Owleyes: A Visual Analytics System for Functions and Connection Patterns of IPv4 Addresses in Networks

Abstract

Netflow log files commonly contain massive transfer records in tiny time interval, making analytical works complex and burdensome. By combining human cognition abilities with computerized techniques, visual analytics systems have become efficient tools for showing network states and locating abnormal behaviors. However, traditional visual analytics systems tend to be designed for solving certain problems and unable to synthesize various types of data sources. Despite recent advances in network security visualization, academia still starves for a proper solution to visualize IPv4 address behavior modes and IPv4 connection patterns within limited drawing space. Thus, we propose a visual analytics system called 'Owleyes' which reprocesses Netflow log data with simple statistical operations in basic dimensions and fulfills the aforementioned requirements with proper novel graphs such as 'sunburst-hive-plot graph' (SHG) and link-wheel graph (LW). The SHG provides a stable and comparable means of visualizing connection patterns efficiently in a limited drawing space. The LW represents the hourly connection counts of main ports in a specific IPv4 connection during one day. With the use case dealing with the ChinaVis 2016 Challenge I data, the efficiency and practicability of Owleyes are demonstrated. INDEX TERMS Visual analytics, network security, sunburst-hiveplot graph, link wheel graph, user-centric interaction. HAIBO HU received the master's degree in software engineering and the Ph.D. degree in computer science from Chongqing University, China, in 2004 and 2012, respectively. He is currently an Associate Professor with the School of Big Data and Software Engineering, Chongqing University. He is also a Research Associate with the Key Laboratory for Dependable Service Computing in Cyber Physical Society of the Ministry of Education, China. His current research interests include software engineering, pattern recognition, semantic web, and visual analytics.