Visual correlation of network alerts
Stefano Foresti, James A. Agutter, Yarden Livnat, Seunghee Moon, Robert F. Erbacher · IEEE Computer Graphics and Applications · 2006
The VisAlert visual correlation tool facilitates situational awareness in complex network environments by providing a holistic view of network security to help detect malicious activities. Information visualization techniques and methods in many applications have effectively increased operators' situational awareness, letting them more effectively detect, diagnose, and treat anomalous conditions. Visualization elevates information comprehension by fostering rapid correlation and perceived associations. Our visualization technique integrates the information in log and alert files into an intuitive, flexible, extensible, and scalable visualization tool - VisAlert - that presents critical information concerning network activity in an integrated manner, increasing the user's situational awareness.