Visual comparison of network anomaly detectors with chord diagrams

Mazel, Johan; Fontugne, Romain; Fukuda, Kensuke

doi:10.1145/2554850.2554886

Cited by 5 publications

(3 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…MAWILab provides a collection of network traffic traces and IDS logs, captured from a backbone link in Japan for about two decades up to now [8] [9]. The captured traces contain the TCP/IP packet header information without payloads in pcap files.…”

Section: Description Of Mawilab Datamentioning

confidence: 99%

Generating Labeled Flow Data from MAWILab Traces for Network Intrusion Detection

Kim

Sim

Choi

2019

Proceedings of the ACM Workshop on Systems and Network Telemetry and Analytics

View full text Add to dashboard Cite

A growing issue in the modern cyberspace world is the direct identification of malicious activity over network connections. The boom of the machine learning industry in the past few years has led to the increasing usage of machine learning technologies, which are especially prevalent in the network intrusion detection research community. When utilizing these fairly contemporary techniques, the community has realized that datasets are pivotal for identifying malicious packets and connections, particularly ones associated with information concerning labeling in order to construct learning models. However, there exists a shortage of publicly available, relevant datasets to researchers in the network intrusion detection community. Thus, in this paper, we introduce a method to construct labeled flow data by combining the packet meta-information with IDS logs to infer labels for intrusion detection research. Specifically, we designed a NetFlow-compatible format due to the capability of a a large body of network devices, such as routers and switches, to export NetFlow records from raw traffic. In doing so, the introduced method at hand would aid researchers to access relevant network flow datasets along with label information.1.

show abstract

Section: Description Of Mawilab Datamentioning

confidence: 99%

Generating Labeled Flow Data from MAWILab Traces for Network Intrusion Detection

Kim

Sim

Choi

2019

Proceedings of the ACM Workshop on Systems and Network Telemetry and Analytics

View full text Add to dashboard Cite

show abstract

“…Chord diagrams are considered to scale well (Mazel et al, 2014;Krzywinski et al, 2009). However, if an industrial network is complex enough to render a unique chord diagram too confusing, simpler chord diagrams can be computed for each of the network segments.…”

Section: Related Workmentioning

confidence: 99%

“…Mazel et al (Mazel et al, 2014) use chord diagrams to perform a visual comparison of different Anomaly Detection Systems and their detection performance.…”

Section: Related Workmentioning

confidence: 99%

Visualizing Network Flows and Related Anomalies in Industrial Networks using Chord Diagrams and Whitelisting

Iturbe

Garitano

Zurutuza

et al. 2016

Proceedings of the 11th Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications

View full text Add to dashboard Cite

Industrial Control Systems are the set of specialized elements that monitor and control physical processes. Those systems are normally interconnected forming environments known as industrial networks. The particularities of these networks disallow the usage of traditional IT security mechanisms, while allowing other security strategies not suitable for IT networks. As industrial network traffic flows follow constant and repetitive patterns, whitelisting has been proved a viable approach for anomaly detection in industrial networks. In this paper, we present a network flow and related alert visualization system based on chord diagrams. The system represents the detected network flows within a time interval, highlighting the ones that do not comply the whitelisting rules. Moreover, it also depicts the network flows that, even if they are registered in the whitelist, have not been detected on the selected time interval (e.g. a host is down). Finally, the visualization system is tested with network data coming from a real industrial network.

show abstract

Supporting Social Network Analysis Using Chord Diagram in Process Mining

Jalali

2016

Lecture Notes in Business Information Processing

View full text Add to dashboard Cite

Visual comparison of network anomaly detectors with chord diagrams

Cited by 5 publications

References 18 publications

Generating Labeled Flow Data from MAWILab Traces for Network Intrusion Detection

Generating Labeled Flow Data from MAWILab Traces for Network Intrusion Detection

Visualizing Network Flows and Related Anomalies in Industrial Networks using Chord Diagrams and Whitelisting

Supporting Social Network Analysis Using Chord Diagram in Process Mining

Contact Info

Product

Resources

About