Visualizing "typical" and "exotic" Internet traffic data

Authors:
Karen Kafadar;Edward J. Wegman
Affiliations:
Department of Mathematics, University of Colorado-Denver, Denver, Colorado 80217-3364, USA;Center for Computational Statistics, George Mason University, Fairfax, Virginia 22030-4444, USA
Venue:
Computational Statistics & Data Analysis
Year:
2006

Citing 6
Cited 1

The grand tour: a tool for viewing multidimensional data

SIAM Journal on Scientific and Statistical Computing
The elements of graphing data

The elements of graphing data
The visual display of quantitative information

The visual display of quantitative information
Brief Application Description; Visual Data Mining: Recognizing Telephone Calling Fraud

Data Mining and Knowledge Discovery
Signature-Based Methods for Data Streams

Data Mining and Knowledge Discovery
MacSpin: Dynamic Graphics on a Desktop Computer

IEEE Computer Graphics and Applications

Nonparametric density estimation of streaming data using orthogonal series

Computational Statistics & Data Analysis

Quantified Score

Hi-index	0.03

Visualization

Abstract

The threat of cyber attacks motivates the need to monitor Internet traffic data for potentially abnormal behavior. Due to the enormous volumes of such data, statistical process monitoring tools, such as those traditionally used on data in the product manufacturing arena, are inadequate. ''Exotic'' data may indicate a potential attack; detecting such data requires a characterization of ''typical'' data. We devise some new graphical displays, including a ''skyline plot,'' that permit ready visual identification of unusual Internet traffic patterns in ''streaming'' data, and use appropriate statistical measures to help identify potential cyberattacks. These methods are illustrated on a moderate-sized data set (135,605 records) collected at George Mason University.