Designing an interactive visualization for intrusion detection systems with video game theory and technology

With an ever increasing number of attacks on networks that have an even more increasing amount of information being communicated across them, the old means of examining network data for intruders and malicious acts through text no longer works. Even with the help of filters and data aggregation there is too much for a person to read through and get a clear understanding of what is happen across a network, causing security officers to many times miss intrusions. With an overwhelming amount of false alerts from incorrectly setup Intrusion Detection Systems and not enough time to sift through them all, a new means of displaying and interacting with the network data presented by intrusion detection system is needed. That is why there has been an increase in research about how to create visualizations for networks that will allow someone to better understand what is happening across a network. Using previous research as well as a study of the theory and architecture used by the video game industry on interactive environments, it is possible to create an intuitive interactive visual environment of network data that will help network administrators more effectively understand their networks and where potential threats may lurk. Therefore, this proposed design attempts to help solve the problem of network communication comprehension

Developing Network Situational Awareness through Visualization of Fused Intrusion Detection System Alerts

With networks increasing in physical size, bandwidth, traffic volume, and malicious activity, network analysts are experiencing greater difficulty in developing network situational awareness. Traditionally, network analysts have used Intrusion Detection Systems to gain awareness but this method is outdated when analysts are unable to process the alerts at the rate they are being generated. Analysts are unwittingly placing the computer assets they are charged to protect at risk when they are unable to detect these network attacks. This research effort examines the theory, application, and results of using visualizations of fused alert data to develop network situational awareness. The fused alerts offer analysts fewer false-positives, less redundancy and alert quantity due to the pre-processing. Visualization offers the analyst quicker visual processing and potential pattern recognition. This research utilized the Visual Information Management toolkit created by Stanfield Systems Inc. to generate meaningful visualizations of the fused alert data. The fused alert data was combined with other network data such as IP address information, network topology and network traffic in the form of tcpdump data. The process of building Situational Awareness is an active process between the toolkit and the analyst. The analyst loads the necessary data into the visualization(s), he or she configures the visualization properties and filters the visualization(s). Results from generating visualizations of the network attack scenarios were positive. The analyst gained more awareness through the process of defining visualization properties. The analyst was able to filter the network data sources effectively to focus on the important alerts. Ultimately, the analyst was able to follow the attacker through the entry point in the network to the victims. The analyst was able to determine that the victims were compromised by the attacker. The analyst wasn\u27t able to definitively label the attack specifically yet the analyst was able to follow the attack effectively leading to Situational Awareness

Information Visualization for an Intrusion Detection System

Spatial hypertext was developed from studies of how humans deal with information overflow particularly in situations where data needed to be interpreted quickly. Intrusion detection requires security managers of large networks to rapidly respond (often in real-time) to masses of information. Users of such systems need to recognize large developing patterns in masses of data, they prefer to work individually (although they must function in collaborative groups), and they rely on their intuitions more than deductive logic. Such users have particular personality characteristics and job needs which can be well served by interfaces which use a spatial hypertext model. Also, like most users, they prefer to be in charge of the process that they use the computer as a tool to assist with. The architecture proposed in this article is based on spatial hypertext and machine learning. That interface design allows for a great deal of interface flexibility and user control. The article discusses in detail how spatial hypertext, and the proposed architecture in particular, can well fulfill the needs of intrusion detection system users through personalized information filtering