• Journal of the Korea Convergence Society
• /
• v.10 no.12
• /
• pp.17-22
• /
• 2019

Network attack analysis and visualization methods using network traffic session data detect network anomalies by visualizing the sender's and receiver's IP addresses and the relationship between them. The traffic flow is a critical feature in detecting anomalies, but simply visualizing the source and destination IP addresses symmetrically from up-down or left-right would become a problematic factor for the analysis. Also, there is a risk of losing timely security situation when designing a visualization interface without considering the temporal characteristics of time-series traffic sessions. In this paper, we propose a visualization interface and analysis method that visualizes time-series traffic data by using the radial axis, divide IP addresses into network and host portions which then projects on the cylindrical coordinate system that could effectively monitor network attacks. The proposed method has the advantage of intuitively recognizing network attacks and identifying attack activity over time.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.07a
• /
• pp.130-132
• /
• 2005

인터넷상의 수많은 트래픽 정보 중에서 악성 트래픽 정보를 빠르게 감지하는 것은 그 정보의 방대함 때문에 쉽지 않다. 공격시각회(Attack Visualization) 기법은 이런 수많은 정보 중에서 악성 트래픽 정보를 좀 더 쉽게 인지하게 함으로써 새로운 공격에 대해서 빠른 대응과 피해 최소화를 하는데 활용할 수 있다. 본 연구에서는 평행좌표계(Parallel Coordinates)를 이용해 공격시각화를 하여, 분산 서비스 거부 공격, 웜, 스캐닝 공격 등 인터넷상에 알려진 혹은 알려지지 않은 새로운 공격들에 대해 빠른 대응을 하기위한 기술 연구를 하였으며, 각 공격들의 특정 시각화 패턴을 감지하고 이를 알려주는 이상탐지(anomaly detection) 시각화 시스템 PCAV를 구현하였다. PCAV 시스템을 통해 네트워크 관리자는 실시간으로 트래픽 정보와 공격들의 시각화 정보를 원격에서도 모니터링하고 이를 통해 즉시 대응하는 것이 가능하다. 또한, 이전에 발생한 공격들의 시각화 정보를 확인하고 이를 분석하는 것과, 알려지지 않은 공격이 발생했을지라도 그 공격의 시각적 패턴이 나타났을 때 즉각 공격 서명(Signature)으로 활용 하는 것이 가능하다.

• Convergence Security Journal
• /
• v.16 no.5
• /
• pp.41-48
• /
• 2016

In this paper we propose a new method of security visualization, VisFlow, using traffic flows to solve the problems of existing traffic flows based visualization techniques that were a loss of end-to-end semantics of communication, reflection problem by symmetrical address coordinates space, and intuitive loss problem in mass of traffic. VisFlow, a simple and effective security visualization interface, can do a real-time analysis and monitoring the situation in the managed network with visualizing a variety of network behavior not seen in the individual traffic data that can be shaped into patterns. This is a way to increase the intuitiveness and usability by identifying the role of nodes and by visualizing the highlighted or simplified information based on their importance in 2D/3D space. In addition, it monitor the network security situation as a way to increase the informational effectively using the asymmetrical connecting line based on IP addresses between pairs of nodes. Administrator can do a real-time analysis and monitoring the situation in the managed network using VisFlow, it makes to effectively investigate the massive traffic data and is easy to intuitively understand the entire network situation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.4
• /
• pp.693-704
• /
• 2020

As a company's network structure is getting bigger and the number of security system is increasing, it is not easy to quickly detect abnormal traffic from huge amounts of security system events. In this paper, We propose traffic visualization analysis system(FDANT-PCSV) that can detect and analyze security events of information security systems such as firewalls in real time. FDANT-PCSV consists of Parallel Coordinates visualization using five factors(source IP, destination IP, destination port, packet length, processing status) and Sankey visualization using four factors(source IP, destination IP, number of events, data size) among security events. In addition, the use of big data-based SIEM enables real-time detection of network attacks and network failure traffic from the internet and intranet. FDANT-PCSV enables cyber security officers and network administrators to quickly and easily detect network abnormal traffic and respond quickly to network threats.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.14 no.4
• /
• pp.1942-1950
• /
• 2013

This paper suggests a new method of detecting attacks of network traffic by visualizing original traffic data and applying multi-class SVM (support vector machine). The proposed method first generates 2D images from IP and ports of transmitters and receivers, and extracts linear patterns and high intensity values from the images, representing traffic attacks. It then obtains variance of ports of transmitters and receivers and extracts the number of clusters and entropy features using ISODATA algorithm. Finally, it determines through multi-class SVM if the traffic data contain DDoS, DoS, Internet worm, or port scans. Experimental results show that the suggested multi-class SVM-based algorithm can more effectively detect network traffic attacks.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.5
• /
• pp.21-28
• /
• 2012

Recently, the necessity for good techniques of detecting network traffic attack has increased. In this paper, we suggest a new method of detecting abnormal patterns of network traffic data by visualizing their IP and port information into two dimensional images. The proposed approach first generates four 2D images from IP data of transmitters and receivers, and makes one 2D image from port data. Analyzing those images, it then extracts their major features such as linear patterns or high intensity values, and determines if traffic data contain DDoS or DoS Attacks. To comparatively evaluate the performance of the proposed algorithm, we show that our abnormal pattern detection method outperforms the existing algorithm in terms of accuracy and speed.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.1
• /
• pp.25-38
• /
• 2017

