Visual Analytics for Cyber Security Domain: State-of-the-Art and Challenges

Damaševičius, Robertas; Toldinas, Jevgenijus; Venčkauskas, Algimantas; Grigaliūnas, Šarūnas; Morkevičius, Nerijus; Jukavicius, Vaidas

doi:10.1007/978-3-030-30275-7_20

Cited by 9 publications

(10 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While there are numerous approaches to detect and mitigate cyber attacks against critical infrastructures, including IoT networks, the majority of studies fail to take into account their integration into a single control system [40]. Data from multiple cyber security modules can quickly become complex and large, and a user-friendly method to effectively utilize such data is through visualization [41], which is enabled though data mining and statistics [42]. Visualizations should provide a receptive method, enhancing the security operators' knowledge to allow them to discover explanations for observed anomalous situations in the network [43].…”

Section: Previous Work In Visual Analytics Systemsmentioning

confidence: 99%

“…Additionally, the application of the visualization of cyber-security-related incidents can enhance cyber security awareness, even in nonexpert users [44] and increase threat-and security-related knowledge transfer between users [45]. For readers further interested in this subject, there are numerous reviews on network security visualization, such as [41][42][43].…”

Section: Previous Work In Visual Analytics Systemsmentioning

confidence: 99%

See 1 more Smart Citation

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

et al. 2022

View full text Add to dashboard Cite

The Internet of Things (IoT) encompasses multiple fast-emerging technologies controlling and connecting millions of new devices every day in several application domains. The increased number of interconnected IoT devices, their limited computational power, and the evolving sophistication of cyber security threats, results in increased security challenges for the IoT ecosystem. The diversity of IoT devices, and the variety of QoS requirements among several domains of IoT application, impose considerable challenges in designing and implementing a robust IoT security solution. The aim of this paper is to present an efficient, robust, and easy-to-use system, for IoT cyber security operators. Following a by-design security approach, the proposed system is a platform comprising four distinct yet cooperating components; a distributed AI-enhanced detection of potential threats and anomalies mechanisms, an AI-based generation of effective mitigation strategies according to the severity of detected threats, a system for the verification of SDN routing decisions along with network- and resource-related policies, and a comprehensive and intuitive security status visualization and analysis. The distributed anomaly detection scheme implementing multiple AI-powered agents is deployed across the IoT network nodes aiming to efficiently monitor the entire network infrastructure. Network traffic data are fed to the AI agents, which process consecutive traffic samples from the network in a time series analysis manner, where consecutive time windows framing the traffic of the surrounding nodes are processed by a graph neural network algorithm. Any detected anomalies are handled by a mitigation engine employing a distributed neural network algorithm, which exploits the recorded anomalous events and deploys appropriate responses for optimal threat mitigation. The implemented platform also includes the hypothesis testing module, and a multi-objective optimization tool for the quick verification of routing decisions. The system incorporates visualization and analytics functionality and a customizable user interface.

show abstract

Section: Previous Work In Visual Analytics Systemsmentioning

confidence: 99%

Section: Previous Work In Visual Analytics Systemsmentioning

confidence: 99%

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

et al. 2022

View full text Add to dashboard Cite

show abstract

Section: Introductionmentioning

confidence: 99%

“…In response to these challenges, there is a growing inclination in the cybersecurity domain towards the integration of visualization techniques with traditional NIDSs [6][7][8]. Despite this interest, many current visualization approaches fall short in effectively representing the technical ramifications of cyberattacks [6][7][8]. There remains a significant need for a cyber visualization tool that seamlessly integrates with NIDS alerts and provides real-time comprehensive insights into the threat landscape.…”

Section: Introductionmentioning

confidence: 99%

Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization

Muhati,

Rawat

2024

JCP

View full text Add to dashboard Cite

The exponential growth in data volumes, combined with the inherent complexity of network algorithms, has drastically affected network security. Data activities are producing voluminous network logs that often mask critical vulnerabilities. Although there are efforts to address these hidden vulnerabilities, the solutions often come at high costs or increased complexities. In contrast, the potential of open-source tools, recognized for their security analysis capabilities, remains under-researched. These tools have the potential for detailed extraction of essential network components, and they strengthen network security. Addressing this gap, our paper proposes a data analytics-driven network anomaly detection model, which is uniquely complemented with a visualization layer, making the dynamics of cyberattacks and their subsequent defenses distinctive in near real-time. Our novel approach, based on network scanning tools and network discovery services, allows us to visualize the network based on how many IP-based networking devices are live, then we implement a data analytics-based intrusion detection system that scrutinizes all network connections. We then initiate mitigation measures, visually distinguishing malicious from benign connections using red and blue hues, respectively. Our experimental evaluation shows an F1 score of 97.9% and a minimal false positive rate of 0.3% in our model, demonstrating a marked improvement over existing research in this domain.

show abstract

“…In this paper, we follow the vision of Grobler et al [20] by acknowledging user, usage, and usability (3U's) as the three principal elements of cyber security. In the cyber security domain, the effective analysis of the data using artificial intelligence techniques allows to deduce high value insights that allow domain experts to design practical strategies to mitigate cyberattacks and ensure decision support [21,22]. Many internet applications, such as online advertising and recommendation systems, rely on CTR prediction to anticipate the possibility that a user would click on an ad or product.…”

Section: Introductionmentioning

confidence: 99%

Usability and Security Testing of Online Links: A Framework for Click-Through Rate Prediction Using Deep Learning

Damaševičius

Zailskaitė-Jakštė

2022

Electronics

Self Cite

View full text Add to dashboard Cite

The user, usage, and usability (3U’s) are three principal constituents for cyber security. The effective analysis of the 3U data using artificial intelligence (AI) techniques allows to deduce valuable observations, which allow domain experts to design practical strategies to alleviate cyberattacks and ensure decision support. Many internet applications, such as internet advertising and recommendation systems, rely on click-through rate (CTR) prediction to anticipate the possibility that a user would click on an ad or product, which is key for understanding human online behaviour. However, online systems are prone to click on fraud attacks. We propose a Human-Centric Cyber Security (HCCS) model that additionally includes AI techniques targeted at the key elements of user, usage, and usability. As a case study, we analyse a CTR prediction task, using deep learning methods (factorization machines) to predict online fraud through clickbait. The results of experiments on a real-world benchmark Avazu dataset show that the proposed approach outpaces (AUC is 0.8062) other CTR forecasting approaches, demonstrating the viability of the proposed framework.

show abstract

Visual Analytics for Cyber Security Domain: State-of-the-Art and Challenges

Cited by 9 publications

References 43 publications

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization

Usability and Security Testing of Online Links: A Framework for Click-Through Rate Prediction Using Deep Learning

Contact Info

Product

Resources

About