Replicable Security Monitoring: Visualizing Time-Variant Graphs of Network Metadata.
Volker Ahlers, Felix Heine, Bastian Hellmann, Carsten Kleiner, Leonard Renners, Thomas Rossow, Ralf Steuerwald · 2014
Abstract. Monitoring a computer network's security state is a difficult task as network components rarely share their information. The IF-MAP specification defines a client/server-based protocol that enables network components to share security information among each other, which is represented in a graph structure. Visualization of this data is challenging due to the highly dynamic topology and the mapping of logical nodes onto physical devices. Furthermore, data in a MAP server is volatile and there is no standardized way to preserve and review changes or previous states of a MAP graph. The evolution of such a graph, however, embodies valuable information for the analysis of past incidents and attacks on the network infrastructure. In this paper we introduce a software framework to visualize MAP data and propose a solution for the efficient long-term storage and replication of MAP graphs. We demonstrate how changes in the graph structure between given points in time can be computed and visualized. 1