The Community for Technology Leaders
Visualization for Computer Security, IEEE Workshops on (2005)
Minneapolis, Minnesota
Oct. 26, 2005 to Oct. 26, 2005
ISBN: 0-7803-9477-1
pp: 6
John R. Goodall , University of Maryland, Baltimore County
Wayne G. Lutters , University of Maryland, Baltimore County
Penny Rheingans , University of Maryland, Baltimore County
Anita Komlodi , University of Maryland, Baltimore County
ABSTRACT
When performing packet-level analysis in intrusion detection, analysts often lose sight of the "big picture" while examining these low-level details. In order to prevent this loss of context and augment the available tools for intrusion detection analysis tasks, we developed an information visualization tool, the Time-based Network traffic Visualizer (TNV). TNV is grounded in an understanding of the work practices of intrusion detection analysts, particularly foregrounding the overarching importance of context and time in the process of intrusion detection analysis. The main visual component of TNV is a matrix showing network activity of hosts over time, with connections between hosts superimposed on the matrix, complemented by multiple, linked views showing port activity and the details of the raw packets. Providing low-level textual data in the context of a high-level, aggregated graphical display enables analysts to examine packetlevel details within the larger context of activity. This combination has the potential to facilitate the intrusion detection analysis tasks and help novice analysts learn what constitutes "normal" on a particular network.
INDEX TERMS
Network visualization, network analysis, information visualization, intrusion detection
CITATION
John R. Goodall, Wayne G. Lutters, Penny Rheingans, Anita Komlodi, "Preserving the Big Picture: Visual Network Traffic Analysis with TN", Visualization for Computer Security, IEEE Workshops on, vol. 00, no. , pp. 6, 2005, doi:10.1109/VIZSEC.2005.17
115 ms
(Ver )