PortVis: a tool for port-based detection of security events

Authors:
Jonathan McPherson;Kwan-Liu Ma;Paul Krystosk;Tony Bartoletti;Marvin Christensen
Affiliations:
University of California at Davis;University of California at Davis;Lawrence Livermore National Laboratory;Lawrence Livermore National Laboratory;Lawrence Livermore National Laboratory
Venue:
Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security
Year:
2004

Citing 7
Cited 38

Self-organization and associative memory: 3rd edition

Self-organization and associative memory: 3rd edition
Case study: interactive visualization for internet security

Proceedings of the conference on Visualization '02
Visualizing Network Data

IEEE Transactions on Visualization and Computer Graphics
Network Visualization with Nam, the VINT Network Animator

Computer
A Visual Approach for Monitoring Logs

LISA '98 Proceedings of the 12th Conference on Systems Administration
How to Own the Internet in Your Spare Time

Proceedings of the 11th USENIX Security Symposium
The Spinning Cube of Potential Doom

Communications of the ACM - Wireless sensor networks

A user-centered approach to visualizing network traffic for intrusion detection

CHI '05 Extended Abstracts on Human Factors in Computing Systems
IDGraphs: Intrusion Detection and Analysis Using Stream Compositing

IEEE Computer Graphics and Applications
Visual Correlation of Network Alerts

IEEE Computer Graphics and Applications
Focusing on Context in Network Traffic Analysis

IEEE Computer Graphics and Applications
Interactive Exploration of Data Traffic with Hierarchical Network Maps

IEEE Transactions on Visualization and Computer Graphics
Visualizing Internet Routing Changes

IEEE Transactions on Visualization and Computer Graphics
An intelligent, interactive tool for exploration and visualization of time-oriented security data

Proceedings of the 3rd international workshop on Visualization for computer security
Visualization assisted detection of sybil attacks in wireless networks

Proceedings of the 3rd international workshop on Visualization for computer security
Ensuring the continuing success of vizsec

Proceedings of the 3rd international workshop on Visualization for computer security
Interactively combining 2D and 3D visualization for network traffic monitoring

Proceedings of the 3rd international workshop on Visualization for computer security
Detecting distributed scans using high-performance query-driven visualization

Proceedings of the 2006 ACM/IEEE conference on Supercomputing
CluVis: dual-domain visual exploration of cluster/network metadata

ACM-SE 45 Proceedings of the 45th annual southeast regional conference
Command line or pretty lines?: comparing textual and visual interfaces for intrusion detection

Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
Towards network awareness

LISA '05 Proceedings of the 19th conference on Large Installation System Administration Conference - Volume 19
Interactive wormhole detection and evaluation

Information Visualization
PolicyVis: firewall security policy visualization and inspection

LISA'07 Proceedings of the 21st conference on Large Installation System Administration Conference
A Task Centered Framework for Computer Security Data Visualization

VizSec '08 Proceedings of the 5th international workshop on Visualization for Computer Security
Existence Plots: A Low-Resolution Time Series for Port Behavior Analysis

VizSec '08 Proceedings of the 5th international workshop on Visualization for Computer Security
A Component-Based Framework for Visualization of Intrusion Detection Events

Information Security Journal: A Global Perspective
Web-Based Monitoring and Visualization of Self-Organizing Process Control Agents

IWSOS '08 Proceedings of the 3rd International Workshop on Self-Organizing Systems
Topnet: a network-aware top(1)

LISA'08 Proceedings of the 22nd conference on Large installation system administration conference
Toward a Scalable Visualization System for Network Traffic Monitoring

IEICE - Transactions on Information and Systems
Network stack diagnosis and visualization tool

Proceedings of the Symposium on Computer Human Interaction for the Management of Information Technology
A new concentric-circle visualization of multi-dimensional data and its application in network security

Journal of Visual Languages and Computing
Visualizing graph dynamics and similarity for enterprise network security and management

Proceedings of the Seventh International Symposium on Visualization for Cyber Security
Managing networks through context: Graph visualization and exploration

Computer Networks: The International Journal of Computer and Telecommunications Networking
TVi: a visual querying system for network monitoring and anomaly detection

Proceedings of the 8th International Symposium on Visualization for Cyber Security
Visual analysis of goal-directed network defense decisions

Proceedings of the 8th International Symposium on Visualization for Cyber Security
Situational assessment of intrusion alerts: a multi attack scenario evaluation

ICICS'11 Proceedings of the 13th international conference on Information and communications security
Web-Based three-dimension e-mail traffic visualization

APWeb'06 Proceedings of the 2006 international conference on Advanced Web and Network Technologies, and Applications
Interactive visualization for network and port scan detection

RAID'05 Proceedings of the 8th international conference on Recent Advances in Intrusion Detection
A survey of security visualization for computer network logs

Security and Communication Networks
Visual analysis of complex firewall configurations

Proceedings of the Ninth International Symposium on Visualization for Cyber Security
MalwareVis: entity-based visualization of malware network traces

Proceedings of the Ninth International Symposium on Visualization for Cyber Security
SPTrack: visual analysis of information flows within SELinux policies and attack logs

AMT'12 Proceedings of the 8th international conference on Active Media Technology
Review: A survey of network flow applications

Journal of Network and Computer Applications
Flexible web visualization for alert-based network security analytics

Proceedings of the Tenth Workshop on Visualization for Cyber Security
NAVSEC: a recommender system for 3D network security visualizations

Proceedings of the Tenth Workshop on Visualization for Cyber Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Most visualizations of security-related network data require large amounts of finely detailed, high-dimensional data. However, in some cases, the data available can only be coarsely detailed because of security concerns or other limitations. How can interesting security events still be discovered in data that lacks important details, such as IP addresses, network security alarms, and labels? In this paper, we discuss a system we have designed that takes very coarsely detailed data--basic, summarized information of the activity on each TCP port during each given hour--and uses visualization to help uncover interesting security events.