Existence Plots: A Low-Resolution Time Series for Port Behavior Analysis

  • Jeff Janies
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5210)


An existence plot is a low-resolution visualization that concurrently represents the activity of all 216 ports on a single host. By doing so, we are able to show patterns of port usage which can indicate server activity and demonstrate scanning. In this work we introduce the existence plot as a visualization and discuss its use in gaining insight into a host’s behavior.


Network traffic visualization Low-resolution visualization Time series 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Collins, M., Shimeall, T., Faber, S., Janies, J., Weaver, R., De Shon, M., Kadane, J.: Using uncleanliness to predict future botnet addresses. In: Proceedings of IMC 2007 (2007)Google Scholar
  2. 2.
    Hernandez-Campos, F., Nobel, A., Smith, F., Jeffay, K.: Understanding patterns of tcp connection usage with statistical clustering. In: Proceedings of MASCOTS 2005. IEEE Computer Society, Los Alamitos (2005)Google Scholar
  3. 3.
    Lakkaraju, K., Yurcik, W., Lee, A.: Nvisionip: netflow visualizations of system state for security situational awareness. In: Proceedings of VizSEC 2004 (2004)Google Scholar
  4. 4.
    Mansmann, F., Meier, L., Keim, D.: Visualization of host behavior for network security. In: Proceedings of VizSEC 2007 (2007)Google Scholar
  5. 5.
    Marchette, D.: Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint. Springer, New York (2001)zbMATHGoogle Scholar
  6. 6.
    McPherson, J., Ma, K., Krystosek, P., Bartoletti, T., Christensen, M.: Portvis: a tool for port-based detection of security events. In: Proceedings of VizSEC/DMSEC 2004. ACM, New York (2004)Google Scholar
  7. 7.
    Pang, R., Yegneswaran, V., Barford, P., Paxson, V., Peterson, L.: Characteristics of internet background radiation. In: Proceedings of IMC 2004 (2004)Google Scholar
  8. 8.
    Wright, C., Monrose, F., Masson, G.: Using visual motifs to classify encrypted traffic. In: proceedings of VizSEC 2006. ACM Press, New York (2006)Google Scholar
  9. 9.
    Xiao, L., Gerth, J., Hanrahan, P.: Enhancing visual analysis of network traffic using a knowledge representation. VAST 0, 107–114 (2006)Google Scholar
  10. 10.
    Yegneswaran, V., Barford, P., Ullrich, J.: Internet intrusions: Global characteristics and prevalence. In: Proceedings of ACM SIGMETRICS 2003 (2003)Google Scholar
  11. 11.
    Yin, X., Yurcik, W., Treaster, M., Li, Y., Lakkaraju, K.: Visflowconnect: netflow visualizations of link relationships for security situational awareness. In: Proceedings of VizSEC/DMSEC 2004. ACM Press, New York (2004)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Jeff Janies
    • 1
  1. 1.CERT Network Situational Awareness GroupPittsburgh

Personalised recommendations