Accelerating network traffic analytics using query-driven visualization

IEEE Symposium on Visual Analytics Science and Technology 2006, VAST 2006 - Proceedings

Volumn , Issue , 2006, Pages 115-122

  Wes Bethel, E ^a   Campbell, Scott ^a   Dart, Eli ^a   Stockinger, Kurt ^a   Wu, Kesheng ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Data mining; Network security; Query driven visualization; Visual analytics

Indexed keywords

QUERY-DRIVEN VISUALIZATION; SCIENTIFIC DATA MANAGEMENT; VISUAL ANALYTICS;

DATA MINING; NETWORK SECURITY; QUEUEING NETWORKS; VISUAL SERVOING; VISUALIZATION;

TELECOMMUNICATION TRAFFIC;

EID: 39049107625     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/VAST.2006.261437     Document Type: Conference Paper

References (44)

1. R. Bellman. Adaptive Control Processes: A Guided Tour. Princeton University Press, 1961.
2. John Bentley. Multidimensional Binary Search Trees Used for Associative Search. Communications of the ACM, 18(9):509-516, 1975.
3. Rene Brun and Fons Rademarkers. ROOT - An Object Oriented Data Analysis Framework. In Proceedings of the AIHENP1996 Workshop, pages 81-86, 1997.
4. Joe Burrescia and William Johnston. ESnet Status Update. Internet2 International Meeting, 2005.
5. C.-Y. Chan and Y. E. Ioannidis. Bitmap index design and evaluation. In Proceedings of the 1998 ACM SIGMOD: International Conference on Management of Data, pages 355-366, New York, NY, USA, 1998. ACM press.
6. R3vis Corporation. OpenRM Scene Graph, http://www.openrm.org, 1999-2006.
7. Kenneth C. Cox, Stephen G. Eick, and Taosong He. 3D Geographic Network Displays. SIGMOD Rec., 25(4):50-54, 1996.
8. Mike Fisk, Steven A. Smith, Paul Weber, Satyam Kothapally, and Thomas Caudell. Immersive Network Monitoring. In Proceedings of the 2003 Passive and Active Measurement Workshop, April 2003.
9. Mark Fullmer and Steve Romig. The OSU Flow-tools package and Cisco Netflow Logs. In Proceedings of the 14th Systems Administrator Conference (LISA 2000), pages 291-303, 2000.
10. Carrie Gates, Michael Collins, Michael Duggan, Andrew Kompanek, and Mark Thomas. More NetFlow Tools: For Performance and Security. In Proceedings of the USENIX18th Systems Administration Conference (LISA 2004), pages 121-131, November 2004.
11. John Goodall, Wayne Lutters, Penny Rheingans, and Anita Komlodi. Preserving the Big Picture: Visual Network Traffic Analysis with TNV. In Proceedings of the 2005 Workshop on Visualization for Computer Security, pages 47-54, October 2005.
12. Bernd Hamann, E. Wes Bethel, Horst Simon, and Juan Meza. The NERSC Visualization Greenbook: Future Visualization Needs of the DOE Computational Science Community Hosted at NERSC. The International Journal of High Performance Computing Applications, 17(2):97-124, 2002.
13. Harry Hochheiser and Ben Shneiderman. Visual specification of queries for finding patterns in time-series data. In Proceedings of Discovery Science, pages 441-446, 2001.
14. Theodore Johnson. Performance measurements of compressed bitmap indices. In Proceedings of the 25th International Conference on Very Large Data Bases, September 1999.
15. Daniel Keim and Hans-Peter Kriegel. Visdb: Database exploration using multidimensional visualization. IEEE Computer Graphics and Applications, 14(4):40-49, 1994.
16. Donald Knuth. The Art of Computer Programming, 2nd Ed., Volume 3. Addison-Wesley, 1998.
17. Anita Komlodi, Penny Rheingans, Utkarsha Ayachit, John Goodall, and Amit Joshi. A user-centered look at glyph-based security visualization. In Proceedings of the 2005 Workshop on Visualization for Computer Security, pages 21-28, October 2005.
18. Eleftherios E. Koutsofios, Stephen C. North, Russell Truscott, and Daniel A. Keim. Visualizing large-scale telecommunication networks and services (case study). In VIS '99: Proceedings of the conference on Visualization '99, pages 457-461, Los Alamitos, CA, USA, 1999. IEEE Computer Society Press.
19. Hans-Peter Kriegel, Peer Kröger, Mattias Schubert, and Ziyue Zhu. Efficient Query Processing in Arbitrary Subspace Using Vector Approximations. In Proceedings of the International Conference on Scientific and Statistical Database Management, July 2006.
20. Kiran Lakkaraju, Ratna Bearavolu, Adam Slagell, William Yurcik, and Stephen North. Closing-the-Loop in NVisionIP: Integrating Discovery and Search in Security Visualizations. In Proceedings of the 2005 Workshop on Visualization for Computer Security, October 2005.
