SpiralView: Towards security policies assessment through visual correlation of network resources with evolution of alarms

被引：28

作者：

Bertini, Enrico ^{[1
]}

Hertzog, Patrick ^{[2
]}

Lalanne, Denis ^{[1
]}

机构：

[1] Univ Fribourg, Fribourg, Switzerland

[2] NEXThink SA, Prilly, Switzerland

来源：

VAST: IEEE SYMPOSIUM ON VISUAL ANALYTICS SCIENCE AND TECHNOLOGY 2007, PROCEEDINGS | 2007年

关键词：

network security; intrusion detection; visualization; data exploration;

D O I：

10.1109/VAST.2007.4389007

中图分类号：

TP18 [人工智能理论];

学科分类号：

081104 ; 0812 ; 0835 ; 1405 ;

摘要：

This article presents SpiralView, a visualization tool for helping system administrators to assess network policies. The tool is meant to be a complementary support to the routine activity of network monitoring, enabling a retrospective view on the alarms generated during and extended period of time. The tool permits to reason about how alarms distribute over time and how they correlate with network resources (e.g., users, IPs, applications, etc.), supporting the analysts in understanding how the network evolves and thus in devising new security policies for the future. The spiral visualization plots alarms in time, and, coupled with interactive bar charts and a users/applications graph view, is used to present network data and perform queries. The user is able to segment the data in meaningful subsets, zoom on specific related information, and inspect for relationships between alarms, users, and applications. In designing the visualizations and their interaction, and through tests with security experts, several ameliorations over the standard techniques have been provided.

引用

页码：139 / +

页数：2

共 23 条

[1] Learning attack strategies through mining and correlation of security alarms
Li, Wang
Zhi-Tang, Li
Jie, Lei
[J]. 2007 10TH IFIP/IEEE INTERNATIONAL SYMPOSIUM ON INTEGRATED NETWORK MANAGEMENT (IM 2009), VOLS 1 AND 2, 2007, : 713 - +
[2] Network Security Situation Awareness Based on Spatio-temporal Correlation of Alarms
Ren, Zehua
Liu, Yang
Liu, Huixiang
Jiang, Baoxiang
Yao, Xiangzhen
Li, Lin
Yang, Haiwen
Liu, Ting
[J]. IEEE INFOCOM 2022 - IEEE CONFERENCE ON COMPUTER COMMUNICATIONS WORKSHOPS (INFOCOM WKSHPS), 2022,
[3] Network Security Risk Assessment Based on Node Correlation
Wang, Zengguang
Lu, Yu
Li, Jindong
[J]. 3RD ANNUAL INTERNATIONAL CONFERENCE ON INFORMATION SYSTEM AND ARTIFICIAL INTELLIGENCE (ISAI2018), 2018, 1069
[4] Putting security in context: Visual correlation of network activity with real-world information
Pike, W. A.
Scherrer, C.
Zabriskie, S.
[J]. VIZSEC 2007, 2008, : 203 - 220
[5] Irish Political Parties' Attitudes towards Neutrality and the Evolution of the EU's Foreign, Security and Defence Policies
Devine, Karen
[J]. IRISH POLITICAL STUDIES, 2009, 24 (04) : 467 - 490
[6] Steady state security assessment through two stages neural network approach
El-Shibini, MA
Saied, EM
[J]. PROCEEDINGS OF THE AMERICAN POWER CONFERENCE, VOL 61 - I AND II, 1999, 61 : 935 - 939
[7] Planning for Regional Water System Sustainability Through Water Resources Security Assessment Under Uncertainties
Yizhong Chen
Li He
Hongwei Lu
Jing Li
Lixia Ren
[J]. Water Resources Management, 2018, 32 : 3135 - 3153
[8] Planning for Regional Water System Sustainability Through Water Resources Security Assessment Under Uncertainties
Chen, Yizhong
He, Li
Lu, Hongwei
Li, Jing
Ren, Lixia
[J]. WATER RESOURCES MANAGEMENT, 2018, 32 (09) : 3135 - 3153
[9] The novel use of harvest policies and rapid visual assessment to manage spatially complex abalone resources (Genus Haliotis)
Prince, Jeremy D.
Peeters, Harry
Gorfine, Harry
Day, Robert W.
[J]. FISHERIES RESEARCH, 2008, 94 (03) : 330 - 338
[10] Evolution of Safety and Security Risk Assessment methodologies towards the use of Bayesian Networks in Process Industries
George, Priscilla Grace
Renjith, V. R.
[J]. PROCESS SAFETY AND ENVIRONMENTAL PROTECTION, 2021, 149 : 758 - 775

← 1 2 3 →