Detecting distributed scans using high-performance query-driven visualization

Proceedings of the 2006 ACM/IEEE Conference on Supercomputing, SC'06

Volumn , Issue , 2006, Pages

  Stockinger, Kurt ^a   Bethel, E Wes ^a   Campbell, Scott ^a   Dart, Eli ^a   Wu, Kesheng ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Data mining; Network connection analysis; Network security; Query driven visualization; Visual analytics

Indexed keywords

FORENSIC ANALYTICS APPLICATIONS; NETWORK CONNECTION ANALYSIS; QUERY DRIVEN VISUALIZATION; VISUAL ANALYTICS;

DATA MINING; DATA RECORDING; NETWORK SECURITY; PARALLEL ALGORITHMS; QUERY PROCESSING; TELECOMMUNICATION TRAFFIC;

DISTRIBUTED COMPUTER SYSTEMS;

EID: 34548211483     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1188455.1188542     Document Type: Conference Paper

References (60)

1. AMSDEN, P., AMWEG, J., CALATO, P., BENSLEY, S., AND LYONS, G., 1997. Cabletron's lightweight flow admission protocol specification, version 1.0. IETF RFC 4124, http://www.ietf.org/rfc/rfc2124.txt.
2. BELLMAN, R. 1961. Adaptive Control Processes: A Guided Tour. Princeton University Press.
3. BENTLEY, J. 1975. Multidimensional binary search trees used for associative search. Communications of the ACM 18, 9, 509-516.
4. BERCHTOLD, S., JAGADISH, H. V., AND ROSS, K. A. 1998. Independence diagrams: A technique for visual, data mining. In Proc. 4th Int. Conf. Knowledge Discovery and Data Mining, KDD, AAAI Press, R. Agrawal, R E. Stolorz, and G. Piatetsky-Shapi.ro, Eds., 139-143.
5. BETHEL, E. W., CAMPBELL, S., DART, E., STOCKINGER, K., AND WU, K. 2006. Accelerating network traffic analysis using query-driven visualization. In IEEE Symposium on Visual Analytics Science and Technology, IEEE Computer Society Press.
6. BRUN, R., AND RADEMARKERS, F. 1997. Root - an object oriented data analysis framework. In Proceedings of the AIHENP 1996 Workshop, 81-86.
7. BURRESCIA, J., AND JOHNSTON, W., 2005. Esnet status update. Internet2 International, Meeting.
8. CHAN, C.-Y., AND IOANNIDIS, Y. E. 1998. Bitmap index design and evaluation. In Proceedings of ACM SIGMOD International Conference on Management of Data.
9. COX, K. C., EICK, S. G., AND HE, T. 1996. 3D Geographic Network Displays. SIGMOD Rec. 25, 4, 50-54.
10. EXPERIMENT, B., 2006. The babar experiment. http://wwwpublic. slac.stanford.edu/babar/.
11. FISK, M., AND VERGHESE, G. 2002. Agile and scalable analysis of network events. In Proceedings of ACM SIGCOMM Internet Measurement Workshop, 285-290.
12. FISK, M., SMITH, S. A., WEBER, P., KOTHAPALLY, S., AND CAUDELL, T. 2003. Immersive Network, Monitoring. In Proceedings of the 2003 Passive and Active Measurement Workshop.
13. FULLMER, M., AND ROMIG, S. 2000. The OSU Flow-tools package and Cisco Netflow Logs. In Proceedings of the 14th Systems Administrator Conference (LISA 2000), 291-303.
14. GATES, C, COLLINS, M., DUGGAN, M., KOMPANEK, A., AND THOMAS, M. 2004. More NetFlow Tools: For Performance and Security. In Proceedings of the USENIX18th Systems Administration Conference (LISA 2004), 121-131.
15. GOODALL, J., LUTTERS, W., RHEINGANS, R, AND KOMLODI, A. 2005. Preserving the Big Picture: Visual Network Traffic Analysis with TNV. In Proceedings of the 2005 Workshop on Visualization for Computer Security, 47-54.
16. GRINSTEIN, G., KEIM, D., AND WARD, M., 2002. Information visualization, visual data mining, and its application to drug design. IEEE Visualization 2002 Course #1 Notes, October.
17. HOCHHEISER, H., AND SHNEIDERMAN, B. 2001. Visual specification of queries for finding patterns in time-series data. In Proceedings of Discovery Science.