Many security threats are occurring around the world due to the characteristics of industrial control systems that can cause serious damage in the event of a security incident including major national infrastructure. Therefore, the industrial control system network traffic should be analyzed so that it can identify the attack in advance or perform incident response after the accident. In this paper, we research the visualization technique as network forensics to enable reasonable suspicion of all possible attacks on DNP3 control system protocol, and define normal action based rules and derive visualization requirements. As a result, we developed a visualization tool that can detect sudden network traffic changes such as DDoS and attacks that contain anormal behavior from captured packet files on industrial control system network. The suspicious behavior in the industrial control system network can be found using visualization tool with Digital Bond packet.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.3
• /
• pp.107-117
• /
• 2009

Network administrator recognizes the abnormal phenomenon in the managed network by using the alert messages generated in the security devices including the intrusion detection system, intrusion prevention system, firewall, and etc. And then the series of task, which searches for the traffic related to the alert message and analyzes the traffic data, are required to determine where the abnormal phenomenon is the real network security threat or not. There are many alert messages to have to inspect in order to determine the network security situation. Also the much times are needed so that the network administrator can analyze the security condition using existing methods. Therefore, in this paper, we proposed an efficient method for analyzing network security situation using visualization. The proposed method monitors anomalies occurred in the entire IP address's space and displays the detail information of a security event. In addition, it represents the physical locations of the attackers or victims by linking GIS information and IP address. Therefore, it is helpful for network administrator to rapidly analyze the security status of managed network.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.6
• /
• pp.1315-1324
• /
• 2012

Security visualization is a form of the data visualization techniques in the field of network security by using security-related events so that it is quickly and easily to understand network traffic flow and security situation. In particular, the security visualization that detects the abnormal situation of network visualizing connections between two endpoints is a novel approach to detect unknown attack patterns and to reduce monitoring overhead in packets monitoring technique. However, the session-based visualization doesn't notice a difference between normal traffic and attacks that they are composed of similar connection pattern. Therefore, in this paper, we propose an efficient session-based visualization method for analyzing and detecting between normal server activities and attacks by using the IP address splitting and port attributes analysis. The proposed method can actually be used to detect and analyze the network security with the existing security tools because there is no dependence on other security monitoring methods. And also, it is helpful for network administrator to rapidly analyze the security status of managed network.

• Proceedings of the KAIS Fall Conference
• /
• 2006.05a
• /
• pp.517-521
• /
• 2006

네트워크 가상현실 시스템은 먼 거리에 떨어진 사용자들 사이에 일관성 있는 가상 세계를 제공하며, 군사, 오락, 건축 등 여러 부분에 응용되고 있다. 본 논문에서는 그 동안 고성능 그래픽 워크스테이션 환경에서 중심적으로 연구되어 왔던 네트워크 가상현실 시스템을 가장 보편적인 플랫폼인 네트워크 환경에서 구현할 때 생기는 3차원 그래픽 처리 성능의 문제 등과 같은 이에 대한 해결책들을 제시하고 미로 환경과 지형 환경에 근거한 가상 세계를 응용 실험 대상으로 삼아 성능을 분석하였다. 실시간으로 상호 작용하는 어플리케이션은 성능을 유지하면서 모든 참가자들에게 동일한 뷰를 보여주는 것이 중요하다. 동일한 뷰를 제공하기 위해 참가자들이 전송하는 이벤트마다 재생 지연 시간을 설정하고, 수신한 이벤트에 대해서는 예정 재생 시각까지 버퍼에 저장하여 모든 참가자들이 동시에 이벤트를 실행하도록 하는 기법이 제안되어 왔다. 그러나 네트워크 트래픽이 동적으로 변하므로 네트워크 상에서 발생하는 전송 지연 시간도 동적으로 변화한다. 그러므로 고정된 재생 지연 시간을 사용할 경우, 네트워크 트래픽 감소에 따라 상호 작용 성능을 향상시킬 수 있는 기회를 상실하게 되고, 네트워크 트래픽 증가에 따라 이벤트 손실률이 크게 증가하게 되어 참가자들 간에 일치하지 않는 뷰를 초래하게 된다. 네트워크 트래픽이 적어서 전송 지연 시간이 짧을 경우 짧은 재생 지연 시간을 적용하여 상호작용 성능을 높여주고, 트래픽이 많은 경우에는 재생 지연 시간을 늘림으로써 상호 작용 성능을 해치지 않는 범위에서 이벤트 손실률을 줄인다. 실험을 통하여 제안하는 기법의 성능을 평가하였으며 그 결과 본 동기화 기법이 고부하(heavily loaded) 네트워크 상태가 지속되는 동안 기존 기법에 비해 참가자들에게 일치된 뷰를 제공할 수 있고, 저부하(lightly loaded) 네트워크 상태에서는 상호 작용 성능을 향상시킬 수 있다는 것을 확인하였다.