Fast detection and visualization of network attacks on parallel coordinates

Computers and Security

Volumn 28, Issue 5, 2009, Pages 276-288

  Choi, Hyunsang ^a   Lee, Heejo ^a   Kim, Hyogon ^a  

^a Korea University   (South Korea)

Author keywords

DDoS attacks; Internet attack visualization; Internet worms; Parallel coordinate attack visualization (PCAV); Parallel coordinates

Indexed keywords

DDOS ATTACKS; INTERNET ATTACK VISUALIZATION; INTERNET WORMS; PARALLEL COORDINATE ATTACK VISUALIZATION (PCAV); PARALLEL COORDINATES;

COMPUTER WORMS; FLOW VISUALIZATION; FLUID DYNAMICS; INTERNET; SECURITY OF DATA;

INTERNET PROTOCOLS;

EID: 67349158355     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2008.12.003     Document Type: Article

References (22)

1. Akritidis P, Anagnostakis K, Markatos E. Efficient content-based detection of zero-day worms. In: Proc. of IEEE ICC; May 2005.
2. Axelsson S. Visualization for intrusion detection: Hooking the worm. In: Proc. of ESORICS; October 2003.
3. Cisco IOS NetFlow (2006), Cisco Systems, Inc. http://www.cisco.com/warp/public/732/Tech/netflow
4. Conti G, Abdullah K. Passive visual fingerprinting of network attack tools. In: Proc. of ACM VizSEC/DMSEC; October 2004.
5. Fischer F, Mansmann F, Keim DA, Pietzko S, Waldvogel M. Large-scale network monitoring for visual analysis of attacks. In: Proc. of ACM VizSEC/DMSEC; 2008.
6. Gil T, Poletto M. MULTOPS: a data-structure for bandwidth attack detection. In: Proc. of USENIX security symposium; August 2001.
7. Inselberg A. The plane with parallel coordinates. The Visual Computer (1985) 69-91
8. Karagiannis T, Papagiannaki K, Faloutsos M. Blinc: Multilevel traffic classification in the dark. In: Proc. of ACM SIGCOMM; 2005.
9. Keim D.A. Visual exploration of large data sets. Communications of the ACM (2001) 38-44
10. Kim S, Reddy A. A study of analyzing network traffic as images in real-time. In: Proc. of IEEE INFOCOM; 2005.
11. Kim H., Kang I., and Bahk S. Real-time visualization of network attacks on high-speed links. IEEE Network (2004)
12. Krasser V, Conti G. Real-time and forensic network data analysis using animated and coordinated visualization. In: Proc. of IEEE Workshop on Info. Assurance and Security; 2005.
13. Lakkaraju K, Yurcik W, Adam J. NVisionIP: netflow visualizations of system state for security situational awareness. In: Proc. of ACM VizSEC/DMSEC; 2004. p. 65-72.
14. Moore D., Shannon C., Voelker G., and Savage S. Inside the slammer worm. IEEE Security and Privacy (2003) 33-39
15. ntop.org. nProbe: an extensible NetFlow v5/v9/IPFIX GPL probe for IPv4/v6. http://www.ntop.org/nProbe.html
16. Nyarko K, Capers T, Scott C, Ladeji-Osias K. Network intrusion visualization with NIVA, an intrusion detection visual analyzer with haptic integration. In: The 10th symp. on haptic interfaces for virtual environment and teleoperator systems; 2002.
17. Onut I.-V., and Ghorbani A.A. SVision: A novel visual network-anomaly identification technique. Computers and Security (2007) 201-212
18. Quittek J., Zseby T., Claise B., and Zander S. Requirements for IP flow information export (IPFIX) vol. 3917 (2004), RFC
19. Samak T, Ghanem S, Ismail MA. On the efficiency of using space-filling curves in network traffic representation. In: Proc. of IEEE INFOCOM; 2008.
20. Solka J., Marchette D., and Wallet B. Statistical visualization methods in intrusion detection. Computing Science and Statistics (2000) 16-24
21. The University of Utah. Information visualization resources. http://www.infovis.org
22. Yin X, Yurcik W, Treaster M, Li Y, Lakkaraju K. VisFlowConnect: NetFlow visualizations of link relationships for security situational awarenes. In: Proc. of ACM VizSEC/DMSEC; 2004.