18. IOANNIDIS, Y. 2003. The history of histograms (abridged). In International Conference on Very Large Data Bases.
19. JACOBSEN, V., LERES, C., AND MCCANNE, S., 1989. tcpdump. ftp://ftp.ee.lbl.gov/.
20. JOHNSON, T. 1999. Performance measurements of compressed bitmap indices. In International Conference on Very Large Data Bases.
21. KEIM, D., AND KRIEGEL, H.-P. 1994. Visdb: Database exploration using multidimensional visualization. IEEE Computer Graphics and Applications 14, 4, 40-49.
22. KINDLMANN, G. 1999. Semi-Automatic Generation of Transfer Functions for Direct Volume Rendering. Master's thesis, Cornell University.
23. KITWARE, INC. 2003. The Visualization Toolkit User's Guide, January.
24. KNUTH, D. 1998. The Art of Computer Programming, 2nd Ed., Volume 3. Addison-Wesley.
25. KOMLODI, A., RHEINGANS, P., AYACHIT, U., GOODALL, J., AND JOSHI, A. 2005. A user-centered look at glyph-based security visualization. In Proceedings of the 2005 Workshop on Visualization for Computer Security.
26. KORNEXL, S., PAXSON, V., DREGER, H., FELDMANN, A., AND SOMM.ER, R. 2005. Building a time machine for efficient recording and retrieval of high-volume network traffic. In Internet Measurement Conference.
27. KOUTSOFIOS, E. E., NORTH, S. C, TRUSCOTT, R., AND KEIM, D. A. 1999. Visualizing large-scale telecommunication networks and services (case study). In VIS '99: Proceedings of the conference on Visualization 99, IEEE Computer Society Press, Los Alamitos, CA, USA, 457-461.
28. LAKKARAJU, K., YURCIK, W., AND LEE, A. 2004. NVisionIP: NetFlow Visualizations of System State for Security Situational Awareness. In Internet Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security (VizSEC/DMSEC-2004).
29. LAU, S. 2004. The spinning cube of potential doom. Communications of the ACM 47, 6, 25-26.
30. LEVOY, M. 1989. Display of Surfaces from Volume Data. PhD thesis, University of North Carolina at Chapel Hill.
31. LIVNAT, Y, AQUTTER, J., MOON, S., ERBACHER, R., AND FORESTI, S. 2005. A visual paradigm, for network intrusion detection. In IEEE Workshop on Information Assurance And Security.
32. LORENSEN, W. E., AND CLINE, H. E. 1987. Marching cubes: A high, resolution 3d surface construction algorithm. In Computer Graphics (Proceedings of SIGGRAPH 87), vol. 21.
33. MAX, N. 1995. Optical models for direct volume rendering. IEEE Transactions on Visualization and Computer Graphics 1, 2 (June).
34. MCCANNE, S., LERES, C, AND JACOBSEN, V., 1994. libpcap. ftp://ftp.ee.lbl.gov/.
35. MCCORMICK, P., INMAN, J., AHRENS, J., HANSEN, C., AND ROTH, G. 2004. Scout: A hardware-accelerated system for quantitatively driven visualization and analysis. In Proceedings of IEEE Visualization, 171-178.
36. MCPHERSON, J., MA, K.-L., KRYSTOSEK, P., BARTOLETTI, T., AND CHRISTENSEN, M. 2004. Portvis: A tool for port-based detection of security events. In Proceedings of CCS Workshop on Visualization and Data Mining for Computer Security, ACM Conference on Computer and Communication Security.
37. NIELSON, G. M., AND HAMANN, B. 1991. The asymptotic decider: Removing the ambiguity in marching cubes. In Proceedings of IEEE Visualization.
38. OETIKER, T., 2006. Multi router traffic grapher. http://mrtg.hdl.com/.
39. OETIKER, T., 2006. Round robin database tool. http://oss.oetik.er.ch/rrdtool/.
40. O'NEIL, P., AND QUASS, D. 1997. Improved query performance with variant indices. In Proceedings of ACM SIGMOD International Conference on Management of Data, ACM Press.
