NVisionIP: NetFlow visualizations of system state for security situational awareness

VizSEC/DMSEC '04: Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security

Volumn , Issue , 2004, Pages 65-72

  Lakkaraju, Kiran ^a   Yurcik, William ^a   Lee, Adam J ^a  

^a UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

Author keywords

NetFlows; Security system state; Security visualization; Situational awareness

Indexed keywords

NETFLOWS; SECURITY SYSTEM STATE; SECURITY VISUALIZATION; SITUATIONAL AWARENESS;

COMPUTER SIMULATION; COMPUTER SOFTWARE; COMPUTER SYSTEMS; ELECTRONIC MAIL; INTERNET; NETWORK PROTOCOLS; TELECOMMUNICATION TRAFFIC; USER INTERFACES;

SECURITY OF DATA;

EID: 20444484611     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (31)

1. Argus - metrics. Web Page, Mar. 2001. 〈http://www.qosient.com/argus/metrics.htm〉.
2. Ratna Bearavolu, Kiran Lakkaraju, William Yurcik, and Hrishikesh Raje. A visualization tool for situational awareness of tactical and strategic security events on large and complex computer networks. In IEEE Military Communications Conference (Milcom), 2003.
3. CERT/CC Statistics 1988-2003, Jan. 2004. 〈http://www.cert.org/stats/〉. (Jun. 2004).
4. Martin Dodge and Rob Kitchin. Atlas of Cyberspace. Addison Wesley, Harlow, England, 2001.
5. Jana Dunn. Security applications for cisco netflow data. Technical report, SANS, Jul. 2001. 〈http://www.sans.org/rr/papers/index.php?id=778〉.
6. Robert F. Erbacher and Deborah Frincke. Visual behavior characterization for intrusion and misuse detection. In SPIE '2001 Conference on Visual Data Exploration and Analysis VIII, pages 210-218, Jan. 2001.
7. Robert F. Erbacher, Kenneth L. Walker, and Deborah A. Frincke. Intrusion and misuse detection in large-scale systems. Computer Graphics and Applications, 22(1):38-48, Jan.-Feb. 2002.
8. Mark Fullmer and Steve Romig. The osu flow-tools package and cisco netflow logs. In 14th Systems Administration Conference (LISA 2000), Dec. 2000.
9. NCSA Automated Learning Group. D2K Toolkit User Manual. National Center for Supercomputing Applications, Apr. 2003. 〈http://algdocs.ncsa.uiuc.edu/TU-20030425-1.pdf〉.
10. Gene H. Kim and Eugene H. Spafford. The design and implementation of tripwire: a file system integrity checker. In Proceedings of the 2nd ACM Conference on Computer and communications security, pages 18-29. ACM Press, 1994.
11. Samuel T. King and Peter M. Chen. Backtracking intrusions. In Proceedings of the 2003 Symposium on Operating Systems Principles (SOSP), Oct. 2003.
12. Kiran Lakkaraju, Ratna Bearavolu, and William Yurcik. Nvisionip - a traffic visualization tool for security analysis of large and complex networks. In International Multiconference on Measurement, Modelling, and Evaluation of Computer-Communications Systems (Performance TOOLS), 2003.
13. Kiran Lakkaraju, William Yurcik, Ratna Bearavolu, and Adam J. Lee. NVisionIP: An Interactive Network Flow Visualization Tool for Security. In IEEE International Conference on Systems, Man, and Cybernetics (SMC), 2004.
14. Stephen Lau. The spinning cube of potential doom. Communications of the ACM, 47(6):25-26, Jun. 2004.
15. John-Paul Navarro, Bill Nickless, and Linda Winkler. Combining cisco netflow exports with relational database technology for usage statistics, intrusion detection, and network forensics. In 14th Systems Administration Conference (LISA 2000), Dec. 2000.
16. The network simulator - ns-2. Web Page, May 2004. 〈http://www.isi.edu/nsnam/ns/〉.
17. OPNET Technologies, Inc. Web Page, Jun. 2004. 〈http://www.opnet.com〉.
18. Adam G. Pennington, John D. Strunk, John Linwood, Griffin, Craig A.N. Soules, Garth R. Goodson, and Gregory R. Ganger. Storage-based intrusion detection: Watching storage activity for suspicious behavior. In USENIX Security Symposium 2003, 2003. 〈http://www.pdl.cmu.edu/PDL-FTP/Secure/usenix03.pdf〉.
19. Dave Plonka. Flowscan: A network traffic flow reporting and visualization tool. In 14th Systems Administration Conference (LISA 2000), Dec. 2000.
20. Secure decisions. Web Page, Jun. 2004. 〈http://www.securedecisions.com/〉.
21. Ben Shneiderman. Tree visualization with tree-maps: 2-d space-filling approach. ACM Trans. Graph., 11(1):92-99, 1992.
22. Security incident fusion toolkit SIFT, Jun.
23. CERT Advisory CA-2003-04 MS-SQL Server Worm. Web Page, Jan. 2003. 〈http: //www.cert.org/advisories/CA-2003-04.html〉.
24. Snort: The open source network intrusion detection system. Web Page, Jun. 2004. 〈http://www.snort.org〉.
25. Security threat manager. Web Page, Jun. 2004. 〈http://www.open.com/products/threatmanager/threatmanager. shtml%〉.
26. Soon Tee Teoh, Kwan-Liu Ma, S. Felix Wu, and Xiaoliang Zhao. Case study: Interactive visualization for internet security. In IEEE Visualization, 2002.
27. Edward R. Tufte. The Visual Display of Quantitative Information. Graphics Press, P.O. Box 430, Cheshire, CT 06410, Second edition, Jan. 2001.
28. United States Department of Homeland Security. Team Coordination Training, Student Guide, May 2004. 〈http://www.cgaux.info/g_ocx/training/tct/〉.
29. Xiaoxin Yin, William Yurcik, Yifan Li, Kiran Lakkaraju, and Cristina Abad. Visflowconnect: Providing security situational awareness by visualizing network traffic flows. In Workshop on Information Assurance (WIA04) held in conjunction with the 23rd IEEE International Performance Computing and Communications Conference (IPCCC), 2004.
30. William Yurcik, James Barlow, Kiran Lakkaraju, and Mike Haberman. Two visual computer network security monitoring tools incorporating operator interface. In ACM CHI Workshop on Human-Computer Interaction and Security Systems (HCISEC), 2003.
31. William Yurcik, Kiran Lakkaraju, James Barlow, and Jeff Rosendale. A prototype tool for visual data mining of network traffic for intrusion detection. In 3rd IEEE International Conference on Data Mining (ICDM) Workshop on Data Mining for Computer Security (DMSEC), 2003.