Understanding multistage attacks by attack-track based visualization of heterogeneous event streams

Proceedings of the 3rd International Workshop on Visualization for Computer Security, VizSEC'06. Co-located with the 13th ACM Conference on Computer and Communications Security, CCS'06

Volumn , Issue , 2006, Pages 1-5

  Mathew, S ^a   Giomundo, R ^a   Upadhyaya, S ^a   Sudit, M ^b   Stotz, A ^b  

^a SUNY at Buffalo ^*  (United States)

^b UNIVERSITY AT BUFFALO   (United States)

Author keywords

Attack tracks; Intrusion detection; Visualization

Indexed keywords

ATTACK TRACKS; HETEROGENEOUS EVENT STREAMS; LOG FILES; MULTISTAGE ATTACK PATHS;

CYBERNETICS; REAL TIME SYSTEMS; SEMANTICS; SENSORS; TRACKING (POSITION); VISUALIZATION;

INTRUSION DETECTION;

EID: 34547299999     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1179576.1179578     Document Type: Conference Paper

References (16)

1. P. Ammann, D. Wijesekera, and S. Kaushik. Scalable, graph-based network vulnerability analysis. In CCS '02: Proceedings of the 9th ACM conference on Computer and Communications Security, pages 217-224, New York, NY, USA, 2002. ACM Press.
2. R. Erbacher, K. Christensen, and A. Sundberg. Designing Visualization Capabilities for IDS Challenges. In Proceedings of the IEEE Workshop on Visualization for Computer Security, 2005.
3. R. Erbacher, K. Walker, and D. Frincke. Intrusion and Misuse Detection in Large Scale Systems. Computer Graphics and Applications, 22(1), 2002.
4. J. Goodall, W. Lutters, P. Rheingans, and A. Komlodi. Preserving the Big Picture: Visual Network Traffic Analysis with TNV. In Proceedings of the 2005 ACM Workshop on Visualization for Computer Security, October 2005.
5. J. Haines, D. Ryder, L. Tinnel, and S. Taylor. Validation of sensor alert correlators. IEEE Security and Privacy, May 2001.
6. S. Jajodia, S. Noel, and B. O'Berry. Topological analysis of network attack vulnerability. Managing Cyber Threats: Issues, Approaches and Challenges, Kluwer Academic Publishers, 2003.
7. S. Jha, O. Sheyner, and J. Wing. Two Formal Analyses of Attack Graphs. In 15th IEEE Computer Security Foundations Workshop (CSFW'02), pages 49-63, Cape Breton, Nova Scotia, Canada, 2002.
8. H. Koike, K. Ohno, and K. Koizumi. Visualizing Cyber Attacks through IP Matrix. In Proceedings of the 2005 ACM Workshop on Visualization for Computer Security, October 2005.
9. Y. Livnat, J. Agutter, S. Moon, R. Erbacher, and S. Foresti. A Visualization Paradigm for Network Intrusion Detection. In Proceedings of the IEEE Information Assurance Workshop, 2005.
10. S. Mathew, D. Britt, R. Giomundo, S. Upadhyaya, M. Sudit, and A. Stotz. Real-time Multistage Attack Awareness through Enhanced Intrusion Alert Clustering. In Situation Management Workshop (SIMA 2005), MILCOM 2005, Atlantic City, NJ, October 2005.
11. S. Mathew, C. Shah, and S. J. Upadhyaya. An Alert Fusion Framework for Situation Awareness of Coordinated Multistage Attacks. In Proceedings of the Third IEEE International Information Assurance Workshop, pages 95-104, College Park, MD, March 2005.
12. S. Noel, M. Jacobs, P. Kalapa, and S. Jajodia. Multiple Coordinated Views for Network Attack Graphs. In Proceedings of the 2005 ACM Workshop on Visualization for Computer Security, October 2005.
13. S. Noel, E. Robertson, and S. Jajodia. Correlating Intrusion Events and Building Attack Scenarios through Attack Graph Distances. In Proceedings of the 20th Annual Computer Security Applications Conference, December 2004.
14. J. Scambray, S. McClure, and G. Kurtz. Hacking exposed: Network security secrets and solutions. Osborne/Mcgraw-Hill, 2001.
15. A. Valdes and M. Fong. Scalable Visualization of Propogating Internet Phenomena. In Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, October 2004.
16. X. Yin, W. Yurcik, M. Treaster, Y. Li, and K. Lakkaraju. VisFlowConnect: NetFlow Visualizations of Link Relationships for Security Situational Awareness. In Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, October 2004.