Home-centric visualization of network traffic for security administration

  • Authors:
  • Robert Ball;Glenn A. Fink;Chris North

  • Affiliations:
  • Virginia Polytechnic Institute and State University;Virginia Polytechnic Institute and State University;Virginia Polytechnic Institute and State University

  • Venue:
  • Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security
  • Year:
  • 2004

Quantified Score

Hi-index 0.00

Visualization

Abstract

Today's system administrators, burdened by rapidly increasing network activity, must quickly perceive the security state of their networks, but they often have only text-based tools to work with. These tools often provide no overview to help users grasp the big-picture. Our interviews with administrators have revealed that they need visualization tools; thus, we present VISUAL (Visual Information Security Utility for Administration Live), a network security visualization tool that allows users to see communication patterns between their home (or internal) networks and external hosts. VISUAL is part of our Network Eye security visualization architecture, also described in this paper. We have designed and tested a new computer security visualization that gives a quick overview of current and recent communication patterns in the monitored network to the users. Many tools can detect and show fan-out and fan-in, but VISUAL shows network events graphically, in context. Visualization helps users comprehend the intensity of network events more intuitively than text-based tools can. VISUAL provides insight for networks with up to 2,500 home hosts and 10,000 external hosts, shows the relative activity of hosts, displays them in a constant relative position, and reveals the ports and protocols used.