Tree visualization with tree-maps: 2-d space-filling approach
ACM Transactions on Graphics (TOG)
Home-centric visualization of network traffic for security administration
Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security
Closing-the-Loop in NVisionIP: Integrating Discovery and Search in Security Visualizations
VIZSEC '05 Proceedings of the IEEE Workshops on Visualization for Computer Security
Preserving the Big Picture: Visual Network Traffic Analysis with TN
VIZSEC '05 Proceedings of the IEEE Workshops on Visualization for Computer Security
Hierarchical Edge Bundles: Visualization of Adjacency Relations in Hierarchical Data
IEEE Transactions on Visualization and Computer Graphics
IEEE Transactions on Visualization and Computer Graphics
Proposing a multi-touch interface for intrusion detection environments
Proceedings of the Seventh International Symposium on Visualization for Cyber Security
Visualizing graph dynamics and similarity for enterprise network security and management
Proceedings of the Seventh International Symposium on Visualization for Cyber Security
Nfsight: netflow-based network awareness tool
LISA'10 Proceedings of the 24th international conference on Large installation system administration
Monitoring large IP spaces with ClockView
Proceedings of the 8th International Symposium on Visualization for Cyber Security
Community-based analysis of netflow for early detection of security incidents
LISA'11 Proceedings of the 25th international conference on Large Installation System Administration
MalwareVis: entity-based visualization of malware network traces
Proceedings of the Ninth International Symposium on Visualization for Cyber Security
Review: A survey of network flow applications
Journal of Network and Computer Applications
Flexible web visualization for alert-based network security analytics
Proceedings of the Tenth Workshop on Visualization for Cyber Security
Visual analysis of large-scale network anomalies
IBM Journal of Research and Development
Hi-index | 0.00 |
The importance of the Internet and our dependency on computer networks are steadily growing, which results in high costs and substantial consequences in case of successful intrusions, stolen data, and interrupted services. At the same time, a trend towards massive attacks against the network infrastructure is noticeable. Therefore, monitoring large networks has become an important field in practice and research. Through monitoring systems, attacks can be detected and analyzed to gain knowledge of how to better protect the network in the future. In the scope of this paper, we present a system to analyze NetFlow data using a relational database system. NetFlow records are linked with alerts from an intrusion detection system to enable efficient exploration of suspicious activity within the monitored network. Within the system, the monitored network is mapped to a TreeMap visualization, the attackers are arranged at the borders and linked using splines parameterized with prefix information. In a series of case studies, we demonstrate how the tool can be used to judge the relevance of alerts, to reveal massive distributed attacks, and to analyze service usage within a network.