacesdifferentthreatsinthis environment Maliciouscode Denial of serviceattacks Attemptstohijackamachine
Motivation Howcanweidentifysuchthreats? Whatkindofdataistransferredbetweenmycomputer andothercomputersonthenetwork? localnetwork localhost internet
Motivation NetworkMonitoring Surveillanceofimportantperformancemetrics Goal:supervisefunctionality,detectandprevent potentialproblems,developeffectivecounter measuresforanomaliesandsabotage
DataSet Communicationdataiscomplex Largeamountsofdata Real timedata Interrelationshipsbetweencommunication connections Relationshipsmayvaryovertime
DataSet TechnicalBackground TCP/IPReferenceModel 1 ApplicationLayer 2 PresentationLayer 3 SessionLayer 4 TransportLayer 5 NetworkLayer 6 DataLinkLayer 7 PhysicalLayer 1 ApplicationLayer 2 PresentationLayer 3 SessionLayer 4 TransportLayer 5 NetworkLayer 6 DataLinkLayer 7 PhysicalLayer
DataSet TechnicalBackground TCP/IPReferenceModel 1 ApplicationLayer 2 PresentationLayer 3 SessionLayer 4 TransportLayer 5 NetworkLayer 6 DataLinkLayer 7 PhysicalLayer allowsmappingtoapplications packetlevel TCP,UDP IP Ports IP Address MAC Address 80(http) 192.168.23.42
DataSet Attributes Time SourceIPaddress&port DestinationIPaddress&port Payload
RelatedWork StephenLau TheSpinningCube ofpotentialdoom Communicationsof thacm,2004
RelatedWork AnitaKomledietal. AUser CentricLookat Glyph BasedSecurity Visualization IEEEWorkshopon Visualizationfor ComputerSecurity, 2005
RelatedWork StefanoForestietal. VisualCorrelationof NetworkAlerts. IEEEComputer Graphicsand Applications,2006
RelatedWork Howdoesthisapproachdifferfromtheseworks? Bringtogetherthecomplementingpiecesof information Easierreadingandinterpretation Easier to understandmetaphors
RadialTrafficAnalyzer Layout Attributesaremappedto differentrings Userselectsimportant attributestobedisplayed intheinnerrings Frominsidetooutsidethe attributesareused successivelyforgrouping andsorting
RadialTrafficAnalyzer Whyaradiallayout? Supportsbetterthetaskoffindingsuspiciouspatterns Userisnotmisguidedtoplacemoreimportanceonan itemduetoitspositionsontheleftorright
ColoringConcept Specialcolors Brightnessfor secure/unsecured Usesdistinctcolors foripadressesand ports
RadialTrafficAnalyzer Interactivity Positioningandthusimportancewithinthesorting ordercanbechangedusingdrag&dropoperations Tooltipsareusedtodisplaythefulllabelincaseof smallsegmentsandadditionalinformation(hostname, possibleapplicationprograms)
RadialTrafficAnalyzer Interactivity Detailedinformationforasegmentisaccessibleusing apopupmenu Differentmeasures:transferredbytes,numberof connections,numberofsessions Mouseclickfilters/discardsalltrafficwiththechosen attribute
RadialTrafficAnalyzer Flexibility
CombiningRTAwithGeospatialDisplays IdeaforHistoMap RetrievecountrynamesforIPaddressesusing Maxmind'sGeoIPDatabase Usesquarifiedtreemaplayout Sizeofrectanglescorrespondstotrafficvolume
CombiningRTAwithGeospatialDisplays
InteractiveExplorationofDataTrafficwith HierarchicalNetworkMaps FlorianMansmannSvetlanaVinnik IEEETransactionsonVisualizationandComputerGraphics,2006
HierarchicalNetworkMaps Displaythedistributionofsourceandtargetdatatraffic ofnetworknodes Visualizationofportactivity Alsoaspace fillingtechniquetreemap
HierarchicalNetworkMaps
HierarchicalNetworkMaps Layout Squarifiedtreemap Togetanalmoststaticmaplayout,thetotalsizeofthe networkanditscomponentsisused(userorientation) Nodesoncontinentandcountrylevelpreservetheir relativegeographicalposition NodesontheotherlevelsaresortedbyIPaddresses
HierarchicalNetworkMaps
HierarchicalNetworkMaps
HierarchicalNetworkMaps Filters Typeofload(packetssent,receivedortotal) Timeframe Portorportcluster Protocol
HierarchicalNetworkMaps Largeamountsofdata Itturnedouttobeinfeasibletoprocesstheentire networkdata Aggregationentrieswereused(#sessions,#packets transferred,bytestransferred) Usageofdatawarehousetechniques(OLAPcubes) SplitthelogintoaShortTermLog,MiddleTermLogand LongTermLog
HierarchicalNetworkMaps DescendingtothePixelLevel
HierarchicalNetworkMaps Interaction Usercanchoosewhichregionofthenetworkshould beinvestigatedfurther Drill down/roll up Additionalinformationviapopupmenu(interactive time,host,andportactivitydiagrams)
HierarchicalNetworkMaps
HierarchicalNetworkMaps Pros Integrationofgeographicalinformationwithaclever layout Nicedataoverview Cons Needsalotofdisplayspacedependingonthe granularitylevel Integrationofdetails
CombiningRTAwithGeospatialDisplays
RadialTrafficAnalyzer Animationovertime
RadialTrafficAnalyzer Animationovertime
RadialTrafficAnalyzer Animationovertime
RadialTrafficAnalyzer Animationovertime
RadialTrafficAnalyzer Classification
RadialTrafficAnalyzer Pros Easymetaphor(e.g.fastperceptionofthetraffic composition) Goodcolorscheme Combinationofmachinetechniquesandhuman capabilities
RadialTrafficAnalyzer Cons Displayspace/useoftooltips(especiallywhen displayingbothvisualizationsatonce) Noexplanationofthedatapreprocessingand performance
Summary