Journal in Computer Virology

, Volume 6, Issue 1, pp 1–29

Applied parallel coordinates for logs and network traffic attack analysis

Original Paper

DOI: 10.1007/s11416-009-0127-3

Cite this article as:
Tricaud, S. & Saadé, P. J Comput Virol (2010) 6: 1. doi:10.1007/s11416-009-0127-3

Abstract

By looking on how computer security issues are handled today, dealing with numerous and unknown events is not easy. Events need to be normalized, abnormal behaviors must be described and known attacks are usually signatures. Parallel coordinates plot offers a new way to deal with such a vast amount of events and event types: instead of working with an alert system, an image is generated so that issues can be visualized. By simply looking at this image, one can see line patterns with particular color, thickness, frequency, or convergence behavior that gives evidence of subtle data correlation. This paper first starts with the mathematical theory needed to understand the power of such a system and later introduces the Picviz software which implements part of it. Picviz dissects acquired data into a graph description language to make a parallel coordinate picture of it. Its architecture and features are covered with examples of how it can be used to discover security related issues.

Keywords

Visualization Parallel coordinates Data-mining Logs Computer security 

Copyright information

© Springer-Verlag France 2009

Authors and Affiliations

  1. 1.Honeynet Project French ChapterParisFrance
  2. 2.Lycée la Martinière Monplaisir, Laboratoire de MathématiquesLyon Cedex 08France

Personalised recommendations