Sciweavers

Share
VIROLOGY
2010

Applied parallel coordinates for logs and network traffic attack analysis

8 years 11 months ago
Applied parallel coordinates for logs and network traffic attack analysis
By looking on how computer security issues are handled today, dealing with numerous and unknown events is not easy. Events need to be normalized, abnormal behaviors must be described and known attacks are usually signatures. Parallel coordinates plot offers a new way to deal with such a vast amount of events and event types: instead of working with an alert system, an image is generated so that issues can be visualized. By simply looking at this image, one can see line patterns with particular color, thickness, frequency, or convergence behavior that gives evidence of subtle data correlation. This paper first starts with the mathematical theory needed to understand the power of such a system and later introduces the Picviz software which implements part of it. Picviz dissects acquired data into a graph description language to make a parallel coordinate picture of it. Its architecture and features are covered with examples of how it can be used to discover security related issues.
Sébastien Tricaud, Philippe Saadé
Added 31 Jan 2011
Updated 31 Jan 2011
Type Journal
Year 2010
Where VIROLOGY
Authors Sébastien Tricaud, Philippe Saadé
Comments (0)
books