swMATH ID: 21753
Software Authors: Yin, X., Yurcik, W., Treaster, M., Li, Y., Lakkaraju, K.
Description: VisFlowConnect: netflow visualizations of link relationships for security situational awareness. We present a visualization design to enhance the ability of an administrator to detect and investigate anomalous traffic between a local network and external domains. Central to the design is a parallel axes view which displays NetFlow records as links between two machines or domains while employing a variety of visual cues to assist the user. We describe several filtering options that can be employed to hide uninteresting or innocuous traffic such that the user can focus his or her attention on the more unusual network flows. This design is implemented in the form of VisFlowConnect, a prototype application which we used to study the effectiveness of our visualization approach. Using VisFlowConnect, we were able to discover a variety of interesting network traffic patterns. Some of these were harmless, normal behavior, but some were malicious attacks against machines on the network.
Homepage: https://dl.acm.org/citation.cfm?id=1029208.1029214
Related Software: NVisionIP; BotGraph; BLINC; SaM; Nfdump; Dynagraph; arulesViz; PCAV; Graphviz
Referenced in: 0 Publications