Interactive Exploration of Data Traffic with Hierarchical Network Maps
|
Abstract—Network communication has become indispensable in business, education, and government. With the pervasive role of the Internet as a means of sharing information across networks, its misuse for destructive purposes, such as spreading malicious code, compromising remote hosts, or damaging data through unauthorized access, has grown immensely in the recent years. The classical way of monitoring the operation of large network systems is by analyzing the system logs for detecting anomalies. In this work, we introduce Hierarchical Network Map, an interactive visualization technique for gaining a deeper insight into network flow behavior by means of user-driven visual exploration. Our approach is meant as an enhancement to conventional analysis methods based on statistics or machine learning. We use multidimensional modeling combined with position and display awareness to view source and target data of the hosts in a hierarchical fashion with the ability to interactively change the level of aggregation or apply filtering. The interdisciplinary approach integrating data warehouse technology, information visualization, and decision support, brings about the benefit of efficiently collecting the input data and aggregating over very large data sets, visualizing the results, and providing interactivity to facilitate analytical reasoning.
[1] 1440 S. Lau, “The Spinning Cube of Potential Doom,” Comm. ACM, vol. 47, no. 6, 2004.
[2] J. McPherson, K.-L. Ma, P. Krystosk, T. Bartoletti, and M. Christensen, “Portvis: A Tool for Port-Based Detection of Security Events,” Proc. ACM Workshop Visualization and Data Mining for Computer Security, 2004.
[3] C. Muelder, K.-L. Ma, and T. Bartoletti, “A Visualization Methodology for Characterization of Network Scans,” Proc. IEEE Workshop Visualization for Computer Security (VizSEC), Oct. 2005.
[4] K. Abdullah, C. Lee, G. Conti, J.A. Copeland, and J. Stasko, “IDs Rainstorm: Visualizing IDs Alerts,” Proc. IEEE Workshop Visualization for Computer Security (VizSEC), Oct. 2005.
[5] S.T. Teoh, T. Jankun-Kelly, K.-L. Ma, and S.F. Wu, “Visual Data Analysis for Detecting Flaws and Intruders in Computer Network Systems,” IEEE Trans. Computer Graphics and Applications, Sept./Oct. 2004.
[6] G.A. Fink and C. North, “Root Polar Layout of Internet Address Data for Security Administration,” Proc. IEEE Workshop Visualization for Computer Security (VizSEC), Oct. 2005.
[7] Sourcefire, Real-Time Network Awareness, Nov. 2005, http://www.sourcefire.com/productsrna.html .
[8] B. Johnson and B. Shneiderman, “Tree Maps: A Space-Filling Approach to the Visualization of Hierarchical Information Structures,” Proc. IEEE Visualization Conf., pp. 284-291, 1991.
[9] E.F. Codd, S.B. Codd, and C.T. Salley, “Providing OLAP (Online Analytical Processing) to User-Analysts: An IT Mandate,” technical report, E.F. Codd & Assoc., 1993.
[10] C. Stolte, D. Tang, and P. Hanrahan, “Multiscale Visualization Using Data Cubes,” IEEE Trans. Visualization and Computer Graphics, vol. 9, no. 2, pp. 176-187, 2003.
[11] T.B. Pedersen and C.S. Jensen, “Multidimensional Database Technology,” Computer, vol. 34, no. 12, pp. 40-46, 2001.
[12] Maxmind, Ltd., Geoip Database, http:/www.maxmind.com, 2005.
[13] D. Bruls, C. Huizing, and J. van Wijk, “Squarified Treemaps,” Proc. Joint Eurographics and IEEE TCVG Symp. Visualization, 2000.
[14] D.A. Keim, S.C. North, C. Panse, and M. Sips, “Pixelmaps: A New Visual Data Mining Approach for Analyzing Large Spatial Data Sets,” Proc. ICDM 2003, Third IEEE Int'l Conf. Data Mining, Nov. 2003.
[15] D.A. Keim, S.C. North, C. Panse, M. Schäfer, and M. Sips, “HistoScale: An Efficient Approach for Computing Pseudo-Cartograms,” Proc. IEEE Visualization Conf., pp. 28-29, Oct. 2003.
[16] R. Heilmann, D.A. Keim, C. Panse, and M. Sips, “RecMap: Rectangular Map Approximations,” Proc. InfoVis 2004, IEEE Symp. Information Visualization, pp. 33-40, Oct. 2004.
[17] D.A. Keim, F. Mansmann, C. Panse, J. Schneidewind, and M. Sips, “Mail Explorer—Spatial and Temporal Exploration of Electronic Mail,” Proc. Eurographics/IEEE-VGTC Symp. Visualization (EuroVis '05), June 2005.
[18] M. Ankerst, D.A. Keim, and H.-P. Kriegel, “Recursive Pattern: A Technique for Visualizing Very Large Amounts of Data,” Proc. IEEE Visualization Conf. '95, pp. 279-286, 1995.
[19] S.G. Eick, “Visual Scalability,” J. Computational & Graphical Statistics, Mar. 2002.
Index Terms:
Data and knowledge visualization, information visualization, visual analytics, network security.
Citation:
Florian Mansmann, Svetlana Vinnik, "Interactive Exploration of Data Traffic with Hierarchical Network Maps," IEEE Transactions on Visualization and Computer Graphics, vol. 12, no. 6, pp. 1440-1449, Nov./Dec. 2006, doi:10.1109/TVCG.2006.98
PURCHASE ARTICLE: $19
IEEE Xplore Subscribers
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb