Countering security information overload through alert and packet visualization

Conti, Gregory; Abdullah, Kulsoom; Grizzard, J.B.; Stasko, John; Copeland, John A.; Ahamad, Mustaque; Owen, Henry L.; Lee, C.

doi:10.1109/mcg.2006.30

Cited by 35 publications

(22 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In terms of case studies, the IDS Rainstorm [8] and MieLog systems [25] focus on time series log data that share similar characteristics with the Travelport data. IDS Rainstorm uses visualizations to help network system administrators analyze massive amounts of alarm data generated from intrusion detection systems.…”

Section: Related Workmentioning

confidence: 99%

SellTrend: Inter-Attribute Visual Analysis of Temporal Transaction Data

Liu

Stasko

Sullivan³

2009

IEEE Trans. Visual. Comput. Graphics

Self Cite

View full text Add to dashboard Cite

Abstract-We present a case study of our experience designing SellTrend, a visualization system for analyzing airline travel purchase requests. The relevant transaction data can be characterized as multi-variate temporal and categorical event sequences, and the chief problem addressed is how to help company analysts identify complex combinations of transaction attributes that contribute to failed purchase requests. SellTrend combines a diverse set of techniques ranging from time series visualization to faceted browsing and historical trend analysis in order to help analysts make sense of the data. We believe that the combination of views and interaction capabilities in SellTrend provides an innovative approach to this problem and to other similar types of multivariate, temporally-driven transaction data analysis. Initial feedback from company analysts confirms the utility and benefits of the system.

show abstract

Section: Related Workmentioning

confidence: 99%

SellTrend: Inter-Attribute Visual Analysis of Temporal Transaction Data

Liu

Stasko

Sullivan³

2009

IEEE Trans. Visual. Comput. Graphics

Self Cite

View full text Add to dashboard Cite

show abstract

“…However, today's highly distributed attacks and excessive Internet background radiation [15] make it difficult to use standard visualization tools to their full potential. Conti et al [4,6] discuss visualization systems which filter data but leave it up to the analyst to select which records to display. The prefiltering phase involves removing unwanted fields from flows or formatting the data; it does not automatically remove any full flows.…”

Section: Related Workmentioning

confidence: 99%

“…Visual representation of network data, as opposed to textual representation, can help in analyzing a vast amount of data more quickly [4]. It takes humans much less time to recognize specific information or patterns in a picture than to detect the same in text.…”

Section: Introductionmentioning

confidence: 99%

Improving Security Visualization with Exposure Map Filtering

Alsaleh

Barrera

Oorschot

2008

2008 Annual Computer Security Applications Conference (ACSAC)

View full text Add to dashboard Cite

Graphical analysis of network traffic flows helps security analysts detect patterns or behaviors that would not be obvious in a text-based environment. The growing volume of network data generated and captured makes it increasingly difficult to detect increasingly sophisticated reconnaissance and stealthy network attacks. We propose a network flow filtering mechanism that leverages the exposure maps technique of Whyte et al. (2007), reducing the traffic for the visualization process according to the network services being offered. This allows focus to be limited to selected subsets of the network traffic, for example what might be categorized (correctly or otherwise) as the unexpected or potentially malicious portion. In particular, we use this technique to filter out traffic from sources that have not gained knowledge from the network in question. We evaluate the benefits of our technique on different visualizations of network flows. Our analysis shows a significant decrease in the volume of network traffic that is to be visualized, resulting in visible patterns and insights not previously apparent.

show abstract

“…The task of making sense of these data files is considerable, and can lead to cognitive overload, even amongst seasoned analysts [5]. Clearly an "information gap" exists between the data produced and the information needed by the analyst to make timely, informed decisions [6].…”

Section: Introductionmentioning

confidence: 99%

“…To reliably perform such a task on a log file consisting of thousands of events is beyond the capabilities of most human beings. Statistical analysis and filtering methods are therefore extensively employed amongst IDS operators [5] to make sense of the data. The user may assemble an SQL query or a sequence of Unix commands to discover which host received the most attacks in a given period, or to isolate all alerts for a given attack type.…”

Section: Introductionmentioning

confidence: 99%

Pianola - Visualization of Multivariate Time-Series Security Event Data

Thomson¹,

Graham

Kennedy

2013

2013 17th International Conference on Information Visualisation

View full text Add to dashboard Cite

Abstract-Monitoring log files for network intrusions is unwieldy. To build a mental model of the log, an analyst is required to recognise continuous timelines and attack patterns from a dataset that is essentially limited to an ordered list of events. Information Visualization techniques arrange data into directly perceivable visual patterns that may alleviate some overheads associated with interpreting these datasets and improve the ability of users, especially those in resourcestretched Small and Medium sized Businesses (SMBs), to make sense of activity patterns in Intrusion Detection System (IDS) event logs. To this end, we discuss existing network security visualizations for IDS logs and after examining the strengths and drawbacks of those applications we have prototyped a visualization tool, Pianola, that arranges events on multiple timelines to reveal patterns both in time and across a network. The tool was evaluated against the traditional use of commandline interface (CLI)-based tools for analyzing network security events and displayed significant improvements in both recognition and detection of attacks and reduction in the users' subjective workload, measured using the NASA Task Load index (TLX).

show abstract

Countering security information overload through alert and packet visualization

Cited by 35 publications

References 8 publications

SellTrend: Inter-Attribute Visual Analysis of Temporal Transaction Data

SellTrend: Inter-Attribute Visual Analysis of Temporal Transaction Data

Improving Security Visualization with Exposure Map Filtering

Pianola - Visualization of Multivariate Time-Series Security Event Data

Contact Info

Product

Resources

About