The Spinning Cube of Potential Doom

Lau, S. H.

doi:10.1145/990680.990699

Cited by 120 publications

(58 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…One of the better named visualizations, "The Spinning Cube of Potential Doom" [13] takes a 3D approach to connection flows. It uses a cube, where the X axis represents local IP addresses, the Y axis global IP addresses and the Z axis ports.…”

Section: Related Researchmentioning

confidence: 99%

FloVis: Flow Visualization System

Taylor

Paterson

Glanfield

et al. 2009

2009 Cybersecurity Applications &Amp; Technology Conference for Homeland Security

View full text Add to dashboard Cite

NetFlow data is routinely captured at the border of many enterprise networks. Although not as rich as full packetcapture data, NetFlow provides a compact record of the interactions between host pairs on either side of the monitored border. Analysis of this data presents a challenge to the security analyst due to its volume. We report preliminary results on the development of a suite of visualization tools that are intended to complement command line tools, such as those from the SiLK Tools, that are currently used by analysts to perform forensic analysis of NetFlow data. The current version of the tool set draws on three visual paradigms: activity diagrams that display various aspects of multiple individual host behaviors as color 1 coded time series, connection bundles that show the interactions among hosts and groups of hosts, and the NetBytes viewer that allows detailed examination of the port and volume behaviors of an individual host over a period of time. The system supports drill down for additional detail and pivoting that allows the analyst to examine the relationships among the displays. SiLK data is preprocessed into a relational database to drive the display modes, and the tools can interact with the SiLK system to extract additional data as necessary.

show abstract

Section: Related Researchmentioning

confidence: 99%

FloVis: Flow Visualization System

Taylor

Paterson

Glanfield

et al. 2009

2009 Cybersecurity Applications &Amp; Technology Conference for Homeland Security

View full text Add to dashboard Cite

show abstract

“…Linear IP address spaces are sometimes displayed in two dimensions using space filling curves [10][11][12], as this technique allows to show aggregations with common prefixes. To visualize network activities, three dimensional cube visualizations have been suggested, mapping source and destination addresses and port numbers [13,14]. These cube visualizations indicate interaction dynamics, although they can be hard to read due to the two-dimensional projection on computer displays.…”

Section: Related Workmentioning

confidence: 99%

Visualization of Node Interaction Dynamics in Network Traces

Dobrev

Stancu-Mara

Schönwälder

2009

Scalability of Networks and Services

View full text Add to dashboard Cite

Abstract. The analysis of network traces often requires to find the spots where something interesting happens. Since traces are usually very large data-sets, it is often not easy and time intensive to get an intuitive understanding of what happens within a given trace. Through the use of suitable data visualization techniques, it is possible for humans to identify noteworthy spots or characteristics of a trace much faster. Particularly interesting properties of a certain class of network traces are node interaction dynamics, that is how the traffic matrix between nodes evolves over time and the pattern of messages exchanged between nodes. This paper presents some tools visualizing node interaction dynamics that were developed to assist network trace analysts.

show abstract

“…Stephen Lau's 'Spinning Cube of Potential Doom' visualizes TCP connection attempts as an animated 3-D scatter plot of points [Lau 2003, Lau 2004. By contrast, the majority of network visualizations employ lines to represent connectivity [Ball et al, Clark, Fisk et al, Teoh et al, Yin et al].…”

Section: Scalability Considerationsmentioning

confidence: 99%

“…InetVis is also capable of displaying real-time traffic capture from a live network interface. (Both live monitoring and variable rate replay are noted by Stephen Lau as desirable extensions [Lau 2003]. )…”

Section: Featuresmentioning

confidence: 99%

“…Between 1995 and the first quarter of 2005, the CERT® Coordination Centre (CERT/CC) received 17,946 vulnerability reports. Over 3,500 vulnerabilities were recorded for each of the last three years, namely 2002, 2003[CERT 2005. As a consequence, a multitude of vulnerable systems are open to exploitation and serve as launching platforms for further attacks, thereby proliferating malicious activity.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

InetVis, a visual tool for network telescope traffic analysis

Riel

Irwin

2006

Proceedings of the 4th International Conference on Computer Graphics, Virtual Reality, Visualisation and Interaction in Africa

View full text Add to dashboard Cite

This article illustrates the merits of visual analysis as it presents preliminary findings using InetVis -an animated 3-D scatter plot visualization of network events. The concepts and features of InetVis are evaluated with reference to related work in the field. Tested against a network scanning tool, anticipated visual signs of port scanning and network mapping serve as a proof of concept. This research also unveils substantial amounts of suspicious activity present in Internet traffic during August 2005, as captured by a class C network telescope. InetVis is found to have promising scalability whilst offering salient depictions of intrusive network activity.

show abstract

The Spinning Cube of Potential Doom

Abstract: The Cube displays network traffic entering and leaving a site, revealing graphical patterns of potentially malicious traffic.

Cited by 120 publications

References 0 publications

FloVis: Flow Visualization System

FloVis: Flow Visualization System

Visualization of Node Interaction Dynamics in Network Traces

InetVis, a visual tool for network telescope traffic analysis

Contact Info

Product

Resources

About