Passive visual fingerprinting of network attack tools

VizSEC/DMSEC '04: Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security

Volumn , Issue , 2004, Pages 45-54

  Conti, Gregory ^a   Abdullah, Kulsoom ^b  

^a Georgia Institute of Technology   (United States)

^b GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

Application fingerprinting; Information visualization; Network attack visualization; Operating system fingerprinting; Passive fingerprinting; Visual fingerprinting

Indexed keywords

ALGORITHMS; COMPUTER OPERATING SYSTEMS; INFORMATION ANALYSIS; NETWORK PROTOCOLS; OPTIMIZATION; RANDOM ACCESS STORAGE; SECURITY OF DATA; USER INTERFACES;

APPLICATION FINGERPRINTING; INFORMATION VISUALIZATION; NETWORK ATTACK VISUALIZATION; OPERATING SYSTEM FINGERPRINTING; PASSIVE FINGERPRINTING; VISUAL FINGERPRINTING;

COMPUTER NETWORKS;

EID: 20444438039     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1029208.1029216     Document Type: Conference Paper

References (35)

1. Teoh, S; Ma, K; Wu, F and Zhao, X. Case Study: Interactive Visualization for Internet Security, Proceedings of IEEE Information Visualization, 2002.
2. Teoh, S; Ma, K and Wu, F. A Visual Exploration Process for the Analysis of Internet Routing Data, Proceedings of IEEE Information Visualization, 2003.
3. Teoh, S. Graphical Presentation of Stepping-Stone Pairs Found. Initial Results, http://graphics.cs.ucdavis.edu/~steoh/research/tcpdump/tcpdump.html, last accessed April 2004.
4. Security Incident Fusion Tool, National Center for Advanced Secure Systems Research Group. http://www.ncassr.org/projects/sift/papers/, last accessed April 2004.
5. Cheswick, B and Burch, H. The Internet Mapping Project. http://research.lumeta.com/ches/map/, last accessed April 2004.
6. An Atlas of Cyberspaces. http://www.cybergeography.org/atlas/atlas.html, last accessed April 2004.
7. Marchette, D. Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint, Springer, 2001.
8. Erbacher, R and Frincke, D. Visual Behavior Characterization for Intrusion and Misuse Detection. Proceedings of the SPIE '2001 Conference on Visual Data Exploration and Analysis VIII, CA, January 2001, pp. 210-218.
9. Code Red Worm Infections. Cooperative Association for Internet Data Analysis (CAIDA) http://www.caida.org/tools/visualization/walrus/examples/codered/.
10. Juslin, J. Intrusion Detection and Visualization Using Perl. O'Reilly Open Source Conference 2001, San Diego, California, U.S.A., 23rd - 29th of July 2001.
11. Zalewski, M. Strange Attractors and TCP/IP Sequence Number Analysis. http://razor.bindview.com/publish/papers/tcpseq.html, last accessed April 2004.
12. Zalewski, M. Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later. http://lcamtuf.coredump.cx/newtcp/, last accessed April 2004.
13. Nyarko, K; Capers, T; Scott, C and Ladeji-Osias, K. Network Intrusion Visualization with NIVA, an Intrusion Detection Visual Analyzer with Haptic Integration. 10th Symposium on Haptic Interfaces for Virtual Environment and Teleoperator Systems. March 24 - 25, 2002. Orlando, Florida, p. 277.
14. Goodall, J. Information Visualization for Intrusion Detection. The Intrusion Detection Tool Kit (IDtk). http://userpages.umbc.edu/~jgood/idtk.php, last accessed April 2004.
15. SecureScope. Secure Decisions. http://www.securedecisions.com/, last accessed April 2004.
16. StealthWatch + Therminator. Lancope Corporation. http://www.stealthwatch.com/, last accessed April 2004.
17. Ethereal: A Network Protocol Analyzer. http://www.ethereal.com/, last accessed April 2004.
18. Etherape: A Graphical Network Monitor. http://etherape.sourceforge.net/, last accessed April 2004.
19. NetStumbler Homepage, http://www.netstumbler.com/, last accessed April 2004.
20. 3D Traceroute Homepage, http://www.hlembke.de/prod/3dtraceroute/, last accessed April 2004.
21. The Xtraceroute Homepage. http://www.dtek.chalmers.se/~d3august/xt/, last accessed April 2004.
22. Fydor, "Top 75 Network Security Tools," http://www.insecure.org/tools.html, last accessed March 2004.
23. TCPDUMP Public Repository, http://www.tcpdump.org/, last accessed March 2004.
24. Snort Project Page, http://www.snort.org/, last accessed March 2004.
25. The Honeynet Project, http://project.honeynet.org/, last acccessed April 2004.
26. Ptacek, T and Newsham, T. Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Secure Networks, Inc. January, 1998. http://www.insecure.org/stf/secnet_ids/secnet_ids.html, last accessed April 2004.
27. Tufte, E. The Visual Display of Quantitative Information. Second Edition. Graphics Press, May 2001.
28. Tufte, E. Visual Explanations: Images and Quantities, Evidence and Narrative. Graphics Press, February 1997.
29. Tufte, E. Envisioning Information. Graphics Press, May 1990.
30. Spence, R. Information Visualization. Pearson Addison Wesley, December 2000.
31. Inselberg, A. Multidimensional Detective. IEEE Proceedings of Information Visualization '97, pp. 100-107.
32. Inselberg, A. The Plane with Parallel Coordinates, The Visual Computer, 1, pp. 100-107.
33. Wegman, E. Hyperdimensional Data Analysis Using Parallel Coordinates. Journal of the American Statistical Association, 85:411, pp. 664-675.
34. Marchette, D. Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint. Springer Verlag, July 2001.
35. Eick, S; Steffen, J and Sumner, E. Seesoft - A Tool for Visualizing Line Oriented Software Statistics. IEEE Transactions on Software Engineering, 18, 11, November 1992, pp. 957-968.