Visualization of Misuse-Based Intrusion Detection: Application to Honeynet Data

  • Urko Zurutuza
  • Enaitz Ezpeleta
  • Álvaro Herrero
  • Emilio Corchado
Part of the Advances in Intelligent and Soft Computing book series (AINSC, volume 87)


This study presents a novel soft computing system that provides network managers with a synthetic and intuitive representation of the situation of the monitored network, in order to reduce the widely known high false-positive rate associated to misuse-based Intrusion Detection Systems (IDSs). The proposed system is based on the use of different projection methods for the visual inspection of honeypot data, and may be seen as a complementary network security tool that sheds light on internal data structures through visual inspection. Furthermore, it is intended to understand the performance of Snort (a well-known misuse-based IDS) through the visualization of attack patterns. Empirical verification and comparison of the proposed projection methods are performed in a real domain where real-life data are defined and analyzed.


Projection Models Artificial Neural Networks Unsupervised Learning Soft Computing Network & Computer Security Intrusion Detection Honeypots 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Myerson, J.M.: Identifying Enterprise Network Vulnerabilities. International Journal of Network Management 12(3), 135–144 (2002)CrossRefGoogle Scholar
  2. 2.
    Charles, K.A.: Decoy Systems: A New Player in Network Security and Computer Incident Response. International Journal of Digital Evidence 2(3) (2004)Google Scholar
  3. 3.
  4. 4.
    Rizza, J.M.: Computer Network Security. Springer US, Heidelberg (2005)Google Scholar
  5. 5.
    D’Amico, A.D., Goodall, J.R., Tesone, D.R., Kopylec, J.K.: Visual Discovery in Computer Network Defense. IEEE Computer Graphics and Applications 27(5), 20–27 (2007)CrossRefGoogle Scholar
  6. 6.
    Goodall, J.R., Lutters, W.G., Rheingans, P., Komlodi, A.: Focusing on Context in Network Traffic Analysis. IEEE Computer Graphics and Applications 26(2), 72–80 (2006)CrossRefGoogle Scholar
  7. 7.
    Itoh, T., Takakura, H., Sawada, A., Koyamada, K.: Hierarchical Visualization of Network Intrusion Detection Data. IEEE Computer Graphics and Applications 26(2), 40–47 (2006)CrossRefGoogle Scholar
  8. 8.
    Livnat, Y., Agutter, J., Moon, S., Erbacher, R.F., Foresti, S.: A Visualization Paradigm for Network Intrusion Detection. In: Sixth Annual IEEE SMC Information Assurance Workshop, IAW 2005(2005)Google Scholar
  9. 9.
    Herrero, Á., Corchado, E., Gastaldo, P., Zunino, R.: Neural Projection Techniques for the Visual Inspection of Network Traffic. Neurocomputing 72(16-18), 3649–3658 (2009)CrossRefGoogle Scholar
  10. 10.
    Herrero, Á., Corchado, E., Pellicer, M.A., Abraham, A.: MOVIH-IDS: A Mobile-Visualization Hybrid Intrusion Detection System. Neurocomputing 72(13-15), 2775–2784 (2009)CrossRefGoogle Scholar
  11. 11.
    Ahlberg, C., Shneiderman, B.: Visual Information Seeking: Tight Coupling of Dynamic Query Filters with Starfield Displays. In: Readings in Information Visualization: using Vision to Think, pp. 244–250. Morgan Kaufmann Publishers Inc., San Francisco (1999)Google Scholar
  12. 12.
    Goodall, J.R., Lutters, W.G., Rheingans, P., Komlodi, A.: Preserving the Big Picture: Visual Network Traffic Analysis with TNV. In: IEEE Workshop on Visualization for Computer Security (VizSEC 2005). IEEE Computer Society, Los Alamitos (2005)Google Scholar
  13. 13.
    Friedman, J.H., Tukey, J.W.: A Projection Pursuit Algorithm for Exploratory Data-Analysis. IEEE Transactions on Computers 23(9), 881–890 (1974)zbMATHCrossRefGoogle Scholar
  14. 14.
    Corchado, E., MacDonald, D., Fyfe, C.: Maximum and Minimum Likelihood Hebbian Learning for Exploratory Projection Pursuit. Data Mining and Knowledge Discovery 8(3), 203–225 (2004)MathSciNetCrossRefGoogle Scholar
  15. 15.
    Oja, E.: A Simplified Neuron Model as a Principal Component Analyzer. Journal of Mathematical Biology 15(3), 267–273 (1982)MathSciNetzbMATHCrossRefGoogle Scholar
  16. 16.
    Sanger, D.: Contribution Analysis: a Technique for Assigning Responsibilities to Hidden Units in Connectionist Networks. Connection Science 1(2), 115–138 (1989)CrossRefGoogle Scholar
  17. 17.
    Fyfe, C.: A Neural Network for PCA and Beyond. Neural Processing Letters 6(1-2), 33–41 (1997)MathSciNetCrossRefGoogle Scholar
  18. 18.
    Corchado, E., Fyfe, C.: Connectionist Techniques for the Identification and Suppression of Interfering Underlying Factors. International Journal of Pattern Recognition and Artificial Intelligence 17(8), 1447–1466 (2003)CrossRefGoogle Scholar
  19. 19.
    Zurutuza, U., Uribeetxeberria, R., Zamboni, D.: A Data Mining Approach for Analysis of Worm Activity through Automatic Signature Generation. In: 1st ACM Workshop on AISec. ACM, New York (2008)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Urko Zurutuza
    • 1
  • Enaitz Ezpeleta
    • 1
  • Álvaro Herrero
    • 2
  • Emilio Corchado
    • 3
  1. 1.Electronics and Computing DepartmentMondragon UniversityArrasate-MondragonSpain
  2. 2.Civil Engineering DepartmentUniversity of BurgosBurgosSpain
  3. 3.Departamento de Informática y AutomáticaUniversity of SalamancaSalamancaSpain

Personalised recommendations