Visualization of PRADS Output Data Using Open-source Visualization Tools For Improved Log Analysis
Dawit Hailu Desta · NORA - Norwegian Open Research Archives · 2014
The ever growing network traffic complexity has brought new threats and vulnerabilities that can affect our day to day activities. This lead to high demand for network monitoring and detection system to tackle the emerging threats . Consequently the inspection and assessment of security incidents has become a daily activity for network and system administrators. Network analysts need to have the awareness about every network activity, the status of the network system and the network assets in the network system. Many tools have been developed to detect and monitor network activities using active scanning and passive scanning mechanisms. This thesis focuses on Passive Real-time Detection System, PRADS, the smartest and powerful asset detection system that creates the network awareness required by network analysts. This asset detection tool reports everything it detects in the network and puts it in a log file. Analyzing the log file using a traditional way of textual log analysis is really hard to analyze and inspect especially when the log file is big. So this thesis tries to implement the visualization of the PRADS log file using open-source visualization tools for better analysis and network awareness. A survey is made on the available open-source visualization tools with regards to their suitability and applicability to visualize PRADS output data. The second phase of the project continues by suggesting different visualization methods for PRADS data. Finally a prototype is developed to demonstrate a proof of concept by using the relevant open-source tools Afterglow and Graphviz. The prototype developed tries to visualize wide range of log file data collected by PRADS in different network scenarios that is often difficult to readily search for patterns and trends using traditional log file analysis methods. The data from PRADS is parsed and fed to the Afterglow scripts to produce inputs suitable for use by the graph layouts in Graphviz. This project tries to successfully show the importance of visualizing log files to reveal the most important properties such as the status of running services on the network, rapid recognition of patters and trends, creation of status awareness on the network mapping. The final results achieved show that the project is successful and the project paves a way for further similar researches.