Visual discovery in computer network defense

Anita D. D'Amico; John R. Goodall; Daniel R. Tesone; Jason K. Kopylec

doi:10.1109/MCG.2007.137

Visual discovery in computer network defense

Anita D. D'Amico, John R. Goodall, Daniel R. Tesone, Jason K. Kopylec

Research output: Contribution to journal › Article › peer-review

42 Scopus citations

Abstract

Computer network defense (CND) requires analysts to detect both known and novel forms of attacks in massive volumes of network data. Visualization tools can potentially assist in the discovery of suspicious patterns of network activity and relationships between seemingly disparate security events, but few CND analysts are leveraging visualization technologies in their current practice. To address this, we created a new visualization framework, VIAssist, based on a comprehensive cognitive task analysis of CND analysts. We designed VIAssist to fit the work practices and operational environments of those analysts. This article describes the major visual analytic features of VIAssist that address the needs of CND analysts, including its coordinated visualizations and interactive report building capabilities. A scenario illustrates how it can be used to discover the unexpected in network flow data.

Original language	English
Pages (from-to)	20-27
Number of pages	8
Journal	IEEE Computer Graphics and Applications
Volume	27
Issue number	5
DOIs	https://doi.org/10.1109/MCG.2007.137
State	Published - Sep 2007
Externally published	Yes

Funding

The US Department of Defense sponsored VIAssist’s development under contract F30602-03-C-0260, with the Air Force Research Laboratory (AFRL) as the contracting agency. We acknowledge the continuous beneficial guidance during VIAssist’s development and testing offered by Kirsten Whitley of the US Department of Defense; Walt Tirenin of the AFRL in Rome, New York; and Robert Nine and the J2 staff of the Joint Task Force on Global Network Operations. The views and conclusions contained in this document are those of the authors, and should not be interpreted as representing the official policies, either expressed or implied, of the US government.

Funders	Funder number
US Department of Defense	F30602-03-C-0260
Air Force Research Laboratory	AFRL

Keywords

Information security
Information visualization
Situational awareness
User-centered design
Visual analytics

Access to Document

10.1109/MCG.2007.137

Cite this

@article{79e8d5fe65254991976fa96c5a932c54,

title = "Visual discovery in computer network defense",

abstract = "Computer network defense (CND) requires analysts to detect both known and novel forms of attacks in massive volumes of network data. Visualization tools can potentially assist in the discovery of suspicious patterns of network activity and relationships between seemingly disparate security events, but few CND analysts are leveraging visualization technologies in their current practice. To address this, we created a new visualization framework, VIAssist, based on a comprehensive cognitive task analysis of CND analysts. We designed VIAssist to fit the work practices and operational environments of those analysts. This article describes the major visual analytic features of VIAssist that address the needs of CND analysts, including its coordinated visualizations and interactive report building capabilities. A scenario illustrates how it can be used to discover the unexpected in network flow data.",

keywords = "Information security, Information visualization, Situational awareness, User-centered design, Visual analytics",

author = "D'Amico, {Anita D.} and Goodall, {John R.} and Tesone, {Daniel R.} and Kopylec, {Jason K.}",

year = "2007",

month = sep,

doi = "10.1109/MCG.2007.137",

language = "English",

volume = "27",

pages = "20--27",

journal = "IEEE Computer Graphics and Applications",

issn = "0272-1716",

publisher = "Institute of Electrical and Electronics Engineers",

number = "5",

}

TY - JOUR

T1 - Visual discovery in computer network defense

AU - D'Amico, Anita D.

AU - Goodall, John R.

AU - Tesone, Daniel R.

AU - Kopylec, Jason K.

PY - 2007/9

Y1 - 2007/9

N2 - Computer network defense (CND) requires analysts to detect both known and novel forms of attacks in massive volumes of network data. Visualization tools can potentially assist in the discovery of suspicious patterns of network activity and relationships between seemingly disparate security events, but few CND analysts are leveraging visualization technologies in their current practice. To address this, we created a new visualization framework, VIAssist, based on a comprehensive cognitive task analysis of CND analysts. We designed VIAssist to fit the work practices and operational environments of those analysts. This article describes the major visual analytic features of VIAssist that address the needs of CND analysts, including its coordinated visualizations and interactive report building capabilities. A scenario illustrates how it can be used to discover the unexpected in network flow data.

AB - Computer network defense (CND) requires analysts to detect both known and novel forms of attacks in massive volumes of network data. Visualization tools can potentially assist in the discovery of suspicious patterns of network activity and relationships between seemingly disparate security events, but few CND analysts are leveraging visualization technologies in their current practice. To address this, we created a new visualization framework, VIAssist, based on a comprehensive cognitive task analysis of CND analysts. We designed VIAssist to fit the work practices and operational environments of those analysts. This article describes the major visual analytic features of VIAssist that address the needs of CND analysts, including its coordinated visualizations and interactive report building capabilities. A scenario illustrates how it can be used to discover the unexpected in network flow data.

KW - Information security

KW - Information visualization

KW - Situational awareness

KW - User-centered design

KW - Visual analytics

UR - http://www.scopus.com/inward/record.url?scp=34548778120&partnerID=8YFLogxK

U2 - 10.1109/MCG.2007.137

DO - 10.1109/MCG.2007.137

M3 - Article

C2 - 17913021

AN - SCOPUS:34548778120

SN - 0272-1716

VL - 27

SP - 20

EP - 27

JO - IEEE Computer Graphics and Applications

JF - IEEE Computer Graphics and Applications

IS - 5

ER -

Visual discovery in computer network defense

Abstract

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this