Real-time visualization of network behaviors for situational awareness

ACM International Conference Proceeding Series

Volumn , Issue , 2010, Pages 79-90

  Best, Daniel M ^a   Bohn, Shawn ^a   Love, Douglas ^a   Wynne, Adam ^a   Pike, William A ^a  

^a PACIFIC NORTHWEST NATIONAL LABORATORY   (United States)

Author keywords

behavior modeling; high throughput; network flow; real time; symbolic aggregate approximation; visualization

Indexed keywords

DATA VISUALIZATION; FLOW VISUALIZATION; SECURITY OF DATA; VISUALIZATION;

BEHAVIOR MODEL; HIGH THROUGHPUT; NETWORK FLOWS; REAL TIME; SYMBOLIC AGGREGATE APPROXIMATION;

REAL TIME SYSTEMS;

EID: 78149456361     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1850795.1850805     Document Type: Conference Paper

References (22)

1. Mule Enterprise Service Bus: What is Mule ESB? Retrieved July 23, 2010, from MuleSoft: http://www.mulesoft.org/what-mule-esb
2. OASIS Web Services Business Process Execution Language: Specification version 2.0. Retrieved July 23, 2010, from OASIS: http://docs.oasis-open.org/ wsbpel/2.0/wsbpel-v2.0.html
3. Gorton, I., Wynne, A., Almquist, J., and Chatterton, J. 2008. The MeDICi Integration Framework: A Platform for High Performance Data Streaming Applications. In Proceedings of the Seventh Working IEEE/IFIP Conference on Software Architecture (February 18 - 21, 2008). WICSA'08. IEEE Computer Society, Washington, DC, 95-104. DOI=http://dx.doi.org/10.1109/WICSA.2008.21
4. Wynne, A., Gorton, I., Almquist, J., Chatterton, J., and Thurman, D. 2008. A Flexible, High Performance Service-Oriented Architecture for Detecting Cyber Attacks. In Proceedings of the Proceedings of the 41st Annual Hawaii international Conference on System Sciences (January 07 - 10, 2008). HICSS. IEEE Computer Society, Washington, DC, 263. DOI=http://dx.doi.org/10.1109/HICSS. 2008.19
5. McLachlan, P., Munzner, T., Koutsofios, E., and North, S. 2008. LiveRAC: interactive visual exploration of system management time-series data. In Proceeding of the Twenty-Sixth Annual SIGCHI Conference on Human Factors in Computing Systems (Florence, Italy, April 05 - 10, 2008). CHI '08. ACM, New York, NY, 1483-1492. DOI=http://doi.acm.org/10.1145/1357054.1357286
6. Cahill, M. H., Lambert, D., Pinheiro, J. C., and Sun, D. X. 2002. Detecting fraud in the real world. In Handbook of Massive Data Sets, J. Abello, P. M. Pardalos, and M. G. Resende, Eds. Kluwer Academic Publishers, Norwell, MA, 911-929.
7. Dutta, M., Mahanta, A. K., and Pujari, A. K. 2005. QROCK: A quick version of the ROCK algorithm for clustering of categorical data. Pattern Recogn. Lett. 26, 15 (Nov. 2005), 2364-2373. DOI= http://dx.doi.org/10.1016/j.patrec.2005.04. 008
8. Domingos, P. and Hulten, G. 2000. Mining high-speed data streams. In Proceedings of the Sixth ACM SIGKDD international Conference on Knowledge Discovery and Data Mining (Boston, Massachusetts, United States, August 20 - 23, 2000). KDD '00. ACM, New York, NY, 71-80. DOI=http://doi.acm.org/10.1145/ 347090.347107
9. Keogh, E., Lin, J. and Fu, A. D. HOT SAX: Efficiently finding the most unusual time series subsequence. In Proceedings of the Fifth IEEE International Conference on Data Mining (November 27-30, 2005). ICDM'05. IEEE Computer Society, Washington, DC, 226-233. DOI=http://doi.ieeecomputersociety.org/10. 1109/ICDM.2005.79
