Oct. 26, 2005 to Oct. 26, 2005
John R. Goodall , University of Maryland, Baltimore County
Wayne G. Lutters , University of Maryland, Baltimore County
Penny Rheingans , University of Maryland, Baltimore County
Anita Komlodi , University of Maryland, Baltimore County
When performing packet-level analysis in intrusion detection, analysts often lose sight of the "big picture" while examining these low-level details. In order to prevent this loss of context and augment the available tools for intrusion detection analysis tasks, we developed an information visualization tool, the Time-based Network traffic Visualizer (TNV). TNV is grounded in an understanding of the work practices of intrusion detection analysts, particularly foregrounding the overarching importance of context and time in the process of intrusion detection analysis. The main visual component of TNV is a matrix showing network activity of hosts over time, with connections between hosts superimposed on the matrix, complemented by multiple, linked views showing port activity and the details of the raw packets. Providing low-level textual data in the context of a high-level, aggregated graphical display enables analysts to examine packetlevel details within the larger context of activity. This combination has the potential to facilitate the intrusion detection analysis tasks and help novice analysts learn what constitutes "normal" on a particular network.
Network visualization, network analysis, information visualization, intrusion detection
John R. Goodall, Wayne G. Lutters, Penny Rheingans, Anita Komlodi, "Preserving the Big Picture: Visual Network Traffic Analysis with TN", VIZSEC, 2005, Visualization for Computer Security, IEEE Workshops on, Visualization for Computer Security, IEEE Workshops on 2005, pp. 6, doi:10.1109/VIZSEC.2005.17