Countering Security Information Overload through Alert and Packet Visualization

Authors:
Gregory Conti;Kulsoom Abdullah;Julian Grizzard;John Stasko;John A. Copeland;Mustaque Ahamad;Henry L. Owen;Chris Lee
Affiliations:
Georgia Institute of Technology;Georgia Institute of Technology;Georgia Institute of Technology;Georgia Institute of Technology;Georgia Institute of Technology;Georgia Institute of Technology;Georgia Institute of Technology;Georgia Institute of Technology
Venue:
IEEE Computer Graphics and Applications
Year:
2006

Citing 7
Cited 9

Seesoft-A Tool for Visualizing Line Oriented Software Statistics

IEEE Transactions on Software Engineering - Special issue on software measurement principles, techniques, and environments
Technical Note: Visually Encoding Program Test Information to Find Faults in Software

INFOVIS '01 Proceedings of the IEEE Symposium on Information Visualization 2001 (INFOVIS'01)
Clustering intrusion detection alarms to support root cause analysis

ACM Transactions on Information and System Security (TISSEC)
Characteristics of internet background radiation

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
SnortView: visualization system of snort logs

Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security
Visual Exploration of Malicious Network Objects Using Semantic Zoom, Interactive Encoding and Dynamic Queries

VIZSEC '05 Proceedings of the IEEE Workshops on Visualization for Computer Security
IDS RainStorm: Visualizing IDS Alarms

VIZSEC '05 Proceedings of the IEEE Workshops on Visualization for Computer Security

An intelligent, interactive tool for exploration and visualization of time-oriented security data

Proceedings of the 3rd international workshop on Visualization for computer security
Tool update: high alarm count issues in IDS rainstorm

Proceedings of the 3rd international workshop on Visualization for computer security
Sesame: informing user security decisions with system visualization

Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
A unified approach to network traffic and network security visualisation

ICC'09 Proceedings of the 2009 IEEE international conference on Communications
Using geographic information systems for enhanced network security visualization

Proceedings of the 1st International Conference and Exhibition on Computing for Geospatial Research & Application
TVi: a visual querying system for network monitoring and anomaly detection

Proceedings of the 8th International Symposium on Visualization for Cyber Security
Monitoring large IP spaces with ClockView

Proceedings of the 8th International Symposium on Visualization for Cyber Security
Interactive analysis of computer scenarios through parallel coordinates graphics

ICCSA'12 Proceedings of the 12th international conference on Computational Science and Its Applications - Volume Part IV
DAEDALUS-VIZ: novel real-time 3D visualization for darknet monitoring-based alert system

Proceedings of the Ninth International Symposium on Visualization for Cyber Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

When given the task of securing a network, security analysts and network administrators typically face large volumes of security data that demand analysis. Selectively mapping elements of these flows to carefully crafted graphical displays can provide rapid insights while actively countering information overload. To this end, this article presents a generic framework for designing such visualization systems as well as results from the end-to-end design and implementation of two highly interactive systems. The first system focuses on increasing the utility of intrusion detection systems by providing information rich displays of network alerts. The second system provides new methods of visualizing network packets that enable the analyst to efficiently and effectively explore network traffic for malicious activity. To support their findings, the authors present the results of a user requirements study.