10. Lin, J., Keogh, E., Lonardi, S., and Chiu, B. 2003. A symbolic representation of time series, with implications for streaming algorithms. In Proceedings of the 8th ACM SIGMOD Workshop on Research Issues in Data Mining and Knowledge Discovery (San Diego, California, June 13 - 13, 2003). DMKD '03. ACM, New York, NY, 2-11. DOI=http://doi.acm.org/10.1145/882082.882086
11. Levenshtein, V. I. 1966. Binary codes capable of correcting deletions, insertions and reversals. Soviet Physics Doklady. 10 (1966), 707-710.
12. Phan, D., Gerth, J., Lee, M., Paepcke, A. and Winograd, T. Visual analysis of network flow data with timelines and event plots. In Proceedings of Visualization for Computer Security (Sacramento, CA, October 29, 2007). VIZSEC'07. Springer-Verlag Berlin, Berlin, 85-99. DOI= http://dx.doi.org/10. 1007/978-3-540-78243-8
13. Weber, M., Alexa, M., and Müller, W. 2001. Visualizing Time-Series on Spirals. In Proceedings of the IEEE Symposium on information Visualization 2001 (October 22 - 23, 2001). INFOVIS'01. IEEE Computer Society, Washington, DC, 7.
14. Pescatore, J. 1997. More Port 445 Activity Could Mean Security Trouble. Technical Report. Gartner, Stamford.
15. Abdullah, K., Lee, A., Conti, G., and Copeland, J. A. Visualizing network data for intrusion detection. In Proceedings of the 2005 IEEE Workshop on Information Assurance and Security (US Military Academy, West Point, 2005) IEEE, New York, NY, USA, 2-3.
16. Plonka, D. 2000. FlowScan: A Network Traffic Flow Reporting and Visualization Tool. In Proceedings of the 14th USENIX Conference on System Administration (New Orleans, Louisiana, December 03 - 08, 2000). System Administration Conference. USENIX Association, Berkeley, CA, 305-318.
17. Swing, E. 1998. Flodar: Flow Visualization of Network Traffic. IEEE Comput. Graph. Appl. 18, 5 (Sep. 1998), 6-8. DOI=http://dx.doi.org/10.1109/38. 708554
18. Nanda, S. and Deo, N. A highly scalable model for network attack identification and path prediction. In Proceedings of the IEEE SoutheastCon (Richmond, VA, March 22-27, 2007). IEEE, New York, NY, 663-668.
19. Noel, S., Jacobs, M., Kalapa, P., and Jajodia, S. 2005. Multiple Coordinated Views for Network Attack Graphs. In Proceedings of the IEEE Workshops on Visualization For Computer Security (October 26 - 26, 2005). VIZSEC. IEEE Computer Society, Washington, DC, 12. DOI=http://dx.doi.org/10. 1109/VIZSEC.2005.14
20. Taylor, T., Paterson, D., Glanfield, J., Gates, C., Brooks, and S., McHugh, J. FloVis: Flow Visualization System. In Proceedings of Cybersecurity Applications and Technologies Conference for Homeland Security (Washington, DC, March 03- 04, 2009). CATCH'09. IEEE Computer Society, Los Alamitos, CA, USA, 186-198.
21. Taylor, T., Paterson, D., Glanfield, J., Gates, C., Brooks, and S., McHugh, J. FloVis: Flow Visualization System. In Proceedings of Cybersecurity Applications and Technologies Conference for Homeland Security (Washington, DC, March 03- 04, 2009). CATCH'09. IEEE Computer Society, Los Alamitos, CA, USA, 186-198.
22. Blake, E. H. 2004. An Extended Platter Metaphor for Effective Reconfigurable Network Visualization. In Proceedings of the information Visualisation, Eighth international Conference (July 14 - 16, 2004). IV. IEEE Computer Society, Washington, DC, 752--757. DOI= http://dx.doi.org/10.1109/IV. 2004.2