IDSRadar:a real-time visualization framework for IDS alerts

被引：0

作者：

ZHAO Ying ^{[1
]}

ZHOU FangFang ^{[1
]}

FAN XiaoPing ^{[1
,2
]}

LIANG Xing ^{[1
]}

LIU YongGang ^{[1
]}

机构：

[1] Information Science and Engineering School,Central South University

[2] Laboratory of Networked Systems,Hunan University of Finance & Economics

来源：

Science China(Information Sciences) | 2013年 / 56卷 / 08期

基金：

中国国家自然科学基金;

关键词：

visual analytics; information visualization; cyber security; IDS log; entropy;

D O I：

暂无

中图分类号：

TP393.08 [];

学科分类号：

0839 ; 1402 ;

摘要：

Intrusion Detection Systems(IDS) is an automated cyber security monitoring system to sense malicious activities.Unfortunately,IDS often generates both a considerable number of alerts and false positives in IDS logs.Information visualization allows users to discover and analyze large amounts of information through visual exploration and interaction efficiently.Even with the aid of visualization,identifying the attack patterns and recognizing the false positives from a great number of alerts are still challenges.In this paper,a novel visualization framework,IDSRadar,is proposed for IDS alerts,which can monitor the network and perceive the overall view of the security situation by using radial graph in real-time.IDSRadar utilizes five categories of entropy functions to quantitatively analyze the irregular behavioral patterns,and synthesizes interactions,filtering and drill-down to detect the potential intrusions.In conclusion,IDSRadar is used to analyze the mini-challenges of the VAST challenge 2011 and 2012.

引用

页码：216 / 227

页数：12

共 4 条

[1] Internet Traffic Behavior Profiling for Network Security Monitoring [J].

Xu, Kuai ;

Zhang, Zhi-Li ;

Bhattacharyya, Supratik .

IEEE-ACM TRANSACTIONS ON NETWORKING, 2008, 16 (06) :1241-1252

[2]

Network intrusion visualization with NIVA, an intrusion detection visual analyzer with haptic integration .2 K Nyarko,T Capers,C Scott et al. Haptic Interfaces for Virtual Environment and Teleoperator Systems . 2002

[3]

IDGraphs: Intrusion Detection and Analysis Using Histographs .2 Pin Ren,Y.G,Zhichun Li,Yan Chen,Benjamin Watson. VizSEC: Proceedings of the IEEE Workshop on Visualization for Computer Security . 2005

[4]

SnortView:Visualization systems of snort logs .2 H. Koike,K. Ohno. 2004 ACM workshop on Visulization and data mining for computer security . 2004

← 1 →