VisFlowCormect: NetFlow visualizations of link relationships for security situational awareness

VizSEC/DMSEC '04: Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security

Volumn , Issue , 2004, Pages 26-34

  Yin, Xiaoxin ^a   Yurcik, William ^a   Treaster, Michael ^a   Li, Yifan ^a   Lakkaraju, Kiran ^a  

^a UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

Author keywords

Link Analysis; Link Relationships; NetFlows; Parallel Axes; Parallel Coordinates; Security Situational Awareness; Security Visualization

Indexed keywords

LINK ANALYSIS; LINK RELATIONSHIPS; NETFLOWS; PARALLEL AXES; PARALLEL COORDINATES; SECURITY SITUATIONAL AWARENESS; SECURITY VISUALIZATION;

COMPUTER NETWORKS; COMPUTER SOFTWARE; DATA MINING; DISTRIBUTED COMPUTER SYSTEMS; INTERFACES (COMPUTER); TELECOMMUNICATION TRAFFIC;

SECURITY OF DATA;

EID: 13944256121     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (37)

1. C. Abaci, Y. Li, K. Lakkaraju, X. Yin, and W. Yurcik. Correlation Between NetFlow System and Network Views for Intrusion Detection In Workshop on Link Analysis, Counter-terrorism, and Privacy held in conjunction with the SIAM International Conference on Data Mining (ICDM), 2004.
2. C. Abad, J. Taylor, C. Sengul, W. Yurcik, Y. Zhou, and K. Rowe. Log correlation for intrusion detection: A proof of concept. In Annual Computer Security Applications Conference (ACSAC), 2003.
3. S. Acharyya and J. Ghosh. A maximum entropy framework for higher order link analysis on directed graphs. In Workshop on Link Analysis for Detecting Complex Behavior (LinkKDD), August 2003.
4. Analyst's notebook software, www.i2inc.com/Products/Analysts_Notebook/default.asp.
5. D. Barbara, J. Couto, S. Jajodia, L. Popyack, and N. Wu. Adam: Detecting intrusions by data mining. In Proceedings of the IEEE Workshop on Information Assurance and Security, June 2001.
6. R. A. Becker, S. G. Eick, and A. R. Wilks. Visualizing network data. IEEE Transactions on Visualization and Computer Graphics, 1(1):16-28, 1995.
7. K. Bollacker, S. Lawrence, and C. L. Giles. CiteSeer: An autonomous web agent for automatic retrieval and identification of interesting publications. In Proceedings of the Second International Conference on Autonomous Agents, pages 116-123, New York, 1998. ACM Press.
8. J. Brutlag. Aberrant behavior detection in time series for network monitoring. In Proceedings of the USENIX Fourteenth System Administration Conference LISA XIV, New Orleans, LA, December 2000.
9. C. Bullard. Audit record generation and utilization system (argus), http://www.qosient.com/argus/ and ftp://ftp.andrew.emu.edu/pub/argus.
10. Clementine software, www.spss.com/clementine/.
11. F. Cuppens and A. Mige. Alert correlation in a cooperative intrusion detection framework. In Proceedings of the 2002 IEEE Symposium on Security and Privacy, page 202. IEEE Computer Society, 2002.
12. H. Debar and A. Wespi. Aggregation and correlation of intrusion-detection alerts. In Proceedings of-the 4th International Symposium on Recent Advances in Intrusion Detection, pages 85-103. Springer-Verlag, 2001.
13. R. Erbacher. Visual behavior characterization for intrusion detection in large scale systems, September 2001.
14. D. Estrin, M. Handley, J. Heidemann, S. McCanne, Y. Xu, and H. Yu. Network visualization with nam, the vint network animator. Computer, 33(11):63-68, 2000.
15. K. Fox, R. Henning, J. Reed, and R. Simonian. A neural network approach towards intrusion detection. Technical report, Harris Corporation, July 1990.
