A visualization paradigm for network intrusion detection

Abstract

A b s h c tinformation and minimize any mental transformations that w e present a novel Paradigm for visual correlation of network alerts from disparate logs. This paradigm facilitates and promotes situational awareness in complex network enmust be applied to the data. O u r goal is t o enable the users to quickly decide how pervasive and how severe problems vironments. Our approach is based on the notion that, by definition, a n alert must posses three attributes, namely: What, When, and Where. This fundamental premise, which WO term w 3 , provides a vehicle for comparing between seemingly disparate events. We propose a concise and scalable representation of these three attributes, that leads to a flexible visualisation tool that is also clear and intuitive t o use.Within our system, alerts can be grouped and viewed hierarchically with respect to both their type, i.e., the What, and t o their Where attributes. Further understanding is gained by displaying the temporal distribution of alerts to reveal complex attack trends. Finally, w e propose a set of visual metaphor extensions that augment the proposed paradigm and enhance users' situational awareness. These metaphors direct the attention of users t o many-t-one correlations within the current display helping them detect abnormal network activity.

Architectural Research in Information Visualization: 10 Years after

“…Rigorous scientific testing has demonstrated that dwelling in such data representation architectures allows people (i.e., network managers, traders, anesthesiologists, etc.) to make more accurate, faster, and better decisions than with existing systems [26,37,30,[42][43][44][53][54][55][56][57][58]. And they can do so while with reducing their cognitive load, stress, and training time.…”

Framework for Visualizing Browsing Patterns Captured in Computer Logs Using Data Mining Techniques

“…On the other hand, a longer periodicity could lead to a frame that does not have much connection to the frame displayed before the last refresh. The periodicity should be defined such that there is a balance the two issues, so that the frame of data that appears after the last refresh is not vastly different from the frame just before the refresh [6].…”

Pianola - Visualization of Multivariate Time-Series Security Event Data

“…Certain elements of the data are of key importance to the operator at this stage: event severity, target and time, or "the W3 of What, Where, When" [11]. These represent the minimum dimensionality that can be known in order to start building an actionable model of the situation (the date, time, IP and priority fields in the IDS alert logs).…”