A Term Distribution Visualization Approach to Digital Forensic String Search

Schwartz, Moses; Liebrock, Lorie M.

doi:10.1007/978-3-540-85933-8_4

Cited by 8 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Because data mining approach alone is probably not enough, there has been research to apply visual data exploration or visual mining to network management and security . Visual analytics is a meaningful presentation of data in a visually appealing way, whether using tables, plots, charts, graphs, or any innovative views that can aid knowledge discovery process.…”

Section: Introductionmentioning

confidence: 99%

“…In particular, data mining approaches generally are unable to eliminate high error rates (false positives/negatives). Most importantly, there is a socalled semantic gap between the data mining results and decision-making, for example, what does the anomaly mean and what is the reason or cause behind the anomaly.Because data mining approach alone is probably not enough, there has been research to apply visual data exploration or visual mining [4] to network management and security [5][6][7][8]. Visual analytics is a meaningful presentation of data in a visually appealing way, whether using tables, plots, charts, graphs, or any innovative views that can aid knowledge discovery process.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Effective network management via dynamic network anomaly visualization

Liao

2016

Int J Network Mgmt

View full text Add to dashboard Cite

Summary Managed network has become increasingly large, complex, heterogeneous, and dynamic. With tremendous number of network components changing at any moment, deciding which events and changes are possibly abnormal and need further investigation is extremely challenging. While there has been widely adopted practice to log daily activities through standard file formats such as netflow, syslog, firewall, and IDS systems, it is vital for system administrators and network managers to be able to analyze the vast amount of log data in order to detect suspicious behaviors or patterns, possibly because of malicious users/applications or faulty devices. While there are automated systems that are available to generate warnings, whether such alarms are true or false, and more importantly, what are the underlying causes are still difficult to know. To bridge the gap between network logging and anomaly analysis, we design and implement a visualization tool that combines multiple useful visualizations together with algorithms such as graph link anomaly analysis. We study the effects of different visualization methods on detecting and analyzing network and system anomalous events and their causes and show that these views, when combined and linked together, may provide an effective alternative for network management and anomaly analysis. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

Effective network management via dynamic network anomaly visualization

Liao

2016

Int J Network Mgmt

View full text Add to dashboard Cite

show abstract

“…We have already done some preliminary work on applying this visualization model to the problem of digital forensic string search [15], and we foresee many more possible applications in the field of information security. Other applications to be pursued include the use of these visualizations for conventional text search tasks as was done in [7], and for trend analysis as has been explored in [9] and [5].…”

Section: Case Studies and Applicationsmentioning

confidence: 99%

Term distribution visualizations with Focus+Context

Schwartz

Hash

Liebrock

2009

Proceedings of the 2009 ACM Symposium on Applied Computing

Self Cite

View full text Add to dashboard Cite

Many text searches are meant to identify one particular fact or one particular section of a document. Unfortunately, predominant search paradigms focus mostly on identifying relevant documents and leave the burden of withindocument searching on the user. This research explores term distribution visualizations as a means to more clearly identify both the relevance of documents and the location of specific information within them. We present a set of term distribution visualizations and introduce a Focus+Context model for within-document search and navigation.

show abstract

“…While this method does assist in locating files with unusual metadata characteristics, the issue we are investigating requires inspection of the file's contents. For looking at file contents, Schwartz and Liebrock [18] provide a histogram-like version of Tile-Bars [12] for finding the distribution of search strings across a disk image. Their visualization is based upon a priori strings (i.e., ones provided by the user), and is thus less beneficial when searching for evidence beyond that initial set.…”

Section: Related Workmentioning

confidence: 99%

A visual analytic framework for exploring relationships in textual contents of digital forensics evidence

Jankun-Kelly

Wilson

Stamps

et al. 2009

2009 6th International Workshop on Visualization for Cyber Security

View full text Add to dashboard Cite

We describe the development of a set of tools for analyzing the textual contents of digital forensic evidence for the purpose of enhancing an investigator's ability to discover information quickly and efficiently. By examining the textual contents of files and unallocated space, relationships between sets of files and clusters can be formed based on the information that they contain. Using the information gathered from the evidence through the analysis tool, the visualization tool can be used to search through the evidence in an organized and efficient manner. The visualization depicts both the frequency of relevant terms and their location on disk. We also discuss a task analysis with forensics officers to motivate the design.

show abstract

A Term Distribution Visualization Approach to Digital Forensic String Search

Cited by 8 publications

References 12 publications

Effective network management via dynamic network anomaly visualization

Effective network management via dynamic network anomaly visualization

Term distribution visualizations with Focus+Context

A visual analytic framework for exploring relationships in textual contents of digital forensics evidence

Contact Info

Product

Resources

About