16. J. G. Goodall, A. Komlodi, and W. G. Lutters. Information visualization for intrusion detection analysis: A needs assessment of systems and network security experts. In Workshop on Statistical and Machine Learning Techniques in Computer Intrusion Detection, Fairfax, VA, 2003.
17. A. Inselberg. Parallel coordinates for multidimensional displays. In Spatial Information Technologies for Remote Sensing Today and Tomorrow, pages 318-322, 1984.
18. A. Inselberg and B. Dimsdale. Parallel coordinates: a tool for visualizing multidimensional geometry. In IEEE Visualization '90 Proceedings, pages 361-378. IEEE Computer Society, October 1990.
19. J. M. Kleinberg. Authoritative sources in a hyperlinked environment. J. ACM, 46(5):604-632, 1999.
20. C. Kruegel, T. Toth, and C. Kerer. Decentralized event correlation for intrusion detection. In International Conference on Information Security and Cryptology (ICISC), Lecture Notes in Computer Science. Springer Verlag, December 2001.
21. K. Lakkaraju, W. Yurcik, A. Lee, R. Bearavolu, Y. Li, and X. Yin. NVisionIP: NetFlow Visualizations of System State for Security Situational Awareness. In ACM CCS Workshop on Visualization and Data Mining for Computer Security (VizSEC/DMSEC) held in conjunction with the 11th ACM Conference on Computer and Communications Security, 2004.
22. W. Lee, S. J. Stolfo, and K. W. Mok. A data mining framework for building intrusion detection models. In IEEE Symposium on Security and Privacy, pages 120-132, 1999.
23. J. Mena. Investigative Data Mining for Security and Criminal Detection. Butterworth Heinemann, 2003.
24. Netflow services and applications. Technical report, Cisco Systems, 1999.
25. Netmap software, www.netmapanalytics.com.
26. A. Y. Ng, A. X. Zheng, and M. I. Jordan. Stable algorithms for link analysis. In Proc. 24th Annual Intl. ACM SIGIR Conference. ACM, 2001.
27. L. Page, S. Brin, R. Motwani, and T. Winograd. The pagerank citation ranking: Bringing order to the web. Technical report, Stanford Digital Library Technologies Project, 1998.
28. V. Paxson. Bro: a system for detecting network intruders in real-time. Computer Networks (Amsterdam, Netherlands: 1999), 31(23-24):2435-2463, 1999.
29. D. Plonka. Flowscan: A network traffic flow reporting and visualization tool. In Proceedings of the USENIX Fourteenth System Administration Conference LISA XIV, December 2000.
30. Polyanalyst software. www.megaputer.com/products/pa/index.php3.
31. Security incident fusion tools (sift). www.ncassr.org/projects/sift/.
32. S. T. Teoh, K.-L. Ma, S. F. Wu, and X. Zhao. Case study: Interactive visualization for internet security. In Proceedings of 13th IEEE Visualization Conference, 2002.
33. Visuallinks suite, www.visualanalytics.com/Products/VL3-0Features.cfm.
34. E. Wegman. Hyperdimensional data analysis using parallel coordinates. Journal of the American Statistical Association, 85:664-675, 1990.
35. X. Yin, W. Yurcik, Y. Li, K. Lakkaraju, and C. Abad. VisFlowConnect: Providing Security Situational Awareness by Visualizing Network Traffic Flows. In Workshop on Information Assurance (WIA04) held in conjunction with the 23rd IEEE International Performance Computing and Communications Conference (IPCCC), 2004.
36. W. Yurcik, J. Barlow, K. Lakkaraju, and J. Rosendale. A prototype tool for visual data mining of network traffic for intrusion detection. In 3rd IEEE International Conference on Data Mining (ICDM), Workshop on Data Mining for Computer Security (DMSEC), 2003.
37. J. Zhu, J. Hong, and J. G. Hughes. Pagecluster: Mining conceptual link hierarchies from web log files for adaptive web site navigation. ACM Trans. Inter. Tech., 4(2): 185-208, 2004.