Collaborative visual analytics for network traffic time-series data with multiple views

被引：0
|
作者：
Zhao Y. [1 ]
Wang Q. [1 ]
Huang Y.-Z. [2 ]
Wu Q. [3 ]
Zhang S. [1 ]
机构：
[1] School of Information Science and Engineering, Central South University, Changsha
[2] School of Software, Central South University, Changsha
[3] Information and Network Center, Central South University, Changsha
来源：
Wu, Qing (wuqing@csu.edu.cn) | 2016年 / Chinese Academy of Sciences卷 / 27期
基金：
中国国家自然科学基金;
关键词：
Anomaly detection; Cyber security visualization; Network traffic; Time series data; Visual analytics;
D O I：
10.13328/j.cnki.jos.004960
中图分类号：
学科分类号：
摘要：
Cyber security visualization is a multi-discipline research field. Visualization techniques have injected new vitality into traditional analysis methods for cyber security. However, most existing studies focus on the visual expression and overlook the visual support for the data analysis process. This paper presents a top-down model for anomaly detection on network traffic time-series data drawing from the experience of cyber security analysts. A prototype system is designed based on this model, and it includes four collaborative views with direct and rich interactions. A number of experiments, including port scanning and DDoS attacking, are carried out to demonstrate that this system can support network traffic time-series analysis on overview to detail, point to area and past to future process flows. © Copyright 2016, Institute of Software, the Chinese Academy of Sciences. All rights reserved.
引用
收藏
页码：1188 / 1198
页数：10
相关论文
共 21 条
  • [1] Lu L.F., Zhang J.W., Sun J.Z., He P.L., Sun L.G., Survey of network security visualization techniques, Journal of Computer Applications, 28, 8, pp. 1924-1927, (2008)
  • [2] Harrison L., Lu A.D., The future of security visualization: Lessons from network visualization, IEEE Network, 26, 6, pp. 6-11, (2012)
  • [3] Zhang Y.P., Xiao Y., Chen M., Zhang J.Y., Deng H.M., A survey of security visualization for computer network logs, Security & Communication Networks, 5, 4, pp. 404-421, (2012)
  • [4] Shiravi H., Shiravi A., Ghorbani A.A., A survey of visualization systems for network security, IEEE Trans. on Visualization and Computer Graphics, 18, 8, pp. 1313-1329, (2012)
  • [5] Zhao Y., Fan X.P., Zhou F.F., Wang F., Zhang J.W., A survey on network security data visualization, Journal of Computer-Aided Design & Computer Graphics, 26, 5, pp. 687-697, (2014)
  • [6] Abdullah K., Lee C., Conti G., Copeland J.A., Visualizing network data for intrusion detection, Proc. of the 6th Annual IEEE SMC Information Assurance Workshop, pp. 100-108, (2005)
  • [7] Yegneswaran V., Barford P., Ullrich J., Internet intrusions: Global characteristics and prevalence, Proc. of the 2003 ACM SIGMETRICS Int'l Conf. on Measurement and Modeling of Computer Systems, pp. 138-147, (2003)
  • [8] Zhao Y., Liang X., Fan X.P., Wang Y.W., Yang M.J., Zhou F.F., MVSec: Multi-Perspective and deductive visual analytics on heterogeneous network security data, Journal of Visualization, 17, 3, pp. 181-196, (2014)
  • [9] Berthier R., Cukier M., Hiltunen M., Kormann D., Vesonder G., Sheleheda D., Nfsight: Netflow-Based network awareness tool, Proc. of the 24th Int'l Conf. on Large Installation System Administration, pp. 1-8, (2010)
  • [10] Taylor T., Paterson D., Glanfield J., Gates C., Brooks S., Mchugh J., Flovis: Flow visualization system, Proc. of the Conf. for Homeland Security, pp. 186-198, (2009)
123