TY - GEN
T1 - Preserving the big picture
T2 - IEEE Workshop on Visualization for Computer Security 2005, VizSEC 05
AU - Goodall, John R.
AU - Lutters, Wayne G.
AU - Rheingans, Penny
AU - Komlodi, Anita
PY - 2005
Y1 - 2005
N2 - When performing packet-level analysis in intrusion detection, analysts often lose sight of the "big picture" while examining these low-level details. In order to prevent this loss of context and augment the available tools for intrusion detection analysis tasks, we developed an information visualization tool, the Time-based Network traffic Visualizer (TNV). TNV is grounded in an understanding of the work practices of intrusion detection analysts, particularly foregrounding the overarching importance of context and time in the process of intrusion detection analysis. The main visual component of TNV is a matrix showing network activity of hosts over time, with connections between hosts superimposed on the matrix, complemented by multiple, linked views showing port activity and the details of the raw packets. Providing low-level textual data in the context of a high-level, aggregated graphical display enables analysts to examine packet-level details within the larger context of activity. This combination has the potential to facilitate the intrusion detection analysis tasks and help novice analysts learn what constitutes "normal" on a particular network.
AB - When performing packet-level analysis in intrusion detection, analysts often lose sight of the "big picture" while examining these low-level details. In order to prevent this loss of context and augment the available tools for intrusion detection analysis tasks, we developed an information visualization tool, the Time-based Network traffic Visualizer (TNV). TNV is grounded in an understanding of the work practices of intrusion detection analysts, particularly foregrounding the overarching importance of context and time in the process of intrusion detection analysis. The main visual component of TNV is a matrix showing network activity of hosts over time, with connections between hosts superimposed on the matrix, complemented by multiple, linked views showing port activity and the details of the raw packets. Providing low-level textual data in the context of a high-level, aggregated graphical display enables analysts to examine packet-level details within the larger context of activity. This combination has the potential to facilitate the intrusion detection analysis tasks and help novice analysts learn what constitutes "normal" on a particular network.
KW - Information visualization
KW - Intrusion detection
KW - Network analysis
KW - Network visualization
UR - http://www.scopus.com/inward/record.url?scp=33749532337&partnerID=8YFLogxK
U2 - 10.1109/VIZSEC.2005.1532065
DO - 10.1109/VIZSEC.2005.1532065
M3 - Conference contribution
AN - SCOPUS:33749532337
SN - 0780394771
SN - 9780780394773
SN - 0780394771
SN - 9780780394773
T3 - IEEE Workshop on Visualization for Computer Security 2005, VizSEC 05, Proceedings
SP - 47
EP - 54
BT - IEEE Workshop on Visualization for Computer Security 2005, VizSEC 05, Proceedings
Y2 - 26 October 2005 through 26 October 2005
ER -