Name
Abstract | ||
|---|---|---|
Plentiful, complex, and dynamic data make understanding the state of an enterprise network difficult. Although visualization can help analysts understand baseline behaviors in network traffic and identify off-normal events, visual analysis systems often do not scale well to operational data volumes (in the hundreds of millions to billions of transactions per day) nor to analysis of emergent trends in real-time data. We present a system that combines multiple, complementary visualization techniques coupled with in-stream analytics, behavioral modeling of network actors, and a high-throughput processing platform called MeDICi. This system provides situational understanding of real-time network activity to help analysts take proactive response steps. We have developed these techniques using requirements gathered from the government users for which the tools are being developed. By linking multiple visualization tools to a streaming analytic pipeline, and designing each tool to support a particular kind of analysis (from high-level awareness to detailed investigation), analysts can understand the behavior of a network across multiple levels of abstraction. |
Year | DOI | Venue |
|---|---|---|
2010 | 10.1145/1850795.1850805 | VizSEC |
Keywords | Field | DocType |
real-time visualization,multiple level,network traffic,enterprise network,dynamic data,network behavior,complementary visualization technique,visualization,network actor,network flow,symbolic aggregate approximation,behavior modeling,operational data volume,real-time data,real-time,high-throughput,multiple visualization tool,real-time network activity,situational awareness,security,situation awareness,real time systems,modeling,flow,visual analysis,computer networks,real time data,high throughput,network,behavior,real time,computer graphics | Flow network,Data mining,Computer security,Computer science,Situation awareness,Visualization,Behavioral modeling,Dynamic data,Analytics,Enterprise private network,Creative visualization | Conference |
Citations | PageRank | References |
19 | 0.91 | 12 |
Authors | ||
5 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Daniel M. Best | 1 | 54 | 4.95 |
| Shawn Bohn | 2 | 63 | 3.13 |
| Douglas Love | 3 | 28 | 1.63 |
| Adam Wynne | 4 | 68 | 9.41 |
| William A. Pike | 5 | 136 | 6.62 |