3D graph visualization prototype system for intrusion detection: A surveillance aid to security analysts

Intrusion Detection (ID) and Intrusion Prevention (IP) systems are an indispensable part of the information security infrastructure of every networking company or organization. Intrusion Detections Systems (IDS) have problems, such as false positives, operational issues in high-speed environments and the difficulty of detecting unknown threats. Intrusion Prevention Systems (IPS) are still in their infancy. There is a misconception in the market that intrusion detection and intrusion prevention are basically the same technology or that IDS systems are on the way out and IPS and firewalls are the wave of the future. In fact, IDS are far from becoming obsolete and both systems complement each other. Much of ID research has focused on improving the accuracy and operation of IDSs but surprisingly there has been very little research into supporting the security analysts ’ intrusion detection tasks. In this paper we will describe an ongoing surveillance prototype system which offers a visual aid to the security analyst by monitoring and exploring 3D graphs. The system offers a visual surveillance of the network activity on a web server for both normal and anomalous or malicious activity. Colors are used on the 3D graphics to indicate different categories of web attacks and the analyst has the ability to navigate into the web requests, of either normal or malicious traffic