A user-centered approach to visualizing network traffic for intrusion detection

ABSTRACT

Intrusion detection (ID) analysts are charged with ensuring the safety and integrity of today's high-speed computer networks. Their work includes the complex task of searching for indications of attacks and misuse in vast amounts of network data. Although there are several information visualization tools to support ID, few are grounded in a thorough understanding of the work ID analysts perform or include any empirical evaluation. We present a user-centered visualization based on our understanding of the work of ID and the needs of analysts derived from the first significant user study of ID. The tool presents analysts with both 'at a glance' understanding of network activity, and low-level network link details. Results from preliminary usability testing show that users performed better and found easier those tasks dealing with network state in comparison to network link tasks.

REFERENCES

• 1: Richard A. Becker , Stephen G. Eick , Allan R. Wilks, Visualizing Network Data, IEEE Transactions on Visualization and Computer Graphics, v.1 n.1, p.16-28, March 1995 [doi>10.1109/2945.468391]
• 2: Erbacher, R., Walker, K., & Frincke, D. Intrusion and misuse detection in large-scale systems. IEEE Computer Graphics & Applications 1 (2002), 38--48.
• 3: John R. Goodall , Wayne G. Lutters , Anita Komlodi, I know my network: collaboration and expertise in intrusion detection, Proceedings of the 2004 ACM conference on Computer supported cooperative work, November 06-10, 2004, Chicago, Illinois, USA [doi>10.1145/1031607.1031663]
• 4: Anita Komlodi , John R. Goodall , Wayne G. Lutters, An Information Visualization Framework for Intrusion Detection, CHI '04 extended abstracts on Human factors in computing systems, April 24-29, 2004, Vienna, Austria [doi>10.1145/985921.1062935]
• 5: Jonathan McPherson , Kwan-Liu Ma , Paul Krystosk , Tony Bartoletti , Marvin Christensen, PortVis: a tool for port-based detection of security events, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, October 29-29, 2004, Washington DC, USA [doi>10.1145/1029208.1029220]
• 6: Stolze, M., Pawlitzek, R., and Wespi, A. Visual Problem-Solving Support for New Event Triage in Centralized Network Security Monitoring. Proc.GI- SIDAR Conference IT Incident Management & IT Forensics, (2003).
• 7: Xiaoxin Yin , William Yurcik , Michael Treaster , Yifan Li , Kiran Lakkaraju, VisFlowConnect: netflow visualizations of link relationships for security situational awareness, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, October 29-29, 2004, Washington DC, USA [doi>10.1145/1029208.1029214]
• 8: Yurcik, W., Barlow, J., Lakkaraju, K., & Haberman, M. Two visual computer network security monitoring tools incorporating operator interface requirements. ACM CHI Workshop on HCI and Security Systems, (2003).

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: User-centered design

Keywords:
information visualization, intrusion detection, network security, usability testing, user-centered design