Visual support for analyzing network traffic and intrusion detection events using TreeMap and graph representations

Abstract

Network security depends heavily on automated Intrusion Detection Systems (IDS) to sense malicious activity. Unfortunately, IDS often deliver both too much raw information, and an incomplete local picture, impeding accurate assessment of emerging threats. We propose a system to support analysis of IDS logs, that visually pivots large sets of Net-Flows. In particular, two visual representations of the flow data are compared: a TreeMap visualization of local network hosts, which are linked through hierarchical edge bundles with the external hosts, and a graph representation using a force-directed layout to visualize the structure of the host communication patterns. Three case studies demonstrate the capabilities of our tool to 1) analyze service usage in a managed network, 2) detect a distributed attack, and 3) investigate hosts in our network that communicate with suspect external IPs.

Visualizing Request-Flow Comparison to Aid Performance Diagnosis in Distributed Systems

“…As in this study, the tool uses automated processes to direct users' attention, and the authors observe that automation failures inhibit users' understanding. In another system targeted at network diagnosis, Mansmann et al observe that automated tools alone are limited in utility without effective presentation of results [26]. Like many other network monitoring efforts, however, the proposed solution primarily focuses on improving display of the underlying data rather than the output of an automated tool.…”

“…Though complete automation would be ideal, the complexity of modern systems and the problems that arise in them ensure that this human-in-the-loop model will be dominant for the foreseeable future. As such, many researchers recognize the need for localization tools to present their results as clearly as possible [26,29]. But apart from from a few select instances [23,26], little research has been conducted on how to do so.…”

Visualizing Network Traffic to Understand the Performance of Massively Parallel Simulations

“…However, such layouts are highly application dependent. Additional work has been done in attempts to understand flow across a network by comparing graph-based flow visualization with TreeMaps for local network monitoring [19]. Here too, both the problem space and necessary analysis techniques are highly application dependent.…”

QuizMap: Open Social Student Modeling and Adaptive Navigation Support with TreeMaps

“…By dividing the display area into a nested sequence of rectangles whose areas are associated to attributes of the data set, it effectively illustrates the structural information with slices and dices. TreeMaps have been applied to a wide variety of domains ranging from financial analysis [23], petroleum engineering [24] to network security analysis [25]. Some studies have focused on specialized techniques to visualize large number items on a TreeMap without aggregation [26].…”