4.6 Article

A Matrix-Based Visualization System for Network Traffic Forensics

Journal

IEEE SYSTEMS JOURNAL
Volume 10, Issue 4, Pages 1350-1360

Publisher

IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC
DOI: 10.1109/JSYST.2014.2358997

Keywords

Cyber security; entropy; information visualization; traffic forensics; VAST challenge

Funding

  1. National Natural Science Foundation of China [61103108, 61402540, 61103096]
  2. National Science AMP
  3. Technology Pillar Program of China [2012BAH08B01]
  4. Hunan Provincial Science and Technology Program [2012RS4049]
  5. Hunan Provincial Natural Science Foundation [12JJ3062]

Ask authors/readers for more resources

Network forensics requires analysts to efficiently reason about various attack phenomena from massive data. Visualization techniques can convert abstract data into visual sensitive graphics; thus, forensic officers can extract useful information quickly. In this paper, we present a matrix-based visualization system for visualized forensic analysis on unintelligible traffic datasets. The system consists of three collaborative views, including the Timeline view integrating active features and individual dispersions based on information entropies for the perception of the overall time series, the Matrix view balancing the expression of network structure and distributions of IPs and ports for efficient events tracing, and the Historical view comparing statuses in successive time slots for dynamic trends tracking. The system provides a multilevel analysis architecture and multifaceted perspectives for comprehensive cognition in traffic forensics. In case studies, we describe the forensic process of this system, including identifying port scan, distributed denial of service, and botnet attacks, on the datasets in VAST Challenge 2013.

Authors

I am an author on this paper
Click your name to claim this paper and add it to your profile.

Reviews

Primary Rating

4.6
Not enough ratings

Secondary Ratings

Novelty
-
Significance
-
Scientific rigor
-
Rate this paper

Recommended

No Data Available
No Data Available