Issue No. 02 - March/April (2006 vol. 26)
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/MCG.2006.49
Stefano Foresti , University of Utah
James Agutter , University of Utah
Yarden Livnat , University of Utah
Shaun Moon , University of Utah
Robert Erbacher , Utah State University
This article presents VisAlert, a novel visual correlation tool that displays network--and host-based alerts from disparate sensors. The approach is based on the fundamental premise that an alert must possess three attributes: what, when, and where. These attributes provide a vehicle for comparing seemingly disparate events. VisAlert facilitates and promotes situational awareness in complex network environments by providing the user with a holistic view of network security to aid in the detection of sophisticated and malicious activities. This visualization was developed with a user centered, interdisciplinary design methodology using domain analysis, visual design, user feedback, and software implementation. Network analysts and decision makers with experience in large organizational networks were involved in the iterative development process. VisAlert was deployed at the Air Force Research Lab where it generated a positive response due to its intuitiveness, effectiveness, simplicity, and flexibility, features that enhance the capability of network analysts to detect, diagnose, and respond to difficult to detect anomalies.
Visualization, Data Correlation, Situational Awareness, Cybersecurity, Network Intrusion, Network Monitoring, User Centered Design
S. Moon, S. Foresti, Y. Livnat, J. Agutter and R. Erbacher, "Visual Correlation of Network Alerts," in IEEE Computer Graphics and Applications, vol. 26, no. , pp. 48-59, 2006.