Browse > Article

Monitoring Network Security Situation Based on Flow Visualization  

Chang, Beom-Hwan (호원대학교 사이버수사보안학부)
Publication Information
Convergence Security Journal / v.16, no.5, 2016 , pp. 41-48 More about this Journal
Abstract
In this paper we propose a new method of security visualization, VisFlow, using traffic flows to solve the problems of existing traffic flows based visualization techniques that were a loss of end-to-end semantics of communication, reflection problem by symmetrical address coordinates space, and intuitive loss problem in mass of traffic. VisFlow, a simple and effective security visualization interface, can do a real-time analysis and monitoring the situation in the managed network with visualizing a variety of network behavior not seen in the individual traffic data that can be shaped into patterns. This is a way to increase the intuitiveness and usability by identifying the role of nodes and by visualizing the highlighted or simplified information based on their importance in 2D/3D space. In addition, it monitor the network security situation as a way to increase the informational effectively using the asymmetrical connecting line based on IP addresses between pairs of nodes. Administrator can do a real-time analysis and monitoring the situation in the managed network using VisFlow, it makes to effectively investigate the massive traffic data and is easy to intuitively understand the entire network situation.
Keywords
Network Security; Network Security Visualization; Network Attack Analysis; Traffic Analysis; Flow Visualization;
Citations & Related Records
Times Cited By KSCI : 4  (Citation Analysis)
연도 인용수 순위
1 Y. Hu, "Adaptive Flow Aggregation-A New Solution for Robust Flow Monitoring under Security Attacks," Proceedings of the 10th IEEE/IFIP on Network Operations and Management Symposium, pp. 424-435, 2006.
2 K. Lakkaraju, W. Yurcik, and A.J. Lee, "NVisionIP: Netflow Visualizations of System State for Security Situational Awareness," Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pp. 65-72, 2004.
3 X. Yin, W. Yurcik, and A. Slagell, "The Design of VisFlowConnect-IP: A Link Analysis System for IP Security Situational Awareness," Proceedings of the 3rd IEEE International Workshop on Information Assurance, pp. 141-153, 2005.
4 T. Taylor, D. Paterson, J. Glanfield and et al., "FloVis: Flow visualization system," Conference For Homeland Security, 2009. CATCH'09. Cybersecurity Applications & Technology, pp. 186-198, 2009.
5 E.L. Malecot, M. Kohara, Y. Hori, and K. Sakurai, "Interactively Combining 2D and 3D Visualization for Network Traffic Monitoring," Proceedings of the 3rd International Workshop on Visualization for Computer Security, pp. 123-127, 2006.
6 장범환, "종단간의 유사 연결 패턴을 갖는 정상 서버 활동과 공격의 구분 및 탐지 방법," 정보보호학회논문지, Vol. 22, No. 6, pp. 1315-1324, 2012.
7 정치윤, 손선경, 장범환, 나중찬, "시각화 기반의 효율적인 네트워크 보안 상황 분석 방법," 한국정보보호학회논문지, Vol. 19, No. 3, pp. 107-117, 2009.
8 장범환, "트래픽 세션의 포트 역할을 이용한 네트워크 공격 시각화," 디지털산업정보학회논문지, 제11권, 제4호, pp. 47-60, 2015.   DOI
9 Beom-Hwan Chang and Chi-Yoon Jeong, "An Efficient Network Attack Visualization using Security Quad and Cube," ETRI Journal, Vol. 33, No. 5, pp. 770-779, 2011.   DOI
10 A. Giani, I.G.D. Souza, V. Berk, and G. CybenkoI, "Attribution and Aggregation of Network Flows for Security Analysis," Proceedings of the 2006 CERT FloCon Workshop, pp. 1-4, 2006.
11 E.W. Bethel, S. Campbell, E. Dart, K. Stockinger, and K. Wu, "Accelerating Network Traffic Analytics Using Query-Driven Visualization," Proceedings of the 2006 IEEE Symposium on Visual Analytics Science and Technology, pp. 115-122, 2006.
12 R. Ball, G.A. Fink, and C. North, "Home-Centric Visualization of Network Traffic for Security Administration," Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pp. 55-64, 2004.