SVision: A novel visual network-anomaly identification technique

Computers and Security

Volumn 26, Issue 3, 2007, Pages 201-212

  Onut, Iosif Viorel ^a   Ghorbani, Ali A ^a  

^a UNIVERSITY OF NEW BRUNSWICK   (Canada)

Author keywords

Anomaly visualization; Intrusion detection; Network monitoring; Network security; Service based data visualization

Indexed keywords

COMPUTER WORMS; DATA REDUCTION; INTERNET PROTOCOLS; INTRUSION DETECTION; NETWORK SECURITY;

DATASETS; NETWORK MONITORING; UNIVERSITIES;

NETWORK MANAGEMENT;

EID: 34248377875     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2006.10.001     Document Type: Article

References (20)

1. Erbacher RF. Visual traffic monitoring and evaluation. Conference on Internet performance and control of network systems II. Denver, CO, USA; August 2001. p. 153-60.
2. Estrin D., Handley M., Heidemann J., McCanne S., Xu Y., and Yu H. Network visualization with the VINT network animator nam. Technical Report (March 1999), University of Southern California, Los Angeles p. 99-703
3. Fisk Mike, Smith Steven, Weber Paul, Kothapally Satyam, Caudell Thomas. Immersive network monitoring. The passive and active measurement workshop (PAM2003) (SDSC at UC San Diego 9500 Gilman Drive La Jolla, CA 92093-0505, USA); April 2003.
4. Frost & Sullivan Security Technologies Group, World intrusion detection and prevention systems markets. Technical report June 2004;25 [Frost and Sullivan, 7550 West Interstate 10, Suite 400 San Antonio, Texas 78229-5616, USA].
5. OpenGL Utility Toolkit (GLUT). http://www.opengl.org/documentation/specs/glut/; 2005 [accessed 10.03.05].
6. Intrusion detection evaluation data set DARPA 2000. http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.html; 2000.
7. Lincoln Laboratory, Intrusion detection evaluation data set DARPA 1999. http://www.ll.mit.edu/IST/ideval/data/1999/1999_data_index.html; 1999.
8. McAfee, W32/nachi worm. http://vil.nai.com/vil/content/v_100559.htm/; 2006 [accessed 01.09.06].
9. MySQL. http://www.mysql.com; 2005 [accessed 12.06.05].
10. MySQL++ api. http://dev.mysql.com/downloads/other/plusplus/index.html; 2005 [accessed 12.06.05].
11. National Laboratory for Applied Network Research (NLANR)'s Measurement & Operations Analysis Team (MOAT), CICHLID data visualization software. http://moat.nlanr.net/Software/Cichlid/; 2005 [accessed 09.05.05].
12. Oetiker Tobias, Rand Dave. Multi Router Traffic Grapher (MRTG). http://ee-staff.ethz.ch/oetiker/webtools/mrtg/; 2005 [accessed 09.05.05].
13. Onut I.-V., Zhu B., and Ghorbani A.A. Svision: a network host-centered anomaly visualization technique. Information Security Conference (ISC2005) vol. 3650 (20-23 September 2005), Springer's Lecture Notes in Computer Science, Singapore, Singapore p. 16-28
14. Plonka D. Flowscan: a network traffic flow reporting and visualization tool. USENIX fourteenth system administration conference LISA XIV (New Orleans, LA); December 2000.
15. Q1Labs, Qradar. http://www.q1labs.com/; 2005 [accessed 09.05.05].
16. Qt/x11 free edition. http://www.trolltech.com/download/qt/x11.html; 2004 [accessed 17.12.04].
17. Spencer Mark. Cheops network user interface. http://www.marko.net/cheops/; 2005 [accessed 09.05.05].
18. Tcpdump public repository. http://www.tcpdump.org/; 2005 [accessed 10.03.05].
19. The mesa 3D graphics library. http://www.mesa3d.org/; 2004 [accessed 17.12.04].
20. United States Computer Emergency Readiness Team US-CERT, W32/welchia worm. http://www.cert.org/current/archive/2003/08/21/archive.html#welchia; 2006 [accessed 01.09.06].