A b s h c tinformation and minimize any mental transformations that w e present a novel Paradigm for visual correlation of network alerts from disparate logs. This paradigm facilitates and promotes situational awareness in complex network enmust be applied to the data. O u r goal is t o enable the users to quickly decide how pervasive and how severe problems vironments. Our approach is based on the notion that, by definition, a n alert must posses three attributes, namely: What, When, and Where. This fundamental premise, which WO term w 3 , provides a vehicle for comparing between seemingly disparate events. We propose a concise and scalable representation of these three attributes, that leads to a flexible visualisation tool that is also clear and intuitive t o use.Within our system, alerts can be grouped and viewed hierarchically with respect to both their type, i.e., the What, and t o their Where attributes. Further understanding is gained by displaying the temporal distribution of alerts to reveal complex attack trends. Finally, w e propose a set of visual metaphor extensions that augment the proposed paradigm and enhance users' situational awareness. These metaphors direct the attention of users t o many-t-one correlations within the current display helping them detect abnormal network activity.
The application of science and education to computerrelated crime forensics is still largely limited to law enforcement organizations. Building a suitable workforce development program could support the rapidly growing field of computer and network forensics.
The goal of our project is to create a set of next-generation cyber situational-awareness capabilities with applications to other domains in the long term. The objective is to improve the decision-making process to enable decision makers to choose better actions. To this end, we put extensive effort into making certain that we had feedback from network analysts and managers and understand what their genuine needs are. This article discusses the cognitive task-analysis methodology that we followed to acquire feedback from the analysts. This article also provides the details we acquired from the analysts on their processes, goals, concerns, the data and metadata that they analyze. Finally, we describe the generation of a novel task-flow diagram representing the activities of the target user base.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.