Situ: Identifying and Explaining Suspicious Behavior in Networks

Abstract

Despite the best efforts of cyber security analysts, networked computing assets are routinely compromised, resulting in the loss of intellectual property, the disclosure of state secrets, and major financial damages. Anomaly detection methods are beneficial for detecting new types of attacks and abnormal network activity, but such algorithms can be difficult to understand and trust. Network operators and cyber analysts need fast and scalable tools to help identify suspicious behavior that bypasses automated security systems, but operators do not want another automated tool with algorithms they do not trust. Experts need tools to augment their own domain expertise and to provide a contextual understanding of suspicious behavior to help them make decisions. In this paper we present Situ, a visual analytics system for discovering suspicious behavior in streaming network data. Situ provides a scalable solution that combines anomaly detection with information visualization. The system's visualizations enable operators to identify and investigate the most anomalous events and IP addresses, and the tool provides context to help operators understand why they are anomalous. Finally, operators need tools that can be integrated into their workflow and with their existing tools. This paper describes the Situ platform and its deployment in an operational network setting. We discuss how operators are currently using the tool in a large organization's security operations center and present the results of expert reviews with professionals.

Security Operations Center: A Systematic Study and Open Challenges

“…Data Collection [37], [47], [80], [103], [104], [107], [111], [127]- [132] Analysis & Detection [13], [35], [41], [43], [55], [56], [84], [133]- [157] Presentation [9], [12], [13], [80], [97], [99], [112], [127], [158]- [170] V-B2). As the interface between people and machines, the presentation of data and analysis results is of particular interest in a SOC context.…”

“…However, they also present the model visually to enable the machine learning model's decisions to be understood. The Situ platform [13] has the goal to visualize the context of an incident for leveraging the experience of security experts. In contrast to the approaches described above, the CyberCOP [12], [99], [160] platform relies on three-dimensional visualization.…”

“…Identifying threats and incidents gets increasingly harder as IT infrastructures grow and expand from the cyberspace into the physical world, for example through the use of cyberphysical systems [83]. Current automated threat detection tools work pretty well for detecting well-known attacks, as they operate based on signatures and attack patterns [13], [159]. Therefore, unknown situations remain undetected as no rule is defined for them yet.…”

“…We identified some work partially relevant to our approach which is trying to get a more hands-on understanding of SOCs. The authors of the respective publications use semistructured interviews [2], [7]- [11], on-site visits [2], [12], case studies [13], or ethnographic fieldwork [14]- [17]. These publications derive their definition of SOCs following a bottom-up approach leading to a limited understanding of SOCs.…”

Visualization of Anomalies using Graph-Based Anomaly Detection

“…Liao and Striegel (Liao and Striegel 2012) propose a differential anomaly visualization by reducing the granularity of network components to communities which increases network shift tolerance and scalability. Situ (Goodall et al 2019) is a visualization platform that takes in a stream of network data and performs probability-based anomaly detection before presenting information on suspicious IPs through multiple views.…”