Interactive visualization techniques for computer network security
Kwan‐Liu Ma, Soon Tee Teoh · 2004
To keep computer and network systems secure and stable, it is necessary to collect vast amounts of data in order to analyze how the systems are performing dynamically. This is because no matter how rigorously a particular system has been designed, many factors during run-time can compromise its performance. Likewise, even though network protocols may have strong theoretical bases, they may suffer security flaws and instability when actually deployed. Furthermore, most systems are not designed with perfect security. Collection and examination of system logs are helpful in both detecting errors and analyzing flaws and intrusions. The analysis of logs to search for problems is a nontrivial task. We often need to discover new and unexpected knowledge to find hitherto unknown weaknesses and security flaws. The task of finding useful information by sifting through large amounts of data has spawned the field of data mining. Most data mining approaches are based on machine learning techniques, numerical analysis or statistical modeling. Human interaction and visualization are used only minimally. Such automatic methods may miss some important features in the data. Therefore, in this dissertation, I present interactive visualization methods to analyze data for computer security, taking advantage of human intuition, visual pattern recognition and domain knowledge, as well as modern computer processing power. I describe the principles behind this interactive visual approach and compare it against automated methods. I present two security applications and new visualization techniques that I developed for them. I demonstrate how these techniques are effective in discovering new and useful information.