Advertisement

VizSEC 2007 pp 85-99 | Cite as

Visual Analysis of Network Flow Data with Timelines and Event Plots

  • D. Phan
  • J. Gerth
  • M. Lee
  • A. Paepcke
  • T. Winograd
Part of the Mathematics and Visualization book series (MATHVISUAL)

Abstract

This paper describes Isis, a system that uses progressive multiples of timelines and event plots to support the iterative investigation of intrusions by experienced analysts using network flow data. The visual representations have been designed to make temporal relationships apparent, allow visual classification of events with dynamic brushing, and enable users to organize their visualizations to reveal traffic structure and patterns by reordering rows. Isis combines visual affordances with SQL to provide a flexible tool for investigation. We present an annotated case study using anonymized data of a real intrusion that demonstrates the features of Isis.

Keywords

Intrusion Detection System Computer Security Internet Service Provider Event Plot Visual Structure 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • D. Phan
    • 1
  • J. Gerth
    • 1
  • M. Lee
    • 1
  • A. Paepcke
    • 1
  • T. Winograd
    • 1
  1. 1.Department of Computer ScienceStanford UniversityUSA

Personalised recommendations