A Component-Based Framework for Visualization of Intrusion Detection Events

Visualization systems for intrusion detection are becoming more prevalent, but the lack of an organizing framework for proper development of these systems is problematic. This paper introduces a component-based structure that can be used to adequately design and implement intrusion detection information visualization systems. This component-based structure implements a combination of common information visualization components with operational components specific to the critical, real-time nature of intrusion detection. The manuscript also performs an analysis of intrusion detection visualization research projects by verifying their use of the components described by this framework.