Multi-dimensional visualization for network forensic analysis
Nuttachot Promrit, Anirach Mingkhwan, Supaporn Simcharoen, Nati Namvong - · International Conference on Networked Computing · 2011
This research studies the offense on a computer network with multiple dimensions of network traffic and logs using parallel coordinates to show relationships of various parameters such as user, source ip address, time, destination ip address, destination service and domain name. The aim is to test the hypothesis that this technique is able to identify patterns of attacks and the behavior of offenders. Initially the attacks were simulated by creating text file dataset. The results of the experiment showed that (i) Attacked signatures are various depending on the situation of attack. (ii) Analyst can observe the attacks obviously in details. In addition, researchers proposed-user investigations with visualization time machine for network forensic (UIV) as a tool for analyzing the behavior on a computer network, the results also showed that (iii) it is possible to track an individual's behavior using this tool.