Abstract
This paper describes Isis, a system that uses progressive multiples of timelines and event plots to support the iterative investigation of intrusions by experienced analysts using network flow data. The visual representations have been designed to make temporal relationships apparent, allow visual classification of events with dynamic brushing, and enable users to organize their visualizations to reveal traffic structure and patterns by reordering rows. Isis combines visual affordances with SQL to provide a flexible tool for investigation. We present an annotated case study using anonymized data of a real intrusion that demonstrates the features of Isis.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2008 Springer-Verlag Berlin Heidelberg
About this chapter
Cite this chapter
Phan, D., Gerth, J., Lee, M., Paepcke, A., Winograd, T. (2008). Visual Analysis of Network Flow Data with Timelines and Event Plots. In: Goodall, J.R., Conti, G., Ma, KL. (eds) VizSEC 2007. Mathematics and Visualization. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-78243-8_6
Download citation
DOI: https://doi.org/10.1007/978-3-540-78243-8_6
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-78242-1
Online ISBN: 978-3-540-78243-8
eBook Packages: Computer ScienceComputer Science (R0)