P3D: A parallel 3D coordinate visualization for advanced network scans

Abstract

As network attacks increase in complexity, network administrators will continue to struggle with analyzing security data immediately and efficiently. To alleviate these challenges, researchers are looking into various visualization techniques (e.g., two-dimensional (2D) and three-dimensional (3D)) to detect, identify, and analyze malicious attacks. This paper discusses the benefits of using a stereoscopic 3D parallel visualization techniques for network scanning, in particular, when addressing occlusion-based visualization attacks intended to confuse network administrators. To our knowledge, no 2D or 3D tool exists that analyzes these attacks. Hence, we propose a novel 3D Parallel coordinate visualization tool for advanced network scans and attacks called P3D. P3D uses flow data, filtering techniques, and state-of-the art 3D technologies to help network administrators detect distributed and coordinated network scans. Compared to other 2D and 3D network security visualization tools, P3D prevents occlusion-based visualization attacks (e.g., Windshield Wiper and Port Source Confusion attacks). We validate our tool with use-cases from emulated distributed scanning attacks. Our evaluation shows P3D allows users to extract new information about scans and minimize information overload by adding an extra dimension and awareness region in the visualization.

Topological analysis and visualisation of network monitoring data: Darknet case study

“…As already introduced, one plane represents the source IP address and port of the packet and the second plane represents the destination IP address and the port of the packets. This 3D visualisation is similar to the technique proposed by Nunnally et al [20]. Before any processing, the result is similar to Figure 3(a).…”

“…Figure 4 is the result of this scan analysis with more data than Figure 3(a). Since the packets marked as noise by the clustering are not drawn, the result is much more understandable than a raw visualisation as proposed by Nunnally and al [20] and depicted in Figure 3(a). Slices of scans are clearly visible where multiple IP addresses of our darknet are being targeted.…”

A Survey on Information Visualization for Network and Service Management

“…Nunnally et al [144] propose a visualization tool called P3D that uses 3D parallel visualization techniques to help network administrators in identifying and analyzing distributed scanning attacks that aim to distract them. P3D is based on a 3D coordinate system with colored links between two Figure 13.…”

“…(a) The visualization proposed by Zhao[140]; (b) An overview of DAEDALUS-VIZ[143]; (c) An example of source port confusion attack represented by P3D visualization[144].…”

A Matrix-Based Visualization System for Network Traffic Forensics

“…This technology can make problems quickly and precisely positioned via interactions. Three-dimensional effect has been also introduced to display network activities [21], [22]. However, depth information that is hard to handle makes interactions difficult and mutual occlusions unavoidable.…”