Visualizing network traffic for intrusion detection

ABSTRACT

Intrusion detection, the process of using network data to identify potential attacks, has become an essential component of information security. Human analysts doing intrusion detection work utilize vast amounts of data from disparate sources to make decisions about potential attacks. Yet, there is limited understanding of this critical human component. This research seeks to understand the work practices of these human analysts to inform the design of a task-appropriate information visualization tool to support network intrusion detection analysis tasks. System design will follow a user-centered, spiral methodology. System evaluation will include both a field-based qualitative evaluation, uncommon in information visualization, and a lab-based benchmarking evaluation.

REFERENCES

• 1: Stuart K. Card , Jock D. Mackinlay , Ben Shneiderman, Readings in information visualization: using vision to think, Morgan Kaufmann Publishers Inc., San Francisco, CA, 1999
• 2: Goodall, J.R., Lutters, W.G. and Komlodi, A., The work of intrusion detection: Rethinking the role of security analysts. Proc. of AMCIS, (2004), 1421--1427.
• 3: John R. Goodall , A. Ant Ozok , Wayne G. Lutters , Penny Rheingans , Anita Komlodi, A user-centered approach to visualizing network traffic for intrusion detection, CHI '05 extended abstracts on Human factors in computing systems, April 02-07, 2005, Portland, OR, USA [doi>10.1145/1056808.1056927]
• 4: Klaus Julisch , Marc Dacier, Mining intrusion detection alarms for actionable knowledge, Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining, July 23-26, 2002, Edmonton, Alberta, Canada [doi>10.1145/775047.775101]
• 5: Stolze, M., Pawlitzek, R. and Wespi, A., Visual problem-solving support for new event triage in centralized network security monitoring: Challenges, tools and benefits. GI-SIDAR Conf. IMF (2003).
• 6: Yurcik, W., Barlow, J., Lakkaraju, K. and Haberman, M., Two visual computer network security monitoring tools incorporating operator interface requirements. ACM CHI HCISEC Workshop, (2003).

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: User-centered design

Keywords:
HCI, information visualization, intrusion detection, network security