Finding anomalies in time-series using visual correlation for interactive root cause analysis

Abstract

Monitoring computer networks often includes gathering vast amounts of time-series data from thousands of computer systems and network devices. Threshold alerting is easy to accomplish with state-of-the-art technologies. However, to find correlations and similar behaviors between the different devices is challenging. We developed a visual analytics application to tackle this challenge by integrating similarity models and analytics combined with well-known, but taskadapted, time-series visualizations. We show in a case study, how this system can be used to visually identify correlations and anomalies in large data sets and identify and investigate security-related events.

Visual Analysis of Time‐Series Similarities for Anomaly Detection in Sensor Networks

“…We shed light on single techniques that are most closely related. Stoffel et al present a client‐server visual analytics systems for anomaly detection in computer networks [SFK13]. Its main views show a collection of vertically oriented line charts that are compared with a reference model of the data.…”

Security in Process: Visually Supported Triage Analysis in Industrial Process Data

“…Results from different anomaly detection approaches have been visualized in different ways. Stoffel et al provide a visualization combining multiple data sources that monitor a computer network [27]. Their visualization relies on well-known time series visualizations.…”

Visualizing the insider threat: challenges and tools for identifying malicious user activity

“…Since the analyst can specify queries, this means the problem space is not confined, however it does rely on the creation of well-defined queries by the analyst to identify insider threat behaviour. Stoffel et al [23] propose a visual analytics application for identifying correlations between different networked devices, based on time-series anomaly detection and similarity models. They focus primarily at the network traffic level, and so they do not currently consider other attributes related to insider threat such as file storage systems and USB connected devices.…”