IDGraphs: Intrusion detection and analysis using histographs

IEEE Workshop on Visualization for Computer Security 2005, VizSEC 05, Proceedings

Volumn , Issue , 2005, Pages 39-46

  Ren, Pin ^a   Gao, Yan ^a   Li, Zhichun ^a   Chen, Yan ^a   Watson, Benjamin ^a  

^a NORTHWESTERN UNIVERSITY   (United States)

Author keywords

Brushing and Linking; Correlation Matrix; Dynamic Query; Interactive System; Intrusion Detection; Visualization

Indexed keywords

BRUSHING AND LINKING; CORRELATION MATRIX; DYNAMIC QUERY; INTRUSION DETECTION;

COMPUTER CRIME; COMPUTER NETWORKS; INTERACTIVE COMPUTER SYSTEMS; NETWORK PROTOCOLS; SECURITY OF DATA; STATISTICAL METHODS; TELECOMMUNICATION TRAFFIC;

GRAPH THEORY;

EID: 33749519234     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/VIZSEC.2005.1532064     Document Type: Conference Paper

References (31)

1. Cyberdiversity. http://www.systemtoolbox.com/bfarticle. php?content_id=61, 2004.
2. C. Abad, J. Taylor, C. Sengul, W. Yurcik, Y. Zhou, and K. Rowe. Log correlation for intrusion detection: A proof of concept. In Annual Computer Security Applications Conference (ACSAC), 2003.
3. Christopher Ahlberg and Ben Shneiderman. Visual information seeking: Tight coupling of dynamic query filters with starfield displays. In Human Factors in Computing Systems. Conference Proceedings CHI'94, pages 313-317, 1994.
4. P. Barford, J. Kline, D. Plonka, and A. Ron. A signal analysis of network traffic anomalies. In ACM SIGCOMM Internet Measurement Workshop, November 2002.
5. Richard A. Becker and William S. Cleveland. Brushing scatterplots. Technometrics, 29(2):127-142, 1987.
6. Richard A. Becker, Stephen G. Eick, and Allan R. Wilks. Visualizing network data. IEEE Transactions on Visualization and Computer Graphics, 1(1):16-28, 1995.
7. CERT Coordination Center. Denial of service attacks, http://www. cert.org/tech_tips/denial_of_service.html, 1999.
8. F. Cuppens and A. Mige. Alert correlation in a cooperative intrusion detection framework. In Proceedings of the 2002 IEEE Symposium on Security and Privacy, 2002.
9. H. Debar and A. Wespi. Aggregation and correlation of intrusiondetection alerts. In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection, 2001.
10. Michael Friendly. Corrgrams: Exploratory displays for correlation matrices. American Statistican, 56(4):316-324, 2002.
11. Yan Gao, Zhichun Li, and Yan Chen. Towards a high-speed router-based anomaly/intrusion detection system. Technical Report NWU-CS-05-011, Northwestern University, 2005.
12. Alfred Inselberg and Bernard Dimsdale. Parallel coordinates: a tool for visualizing multi-dimensional geometry. In VIS '90: Proceedings of the 1st conference on Visualization '90, pages 361-378, Los Alamitos, CA, USA, 1990. IEEE Computer Society Press.
13. Dean F. Jerding and John T. Stasko. The information mural: A technique for displaying and navigating large information spaces. IEEE Transactions on Visualization and Computer Graphics, 4(3):257-271, 1998.
14. Jaeyeon Jung, Vern Paxson, Arthur W. Berger, and Hari Balakrishnan. Fast portscan detection using sequential hypothesis testing. In Proceedings of the IEEE Symposium on Security and Privacy, 2004.
15. C. Kruegel, T. Toth, and C. Kerer. Decentralized event correlation for intrusion detection. In International Conference on Information Security and Cryptology (ICISC), 2001.
16. Kiran Lakkaraju, William Yurcik, and Adam J. Lee. Nvisionip: netflow visualizations of system state for security situational awareness. In Proc. of VizSEC/DMSEC, 2004.
17. Stephen Lau. The spinning cube of potential doom. Commun. ACM, 47(6):25-26, 2004.
18. E. Mars and J. D. Jansky. Email defense industry statistics, http:// www.mxlogic.com/PDFs/IndustryStats.2.28.04.pdf, 2004.
19. Jonathan McPherson, Kwan-Liu Ma, Paul Krystosk, Tony Bartoletti, and Marvin Christensen. Portvis: a tool for port-based detection of security events. In Proc. of VizSEC/DMSEC, 2004.
20. David Moore, Geoffrey Voelker, and Stefan Savage. Inferring Internet denial of service activity. In Proceedings of the 2001 USENIX Security Symposium, Aug. 2001.
21. V. Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks, 31(23-24):2435-2463, 1999.
22. Dave Plonka. Flowscan: A network traffic ow reporting and visualization tool. In Proc. of 14th Systems Administration Conference (LISA 2000), 2000.
23. Pin Ren and Benjamin Watson. Histographs: Interactive visualization of complex data with graphs. Technical Report NWU-CS-05-12, Department of Computer Sciences, Northwestern University, 2005. http://www.cs.northwestern.edu/ publications/techreports/.
24. Marty Roesch. Snort: The lightweight network intrusion detection system, 2001. http://www.snort.org/.
25. Ben Shneiderman. The eyes have it: A task by data type taxonomy for information visualizations. In VL '96: Proceedings of the 1996 IEEE Symposium on Visual Languages, page 336, Washington, DC, USA, 1996. IEEE Computer Society.
26. S. Staniford, J. A. Hoagland, and J. M. McAlerney. Practical automated detection of stealthy portscans. Journal of Computer Security, 10(1-2), 2002.
27. Soon Tee Teoh, Kwan Liu Ma, S. Felix Wu, and Xiaoliang Zhao. Case study: interactive visualization for internet security. In Proc. of the IEEE Visualization, 2002.
28. H. Wang, D. Zhang, and K. G. Shin. Detecting SYN flooding attacks. In Proc. of IEEE INFOCOM, 2002.
29. H.N. Wang, D.L. Zhang, and K.G. Shin. Change-point monitoring for detection of dos attacks. IEEE Transactions on Dependable and Secure Computing, 1(4), 2004.
30. Vinod Yegneswaran, Paul Barford, and Johannes Ullrich. Internet intrusions: Global characteristics and prevalence. In Proceedings of ACM SIGMETRICS, 2003.
31. X. Yin, W. Yurcik, M. Treaster, Y. Li, and K. Lakkaraju. Visflow-connect: netflow visualizations of link relationships for security situational awareness. In Proc. of VizSEC/DMSEC, 2004.