Visualization design for immediate high-level situational assessment

Abstract

We present the design of a visualization technique based on the results of a human in the loop process, which relied on network managers and network analysts. This visualization design was directly targeted at supporting tasks identified by the domain experts. This was the need for the ability to provide rapid and immediate assessment of the state of the network and associated hosts. This visualization technique, the Cyber Command Gauge Cluster (CCGC), allows analysts to review the state of the network and locate potentially problematic anomalies, drill down into those anomalies, and prioritize the anomalies for detailed analysis and remediation. By providing a summary representation combined with independent representations of critical parameters, the technique is unique in its ability to aid decision makers in making rapid assessments and prioritization of identified anomalies. While the prototype focuses on network analysis, the technique is devised to provide generalized support for situational awareness in any domain. The generalized parameter mapping allows the technique to be applicable to any level of decision making, from the front-line network analyst to the CIO.

Analysis framework of network security situational awareness and comparison of implementation methods

“…The concept of the model (integration with other disciplines) [16, 18, 39, 45, 50-57, 63, 67, 68] The completeness and regularization of data acquisition variables [40,42,45,47,73,87] The optimization of related algorithms [58][59][60][61][62][63][64][65][66][67] The information fusion analysis [40,42,53,[69][70][71][72][73][74] The automation of process tools [33-35, 73, 75, 84, 85, 87] The visualization of work at each stage [5,11,55,61,[76][77][78][79]86] Practice testing and efficiency gains in large-scale real-world networks [80][81][82] The software engineering implementation of sensing methods [42,[83][84][85]88] The practical application of analysis and prediction results in specific fields [42,47,…”

“…Beaver et al [77] effectively filter the analysis process and data in IDS and present them to administrators in a visual way. In literature [78], with the help of the unique professional knowledge of the participants, a real-time evaluation visual framework is designed to allow network managers to participate in the analysis loop manually; some articles focus on machine learning methods for visual rendering (such as artificial neural network [79] and cluster analysis [77]). In addition, most active analysis models such as attack graphs are combined with visualization technology [5,11,55,61].…”

Human Factors in Streaming Data Analysis: Challenges and Opportunities for Information Visualization

“…The SA‐related analytical tasks can be synthesized into the following main types: SA1 :Summarize information from heterogeneous streaming data sources for identifying causal relationships behind the changing patterns. SA2 :Take domain knowledge into account and let analysts explore dynamic what‐if scenarios. Based on our survey, we found that very few papers (with the exception of [Erb12, FK14, MJR*11, SBM*14]) address situational awareness scenarios. In Figure , we see one such example where interactive feature selection is used for summarizing and reasoning purposes.…”

“…Erbacher visualized streaming data in concentric circles, where newly arrived data were added to the outside of the circle, giving it more screen space [Erb12]. Conversely, less screen space was available to older data, which was assumed to be of lesser importance.…”

NStreamAware

“…Furthermore, there is not only work on SA systems, but also visualization techniques (e.g., [7]) designed to convey the current state of the network to best support situational assessment. ELVIS [10] is a highly interactive system to analyze system log data, but cannot be applied to real-time streams.…”