InSight2: A Modular Visual Analysis Platform for Network Situational Awareness in Large-Scale Networks

Abstract

The complexity and throughput of computer networks are rapidly increasing as a result of the proliferation of interconnected devices, data-driven applications, and remote working. Providing situational awareness for computer networks requires monitoring and analysis of network data to understand normal activity and identify abnormal activity. A scalable platform to process and visualize data in real time for large-scale networks enables security analysts and researchers to not only monitor and study network flow data but also experiment and develop novel analytics. In this paper, we introduce InSight2, an open-source platform for manipulating both streaming and archived network flow data in real time that aims to address the issues of existing solutions such as scalability, extendability, and flexibility. Case-studies are provided that demonstrate applications in monitoring network activity, identifying network attacks and compromised hosts and anomaly detection.

Mod2Dash: A Framework for Model-Driven Dashboards Generation

“…All services in the backend are disclosed by RESTful APIs, which are written by Flask 15 (a lightweight web application framework) and Swagger 16 (an interface description language for describing RESTful APIs). The backend service is deployed by Gunicorn 17 (a Python WSGI HTTP Server).…”

“…The proposed dashboard (Figure 11) enables operators to identify and investigate the situation and provides context to help operators understand the situation. Kodituwakku et al [15] propose a visual analysis platform (Figure 12) for visualizing real-time data in large-scale networks to provide computer network CSA for security analysts and researchers.…”

“…12. Dashboard that proposed by Kodituwakku, Keller and Gregor [15] in 2020 (left) and the replica generated by Mod2Dash approach (right). could be selected for the final collection.…”

“…We found the maximal number using different Visualization Technique in a single dashboard is 7, and the minimal is 2, with an average of 4. For example, the dashboard in [15] (Figure 12) uses 19 widgets to monitor real-time and large-scale networks by applying 7 different visualization techniques (i.e., Gauge, Single Value, Area Chart, Column Chart, Word Cloud, Ring, and Map). • Interactions in this study are focused more on dashboard-level and widget-level rather than the interactions in a chart.…”