Large-Scale Network Monitoring for Visual Analysis of Attacks

  • Fabian Fischer
  • Florian Mansmann
  • Daniel A. Keim
  • Stephan Pietzko
  • Marcel Waldvogel
Conference paper

DOI: 10.1007/978-3-540-85933-8_11

Volume 5210 of the book series Lecture Notes in Computer Science (LNCS)
Cite this paper as:
Fischer F., Mansmann F., Keim D.A., Pietzko S., Waldvogel M. (2008) Large-Scale Network Monitoring for Visual Analysis of Attacks. In: Goodall J.R., Conti G., Ma KL. (eds) Visualization for Computer Security. Lecture Notes in Computer Science, vol 5210. Springer, Berlin, Heidelberg

Abstract

The importance of the Internet and our dependency on computer networks are steadily growing, which results in high costs and substantial consequences in case of successful intrusions, stolen data, and interrupted services. At the same time, a trend towards massive attacks against the network infrastructure is noticeable. Therefore, monitoring large networks has become an important field in practice and research. Through monitoring systems, attacks can be detected and analyzed to gain knowledge of how to better protect the network in the future. In the scope of this paper, we present a system to analyze NetFlow data using a relational database system. NetFlow records are linked with alerts from an intrusion detection system to enable efficient exploration of suspicious activity within the monitored network. Within the system, the monitored network is mapped to a TreeMap visualization, the attackers are arranged at the borders and linked using splines parameterized with prefix information. In a series of case studies, we demonstrate how the tool can be used to judge the relevance of alerts, to reveal massive distributed attacks, and to analyze service usage within a network.

Keywords

visual network monitoring visualization for network security large-scale netflow analysis 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Fabian Fischer
    • 1
  • Florian Mansmann
    • 1
  • Daniel A. Keim
    • 1
  • Stephan Pietzko
    • 1
  • Marcel Waldvogel
    • 1
  1. 1.Computer and Information ScienceUniversity of KonstanzKonstanzGermany