A Novel Visualization Approach for Efficient Network Scans Detection

Abstract

Network scans visualization provides very effective means for to detection large scale network scans. Many visualization methods have been developed to monitor network traffic, but all the techniques or tools still heavily rely on human detection. They seldom consider the importance of network event characteristics to the network data visualization, and cannot detect slow scans, hidden scans etc. In this paper a visual interactive network scans detection system called ScanViewer is designed to represent traffic activities that reside in network flows and their patterns. The ScanViewer combines the characteristics of network scan with novel visual structures, and utilizes a set of different visual concepts to map the collected datagram to the graphs that emphasize their patterns. Additionally, a new tool named Localport is designed for to capture large-scale ports information. The experiments show that ScanViewer can not only detect network scans, port scans, distributed port scans, but also can detect the hidden scans etc.

P3D: A parallel 3D coordinate visualization for advanced network scans

“…However, brushing may become tedious when trying to select the behavior of one coordinate out of multiple coordinates. Scanveiwer [16] combines scatterplots, parallel coordinates, histograms and color maps into a single tool. However, occlusions due to large volumes of datasets result in cluttered visualizations and may cause data to be overlooked.…”

Detecting subtle port scans through characteristics based on interactive visualization

“…Visualization systems and tools have been substantially designed and implemented to detect port scanning and other network intrusions in the past decade [1,3,7,8,11,13]. One popular approach is to visualize network connections to identify port-scan patterns.…”

“…Conti and Abdullah visualized the packet information such as IP and port with parallel coordinate plots to identify port scanning [3]. Similarly, Jiawan et al used traffic activities among hosts and mapped the collected datagram to graphs that emphasize port-scan patterns [8]. However, the port-scan traffic in these two approaches may be obscured by high-volume normal traffic, and therefore the corresponding patterns cannot be effectively shown on the screen and then detected by the human eye.…”

Visualizing graph features for fast port scan detection

“…The hypothesis is that incorporating additional approaches to assist the visualization will provide more narrowly focused visual displays. Compared to earlier work that used visualization techniques for network scan detection [1,6,7], the proposed work is novel in the sense that graph-theoretical algorithms are used for preprocessing, and processed graph models instead of packet flows/connections are used in visual displays. In [6,1], a line is rendered to show a connection between a remote IP address and a local IP address and in [6] an additional histogram is used to show the number of datagrams of different type.…”

“…Compared to earlier work that used visualization techniques for network scan detection [1,6,7], the proposed work is novel in the sense that graph-theoretical algorithms are used for preprocessing, and processed graph models instead of packet flows/connections are used in visual displays. In [6,1], a line is rendered to show a connection between a remote IP address and a local IP address and in [6] an additional histogram is used to show the number of datagrams of different type. In [7], a 256x256 grid is used to plot the scans, where the x and y coordinates are the third and fourth bytes of the destination IP addresses scanned ("c" and "d" in the address a.b.c.d), and the color represents metrics based on statistical information regarding the arrival time at that IP address.…”