Skip to main content

Large-Scale Network Monitoring for Visual Analysis of Attacks

  • Conference paper

Part of the Lecture Notes in Computer Science book series (LNSC,volume 5210)

Abstract

The importance of the Internet and our dependency on computer networks are steadily growing, which results in high costs and substantial consequences in case of successful intrusions, stolen data, and interrupted services. At the same time, a trend towards massive attacks against the network infrastructure is noticeable. Therefore, monitoring large networks has become an important field in practice and research. Through monitoring systems, attacks can be detected and analyzed to gain knowledge of how to better protect the network in the future. In the scope of this paper, we present a system to analyze NetFlow data using a relational database system. NetFlow records are linked with alerts from an intrusion detection system to enable efficient exploration of suspicious activity within the monitored network. Within the system, the monitored network is mapped to a TreeMap visualization, the attackers are arranged at the borders and linked using splines parameterized with prefix information. In a series of case studies, we demonstrate how the tool can be used to judge the relevance of alerts, to reveal massive distributed attacks, and to analyze service usage within a network.

Keywords

  • visual network monitoring
  • visualization for network security
  • large-scale netflow analysis

This is a preview of subscription content, access via your institution.

Buying options

Chapter
USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-540-85933-8_11
  • Chapter length: 8 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
eBook
USD   64.99
Price excludes VAT (USA)
  • ISBN: 978-3-540-85933-8
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   84.99
Price excludes VAT (USA)

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. McPherson, D., Labovitz, C., Hollyman, M.: Worldwide infrastructure security report, volume III. Technical report, Arbor Networks (September 2007)

    Google Scholar 

  2. NfSen - Netflow Sensor: A graphical web based front end for the nfdump netflow tools (2007), http://nfsen.sourceforge.net/

  3. Oslebo, A.: Stager A Web Based Application for Presenting Network Statistics. In: Network Operations and Management Symposium, 2006. NOMS 2006. 10th IEEE/IFIP, pp. 1–15 (2006)

    Google Scholar 

  4. Lakkaraju, K., Bearavolu, R., Slagell, A., Yurcik, W., North, S.: Closing-the-Loop in NVisionIP: Integrating Discovery and Search in Security Visualizations. In: IEEE Workshops on Visualization for Computer Security, 26 October 2005, p. 9 (2005)

    Google Scholar 

  5. Goodall, J.R., Lutters, W.G., Rheingans, P., Komlodi, A.: Preserving the Big Picture: Visual Network Traffic Analysis with TNV. In: VIZSEC 2005: Proceedings of the IEEE Workshops on Visualization for Computer Security, Washington, DC, USA. IEEE Computer Society, Los Alamitos (2005)

    Google Scholar 

  6. Ball, R., Fink, G., North, C.: Home-centric visualization of network traffic for security administration. In: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, pp. 55–64 (2004)

    Google Scholar 

  7. Shneiderman, B.: Tree visualization with tree-maps: 2-d space-filling approach. ACM Trans. Graph. 11(1), 92–99 (1992)

    MATH  CrossRef  Google Scholar 

  8. Mansmann, F., Keim, D.A., North, S.C., Rexroad, B., Sheleheda, D.: Visual Analysis of Network Traffic for Resource Planning, Interactive Monitoring, and Interpretation of Security Threats. IEEE Transactions on Visualization and Computer Graphics 13(6), 1105–1112 (2007)

    CrossRef  Google Scholar 

  9. Holten, D.: Hierarchical Edge Bundles: Visualization of Adjacency Relations in Hierarchical Data. IEEE Trans. Vis. Comput. Graph. 12(5), 741–748 (2006)

    CrossRef  Google Scholar 

  10. Mansmann, F., Fischer, F., Keim, D., North, S.: Visualizing large-scale IP traffic flows. In: Proceedings of 12th International Workshop Vision, Modeling, and Visualization (2007)

    Google Scholar 

  11. Kaufman, L., Rousseeuw, P.: Finding groups in data. An introduction to cluster analysis. In: Applied Probability and Statistics. Wiley Series in Probability and Mathematical Statistics. Wiley, New York (1990)

    Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Editor information

Editors and Affiliations

Rights and permissions

Reprints and Permissions

Copyright information

© 2008 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Fischer, F., Mansmann, F., Keim, D.A., Pietzko, S., Waldvogel, M. (2008). Large-Scale Network Monitoring for Visual Analysis of Attacks. In: Goodall, J.R., Conti, G., Ma, KL. (eds) Visualization for Computer Security. VizSec 2008. Lecture Notes in Computer Science, vol 5210. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-85933-8_11

Download citation

  • DOI: https://doi.org/10.1007/978-3-540-85933-8_11

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-540-85931-4

  • Online ISBN: 978-3-540-85933-8

  • eBook Packages: Computer ScienceComputer Science (R0)