Large-Scale Network Monitoring for Visual Analysis of Attacks

Abstract

The importance of the Internet and our dependency on computer networks are steadily growing, which results in high costs and substantial consequences in case of successful intrusions, stolen data, and interrupted services. At the same time, a trend towards massive attacks against the network infrastructure is noticeable. Therefore, monitoring large networks has become an important field in practice and research. Through monitoring systems, attacks can be detected and analyzed to gain knowledge of how to better protect the network in the future. In the scope of this paper, we present a system to analyze NetFlow data using a relational database system. NetFlow records are linked with alerts from an intrusion detection system to enable efficient exploration of suspicious activity within the monitored network. Within the system, the monitored network is mapped to a TreeMap visualization, the attackers are arranged at the borders and linked using splines parameterized with prefix information. In a series of case studies, we demonstrate how the tool can be used to judge the relevance of alerts, to reveal massive distributed attacks, and to analyze service usage within a network.

Visual Analytics: Towards Intelligent Interactive Internet and Security Solutions

“…5. Analysis of a distributed network attack on the SSH service of a university network on May 11, 2008 using NFlowVis [7]. The circles on the outside represent hosts that attack the squared hosts in the internal network.…”

“…By means of the Visual Analytics application NFlowVis [7] we demonstrate in this section how the combination of automatic and visual analysis can help security experts to more efficiently derive meaning out of the vast amount of security events and traffic data, which is a characteristic of the field. In particular, we use traffic patterns, which are common for signature-based intrusion detection systems and one day of network traffic statistics (NetFlows) from the main gateway of a medium sized university, which amounts to approximately 10 GB of raw data.…”

A Visualization Method Based on Graph Database in Security Logs Analysis

“…Alsaleh et al [11] designed an open source system for intrusion detection and protection for PHP-based Web applications. At present, for the network security data visualization, many methods are used, such as matrix graph, tree diagram, folding map, map, thermal map, plane coordinate, three-dimensional graphics, scatter plot and radar map [12][13][14] . This article uses the graph database to visualize the event information to facilitate the forensic analysis of the event.…”

Flexible web visualization for alert-based network security analytics

“…Picviz [16] uses parallel coordinates to present relationships between multiple data dimensions like IP, port, packet number, TTL, and time. Treemaps [20] have been used to visualize hierarchical structures in network data, for example, in the NFlowVis system proposed by Fischer et al [3]. Scatterplots in PortVis and NVisionIP [8,10] highlight correlations between data dimensions.…”