An information visualization framework for intrusion detection

This paper reports a framework for designing information visualization (IV) tools for monitoring and analysis activities. In this user study, the domain for these activities is network intrusion detection (ID). User-centered design methods have been widely used for many years, however, innovative IV displays are often developed with limited consideration of user needs in the context of real-life problems. While it can be argued that this is required to generate creative new solutions, the resulting tools often do not support actual users in their daily work. Several IV tools have been developed to support ID, but there is little evidence that these solutions address the needs of the users. We studied ID analysts' daily activities in order to understand their routine work practices and the need for designing IV tools. We developed a three-phase process model that frames corresponding requirements for IV tools. This model significantly extends the scope of contemporary IV for ID tools in novel ways.