NetSecRadar: A Visualization System for Network Security Situational Awareness

Zhou, Fangfang; Shi, Ronghua; Zhao, Ying; Huang, Yezi; Liang, Xin-Gang

doi:10.1007/978-3-319-03584-0_30

Cited by 8 publications

(3 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…It focuses on providing analysts insight in network intrusion detection but requires the user to manually aggregate their data for input into the tool. Similar to VisAlert, Zhou et al used a radial layout with edge bundling and node-links to create NetSecRadar 37 but focuses on tackling network data fusion while providing real-time event correlation to users. Best et al developed two tools to create a real-time, situation awareness platform called MeDICi.…”

Section: Related Workmentioning

confidence: 99%

Riverside: A design study on visualization for situation awareness in cybersecurity

DeValk,

Elmqvist

2023

Information Visualization

View full text Add to dashboard Cite

Real-time situation awareness is a key challenge of cybersecurity defense. Visual analytics has been utilized for this purpose, but existing tools tend to require detailed knowledge about the network, which can be challenging in large-scale, production networks. We conducted an interview study involving 24 security professionals to gather requirements for the design, development, and evaluation of visualization to aid situation awareness in cybersecurity. Using these findings, we designed a visualization tool – called RIVERSIDE – for providing a real-time view of the dynamically changing computer network to support situation awareness. We evaluated Riverside in a user study involving 10 participants. Participants were placed in an incident response scenario that tasked them to identify malicious activity on a network. 20% of the users identified all attack component, while an additional 40% only missed one component.

show abstract

Section: Related Workmentioning

confidence: 99%

Riverside: A design study on visualization for situation awareness in cybersecurity

DeValk,

Elmqvist

2023

Information Visualization

View full text Add to dashboard Cite

show abstract

“…A wide variety of visual displays and graphical interfaces have been developed for CND in pursuit of this goal. Graph-based approaches have been used to visualize various relationships between network hosts including radial graph displays for system events (e.g., multisource system logs; Zhao, Zhou, & Shi, 2012), 3D visualizations for monitoring Darknet traffic (Inoue, Eto, Suzuki, Suzuki, & Nakao, 2012), network attack information (Tamassia, Palazzi, & Papamanthou, 2009), and overviews of network activity (Oline & Reiners, 2005). Bobche and Mehtre (2014) developed visual representations of exploitation patterns.…”

Section: Introductionmentioning

confidence: 99%

Ecological Interface Design for Computer Network Defense

2018

View full text Add to dashboard Cite

show abstract

“…Si bien el análisis de datos tiene como objetivo la obtención de informacióń util a partir de amplios y complejos conjuntos de datos, la visualización de la información explota el conocimiento previo adquirido y contribuye a incrementar la cognición humana mediante una exploración visual y una eficiente interacción con la información representada [199]. Al emergente campo de estudio que, con el fin de mejorar el proceso de toma de decisiones, combina las ventajas que ofrecen ambos enfoques se le conoce como visual analytics [200][201] [202].…”

Section: Técnicas De Visualización De Informaciónunclassified

Arquitectura de Cyber Situational Awareness (CySA) para la protección de infraestructuras críticas

Gómez¹,

Eric²

View full text Add to dashboard Cite

Security in cyberspace is today a key challenge for any organization with the continuous growth of cyberattacks worldwide. In the current technological reality, in which physical and cyber domains are increasingly interdependent, this task is still most essential since actions in any of these scopes can lead to devastating consequences on both. This is even more important in case of critical infrastructures (CI), inasmuch as well-being of nations and their citizens depends on their proper functioning. New solutions are therefore needed in order to efficiently face the defence of all kind of CI in this hybrid scenario, in which traditional security tools (firewall, IDS/IPS and even SIEM systems) are by themselves insufficient against largescale attacks and where more complete workarounds such as the most recent SCADA systems still remain focused on very specific sectors. This doctoral thesis introduces an innovative Situational Awareness (SA) approach for the suitable CI protection in the cyber-physical context. In particular, a hybrid SA architecture that provides, through advanced representation techniques, a Common Operational Picture of both physical and cyber dimensions in a unique visualization space is proposed to support operator's decision-making. The defined architecture has been applied in two different Cyber Command & Control solutions for CI protection: GESTPIC system for cyber-physical SA advanced visualization, and HYBINT as a novel tool for intelligence information integration and analysis. The model presented in this research has been validated in both simulated and real working environments, awakening the interest of potential end users and being confirmed as a groundbreaking proposal in its field in the specialized forums in which it has participated.

show abstract

NetSecRadar: A Visualization System for Network Security Situational Awareness

Cited by 8 publications

References 14 publications

Riverside: A design study on visualization for situation awareness in cybersecurity

Riverside: A design study on visualization for situation awareness in cybersecurity

Ecological Interface Design for Computer Network Defense

Arquitectura de Cyber Situational Awareness (CySA) para la protección de infraestructuras críticas

Contact Info

Product

Resources

About