Cyber security through visualization
Kwan‐Liu Ma · 2006
Networked computers are subject to attack, misuse, and abuse. Organizations and individuals are making every effort to build and maintain trustworthy computing systems. The main strategy is to closely monitor and inspect network activities by collecting and analyzing data about the network traffic and the trails of system usage. The analysis usually requires large amounts of finely detailed, high-dimensional data to enable analysts to uncover hidden threats and make calculated predictions in a timely fashion. The traditional, signature-based and statistical methods are limited in their capability to cope with the large, evolving data and the dynamic nature of the Internet. Visualization proves effective to aid in understanding large, high-dimensional data commonly found in many demanding applications such as large-scale scientific simulations and biomedicine. There is thus a growing interest in the development of visualization methods as alternative or complementary solutions to the pressing cyber security problems (Brodley, Chan, Lippmann & Yurcik 2004, Ma, North & Yurcik 2005). The challenge is to develop new visual representations, layout methods, user interfaces, and interaction techniques that can effectively facilitate visual interrogation and communication of the vast amounts of cyber security information. Visual data analysis is inherently an iterative process, where each iteration provides more insight into the data being shown. A typical example of this process occurs with any type of overview plus detail visualization. Patterns in the overview tend to direct what the user chooses to view in more detail, and the detailed view can provide insight on regions of the overview. This drill-down process, starting at a high semantic level and progressing to more detailed views, creates a feedback loop as shown in Figure 1, which can lend itself well to visualizing the relationships between large number of objects, such as port and network scans. In most cases, different visual representations are needed for constructing these different views. In particular, each specific region of interest may be defined in a space of arbitrary dimensions. The challenge is thus to seek the best space and visual representation in that space for each type of analysis task. I show with three different tasks how visualization can assist in the analysis of computer network activities for detecting anomalies using the drill-down process.