FloVis: Flow Visualization System

Abstract

NetFlow data is routinely captured at the border of many enterprise networks. Although not as rich as full packetcapture data, NetFlow provides a compact record of the interactions between host pairs on either side of the monitored border. Analysis of this data presents a challenge to the security analyst due to its volume. We report preliminary results on the development of a suite of visualization tools that are intended to complement command line tools, such as those from the SiLK Tools, that are currently used by analysts to perform forensic analysis of NetFlow data. The current version of the tool set draws on three visual paradigms: activity diagrams that display various aspects of multiple individual host behaviors as color 1 coded time series, connection bundles that show the interactions among hosts and groups of hosts, and the NetBytes viewer that allows detailed examination of the port and volume behaviors of an individual host over a period of time. The system supports drill down for additional detail and pivoting that allows the analyst to examine the relationships among the displays. SiLK data is preprocessed into a relational database to drive the display modes, and the tools can interact with the SiLK system to extract additional data as necessary.

Security visualization tools and IPv6 addresses

“…The existing literature on security visualization also does not explicitly state that the focus is IPv4 traffic, but typically implicitly assumes that IPv4 is the underlying protocol of the analyzed network traffic. Several visualization tools [10,11,17] which provide good insight into remote IP behavior are limited to IPv4 addresses.…”

“…If a dual stack capture 3 is loaded, the tool will just ignore the IPv6 packets and not display them. NVisionIP [11] and Flovis [17] are other examples of tools where only 32-bit source addresses are currently supported. Koike et al [10] also describe a technique similar to NVisionIP in which source and destination addresses are visualized in a 2D matrix; only IPv4 addresses can be displayed.…”

Flow-inspector: a framework for visualizing network flow data using current web technologies

“…In [12], the authors present the client-based visualization tool FlowVis, which uses the SiLK tools for processing NetFlow data. They provide proofof-concept visualizations like activity plots, flow edge bundles, and network bytes viewer.…”

Accommodating IPv6 Addresses in Security Visualization Tools

“…The existing literature on security visualization also does not explicitly state that the focus is IPv4 traffic, but typically implicitly assumes that IPv4 is the underlying protocol of the analyzed network traffic. Several visualization tools [11,12,19] which provide good insight into remote IP behavior are limited to IPv4 addresses. Nakamae et al [18] (CAIDA) has also produced visualizations displaying IPv6 autonomous system (AS) interconnections [5].…”

“…If a dual stack capture (i.e., containing both IPv4 and IPv6 data) is loaded, the tool will just ignore the IPv6 packets and not display them. NVisionIP [12] and Flovis [19] are other examples of tools where only 32-bit source addresses are currently supported. Koike et al [11] also describe a technique similar to NVisionIP in which source and destination addresses are visualized in a 2D matrix; only IPv4 addresses can be displayed.…”