41. O'NEIL, P. 1987. Model 204 architecture and performance. In Second International Workshop in High Performance Transaction Systems, Springer Verlag.
42. PAXSON, V. 1998. Bro: A system for detecting network intruders in real-time. In Proceedings of the 7th USENIX Security Symposium.
43. PHAAL, P., PANCHEN, S., AND MCKEE, N., 2001. Inmon corporation's sflow: A. method for monitoring traffic in switched and routed networks. IETF RFC 3176, http://www.app.si.etf.org/rfc/rfc3176.html.
44. PLONKA, D. 2000. FlowScan: A Network Traffic Flow Reporting and Visualization Tool. In Proceedings of the 14th Systems Administrator Conference (USA 2000), 305-317.
45. PRODUCTS, E. S., 2006. The fastlight toolkit, http://www.fltk.org.
46. R3VIS, 1999-2006. OpenRM Scene Graph. http://www.openrm.org.
47. SCIENTIFIC DATA MANAGEMENT GROUP, L. B. N. L., 2006. Fastbit. http://sdm.lbl.gov/fastbit.
48. SHOSHANI, A., BERNARDO, L., NORDBERG, H., ROTEM, D., AND SIM, A. 1999. Multidimensional, indexing and query coordination for tertiary storage management. In International Conference on Scientific and Statistical Database Management, IEEE Computer Society. 1998. Proceedings of the 1998 ACM SIGMOD: International Conference on Management of Data, ACM Press, New York, NY, USA.
49. STOCKINGER, K., DUELLMANN, D., HOSCHEK, W., AND SCHIKUTA, E. 2000. Improving the performance of high-energy physics analysis through bitmap indices. In Proceedings of the 11th International Conference on Database and Expert Systems Applications, Springer Verlag.
50. STOCKINGER, K., WU, K., CAMPBELL, S., LAU, S., M, R, GAVRILOV, E., KENT, A., DAVIS, C. E., OLINGER, R., YOUNG, R., PREWETT, J., WEBER, P., CAUDELL, T. P., BETHEL, E. W., AND SMITH, S. 2005. Network traffic analysis with query driven visualization - sc 2005 hpc analytics results. In SC05, HPC Analytics Challenge, ACM Press.
51. STOCKINGER, K., SHALF, J., WU, K., AND BETHEL, E. W. 2005. Query-driven visaulization of large data sets. In Proceedings of IEEE Visualization.
52. STOCKINGER, K., WU, K., BRUN, R., AND CANAL, P. 2006. Bitmap indices for fast end-user physics analysis in root. Nuclear Instruments and Methods in Physics Research, Section A -Accelerators, Spectrometers, Detectors and Associated Equipment 559, 99-102.
53. SYSTEMS, C., 2005. Cisco netflow collection engine. http://www.cisco.com/en/US/prod.ucts/sw/netm.gtsw/ps 1964/.
54. THOMAS, J. J., AND EDS., K. A. C. 2005. Illuminating the Path - The Research and Development Agenda for Visual Analytics. IEEE Computer Society Press.
55. UPHOFF, B., AND CRISCUOLO, P. 2004. A framework for collection and management of intrusion detection data sets. In Proceedings of the 16th Annual FIRST Conference on Computer Security Incident Handling.
56. WARE, C. 2004. Information Visualization: Perception for Design, second ed. Morgan Kaufmann Publishers.
57. WU, K., OTOO, E., AND SHOSHANI, A. 2001. A performance comparison of bitmap indices. In Proceedings of the ACM CIKM International Conference on Information and Knowledge Management, ACM Press.
58. WU, K., OTOO, E., AND SHOSHANI, A. 2004. On the performance of bitmap indices for high cardinality attributes. In Proceedings of the International Conference on Very Large Data Bases.
59. WU, K., OTOO, E. J., AND SHOSHANI, A. 2006. An Efficient Compression Scheme For Bitmap Indices. ACM Transactions on Database Systems 31, 1-38.
60. YIN, X., YURCIK, W., TREASTER, M., LI, Y., AND LAKKARAJU, K. 2004. VisFlowConnect: NetFlow Visualizations of Link Relations for Security Situational. Awareness. In Internet Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security (VizSEC/DMSEC2004).