Name
Abstract | ||
|---|---|---|
This article presents what we call the parallel coordinate attack visualization (PCAV) for detecting unknown large-scale Internet attacks including Internet worms, DDoS attacks and network scanning activities. PCAV displays network traffic on the plane of parallel coordinates using the flow information such as the source IP address, destination IP address, destination port and the average packet length in a flow. The parameters are used to draw each flow as a connected line on the plane, where a group of polygonal lines form a particular shape in case of attack. From the observation that each attack type of significance forms a unique pattern, we develop nine signatures and their detection mechanism based on an efficient hashing algorithm. Using the graphical signatures, PCAV can quickly detect new attacks and enable network administrators to intuitively recognize and respond to the attacks. Compared with existing visualization works, PCAV can handle hyper-dimensions, i.e., can visualize more than 3 parameters if necessary, which significantly reduces false positives. As a consequence, Internet worms are more precisely detectable by machine and more easily recognizable by human. Another strength of PCAV is handling flows instead of packets. Per-flow visualization greatly reduces the processing time and further provides compatibility with legacy routers which export flow information, e.g., as NetFlow does in Cisco routers. We demonstrate the effectiveness of PCAV using real-life Internet traffic traces. The PCAV program is publicly available. |
Year | DOI | Venue |
|---|---|---|
2009 | 10.1016/j.cose.2008.12.003 | Computers and Security |
Keywords | Field | DocType |
parallel coordinates,parallel coordinate attack visualization,internet attack visualization,internet worms,parallel coordinate attack visualization (pcav),ddos attacks,internet traffic,false positive,ddos attack,flow visualization | Internet privacy,Denial-of-service attack,Visualization,Computer science,NetFlow,Computer security,Network packet,Parallel coordinates,Hash function,Internet traffic,The Internet | Journal |
Volume | Issue | ISSN |
28 | 5 | Computers & Security |
Citations | PageRank | References |
28 | 1.18 | 16 |
Authors | ||
3 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Hyunsang Choi | 1 | 229 | 10.54 |
| Heejo Lee | 2 | 1501 | 132.47 |
| Hyogon Kim | 3 | 494 | 58.48 |