Visualization for Cybersecurity Focusing on Context in Network Traffic Analysis

With network size and complexity continuously increasing, securing computing infrastructures from attacks is an escalating challenge. Intrusion detection systems (IDSs) are often used to aid analysts ’ efforts by automatically identifying successful and unsuccessful system attacks or abuses. Although IDS alerts can be a useful first step in uncovering security compromises, they’re often just that: a starting point. While IDS alerts contain some pertinent information, analysts can rarely determine an event’s accuracy and severity from an IDS alert alone. Rather, they must collect and construct the event’s relevant context within volu-The Time-Based Network minous network traffic data. Building this contextual understanding of Traffic Visualizer combines an event is fundamental to intrusion detection (ID) analysis. low-level, textual detail with Whether the starting point of analysis is data rich (as with an IDS multiple visualizations of the alert) or data poor (as with a phone call from a user), analysis of a net-larger context to help users work security event is a complex task. Generally, contextual data construct a security event’s comes from collecting packet-level detail of the event-related network big picture. traffic. The textual or tabular tools that analysts currently use—such as Tcpdum