Anomalous network communication detection system by visual pattern on a client computer
Hayate Goto, T. Takada · 2015
In this study, we propose a visual anomaly detection system for network connections on a client computer. End users are exposed to security threats and they remain vulnerable to unknown emerging threats because current tools such as antivirus software and firewalls can only handle known threats. The proposed system aims to become a complementary security tool for end users that visualizes both inbound and outbound network connections on their computers. We consider three design features in this security tool for end users: visualizing a block of logs as a network usage trend, providing a temporal sequence of the log content as visual images, and anomaly detection based on frequency analysis. These features help users to build a normal usage model in their minds and they make them more aware of suspicious network traffic on their computers by observing visual differences between images. We also present four visual examples of anomalous network traffic based on the proposed system. These examples show that our tool has the potential to detect anomalous network communication.