Preserving the big picture: Visual network traffic analysis with TNV

被引：42

作者：

Goodall, JR ^{[1
]}

Lutters, WG ^{[1
]}

Rheingans, P ^{[1
]}

Komlodi, A ^{[1
]}

机构：

[1] Univ Maryland Baltimore Cty, Baltimore, MD 21228 USA

来源：

IEEE WORKSHOP ON VISUALIZATION FOR COMPUTER SECURITY 2005, PROCEEDINGS | 2005年

关键词：

network visualization; network analysis; information visualization; intrusion detection;

D O I：

10.1109/VIZSEC.2005.1532065

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

When performing packet-level analysis in intrusion detection, analysts often lose sight of the "big picture" while examining these low-level details. In order to prevent this loss of context and augment the available tools for intrusion detection analysis tasks, we developed an information visualization tool, the Time-based Network traffic Visualizer (TNV). TNV is grounded in an understanding of the work practices of intrusion detection analysts, particularly foregrounding the overarching importance of context and time in the process of intrusion detection analysis. The main visual component of TNV is a matrix showing network activity of hosts over time, with connections between hosts superimposed on the matrix, complemented by multiple, linked views showing port activity and the details of the raw packets. Providing low-level textual data in the context of a high-level. aggregated graphical display enables analysts to examine packet-level details within the larger context of activity. This combination has the potential to facilitate the intrusion detection analysis tasks and help novice analysts learn what constitutes "normal" on a particular network.

引用

页码：47 / 54

页数：8

共 23 条

[1]

[Anonymous], 2004, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security (New York, NY, USA), VizSEC/DMSEC '04, ACM, DOI DOI 10.1145/1029208.1029217

[2]

[Anonymous], 2002, P 8 ACM SIGKDD INT C, DOI DOI 10.1145/775047.775101

[3]

[Anonymous], 2004, P 2004 ACM WORKSH VI, DOI DOI 10.1145/1029208.1029220

[4] VISUALIZING NETWORK DATA [J].

BECKER, RA ;

EICK, SG ;

WILKS, AR .

IEEE TRANSACTIONS ON VISUALIZATION AND COMPUTER GRAPHICS, 1995, 1 (01) :16-28

[5]

Conti Gregory., 2004, P 2004 ACM WORKSHOP, P45, DOI DOI 10.1145/1029208.1029216

[6] Visual data mining: Recognizing telephone calling fraud [J].

Cox, KC ;

Eick, SG ;

Wills, GJ ;

Brachman, RJ .

DATA MINING AND KNOWLEDGE DISCOVERY, 1997, 1 (02) :225-231

[7]

Erbacher R. F., 2002, Proceedings of Second IASTED International Conference Visualization, Imaging, and Image Processing, P720

[8] Intrusion and misuse detection in large-scale systems [J].

Erbacher, RF ;

Walker, KL ;

Frincke, DA .

IEEE COMPUTER GRAPHICS AND APPLICATIONS, 2002, 22 (01) :38-47

[9]

Girardin L, 1998, PROCEEDINGS OF THE TWELFTH SYSTEMS ADMINISTRATION CONFERENCE (LISA XII), P299

[10]

Goodall J. R., 2004, P 10 AM C INF SYST N, P1421

← 1 2 3 →