21. Kiran Lakkaraju, William Yurcik, and Adam Lee. NVisionIP: Net-Flow Visualizations of System State for Security Situational Awareness. In Internet Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security (VizSEC/DMSEC2004), October 2004.
22. Stephen Lau. The Spinning Cube of Potential Doom. Communications of the ACM, 47(6):25-26, 2004.
23. Yarden Livnat, Jim Agutter, Shaun Moon, Robert Erbacher, and Stefano Foresti. A visual paradigm for network intrusion detection. In Proceedings of the 2005 IEEE Workshop on Information Assurance And Security, June 17-19 2005.
24. Jonhathan McPherson, Kwan-Liu Ma, Paul Krystosek, Tony Bartoletti, and Marvin Christensen. Portvis: A tool for port-based detection of security events. In Proceedings of CCS Workshop on Visualization and Data Mining for Computer Security, ACM Conference on Computer and Communication Security, October 2004.
25. John-Paul Navarro, Bill Nickless, and Linda Winkler. Combining Cisco Netflow Exports with Relational Database Technology for Usage Statistics, Intrusion Detection, and Network Forensics. In Proceedings of the 14th Systems Administrator Conference (LISA 2000), pages 285-290, 2000.
26. Tobias Oetiker. Multi router traffic grapher. http://mrtg.hdl.com/.
27. Tobias Oetiker. Round robin database tool. http://oss.oetiker.ch/ rrdtooiy.
28. Patrick O'Neil. Model 204 architecture and performance. In Second International Workshop in High Performance Transaction Systems. Lecture Notes in Computer Science, vol. 359, Springer-Verlag 4059, 1987.
29. Patrick O'Neil and D Quass. Improved query performance with variant indices. In Proceedings of ACM SIGMOD International Conference on Management of Data. ACM Press, May 1997.
30. Vern Paxson. Bro: A system for detecting network intruders in realtime. In Proceedings of the 7th USENIX Security Symposium, January 1998.
31. Peter Phaal, Sonia Panchen, and Neil McKee. Inmon corporation's sflow: A method for monitoring traffic in switched and routed networks. IETF RFC 3176, http://www.app.sietf.org/rfc/rfc3176.html, 2001.
32. Dave Plonka. FlowScan: A Network Traffic Flow Reporting and Visualization Tool. In Proceedings of the 14th Systems Administrator Conference (LISA 2000), pages 305-317, 2000.
33. Easy Software Products. The fast light toolkit, http://www.fltk.org, 2006.
34. Lawrence Berkeley National Laboratory Scientific Data Management Group. Fastbit. http://sdm.lbl.gov/fastbit, 2006.
35. Arie Shoshani, Luis Bernardo, Henrik Nordberg, Doron Rotem, and Alex Sim. Multidimensional indexing and query coordination for tertiary storage management. In Proceedings of the 11th International Conference on Scientific and Statistical Database Management. IEEE Computer Society 214225, July 1999.
36. Kurt Stockinger, Dirk Duellmann, Wolfgang Hoschek, and Erich Schikuta. Improving the performance of high-energy physics analysis through bitmap indices. In Proceedings of the 11th International Conference on Database and Expert Systems Applications, 2000.
37. Kurt Stockinger, John Shalf, Kesheng Wu, and E. Wes Bethel. Query-Driven Visualization of Large Data Sets. In Proceedings of IEEE Visualization, pages 167-174, October 2005.
38. Kurt Stockinger, Kesheng Wu, Rene Brun, and P. Canal. Bitmap indices for fast end-user physics analysis in root. In Nuclear Instruments and Methods in Physics Research, Section A - Accelerators, Spectrometers, Detectors and Associated Equipment, volume 599, pages 99-102. Elsevier, 2006.
39. Cisco Systems. Cisco netflow collection engine. http://www.cisco.com/en/ US/products/sw/netmgtsw/psl964/, 2005.
40. James J. Thomas and Kristin A. Cook eds. Illuminating the Path -The Research and Development Agenda for Visual Analytics. IEEE Computer Society Press, 2005.
41. Roger Weber, Hans-J. Schek, and Stephen Blott. A Quantative Analysis and Performance Study for Similarity-Search Methods in HighDimensional Spaces. In Proceedings of the International Conference on Very Large Data Bases, September 1998.
42. Kesheng Wu, Ekow Otoo, and Arie Shoshani. A performance comparison of bitmap indices. In Proceedings of the ACM CIKM International Conference on Information and Knowledge Management. ACM 559561, November 2001.
43. Kesheng Wu, Ekow Otoo, and Arie Shoshani. On the performance of bitmap indices for high cardinality attributes. In In Proceedings of the International Conference of Very Large Data Bases, pages 24-35, 2004.
44. Xiaoxin Yin, William Yurcik, Michael Treaster, Yifan Li, and Kiran Lakkaraju. VisFlowConnect: NetFlow Visualizations of Link Relations for Security Situational Awareness. In Internet Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security (VizSEC/DMSEC-2004), October 2004.