Bridging the gap of network management and anomaly detection through interactive visualization

Tao Zhang, Qi Liao, Lei Shi

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

12 Scopus citations

Abstract

Large-scale networks have become increasingly challenging to manage. It is vital for a system administrator or network manager to be able to analyze the vast amount of log data in order to detect suspicious behaviors or patterns, possibly due to malicious users/applications or faulty devices. While an intrusion detection system (IDS) log can provide a large number of warnings, exactly which alarms are true while the others are false, and more importantly what are the underlying causes are still difficult to know. To bridge the gap between network log and anomaly discovery, we design and implement a visualization tool that combines multiple commodity visualizations with minimum learning curve. While each individual view is well understood, the effects of such views in analyzing network anomalies are not well studied. Since each visualization technique has advantages as well as limitations in addressing a particular task, we show that these views, when combined and linked together, may provide an effective and lightweight network anomaly analysis tool. The web-based open platform may simplify network administration as well as promote collaborative analysis among researchers.

Original languageEnglish
Title of host publicationProceedings - 2014 IEEE Pacific Visualization Symposium, PacificVis 2014
PublisherIEEE Computer Society
Pages253-257
Number of pages5
ISBN (Print)9781479928736
DOIs
StatePublished - 2014
Event2014 7th IEEE Pacific Visualization Symposium, PacificVis 2014 - Yokohama, Kanagawa, Japan
Duration: Mar 4 2014Mar 7 2014

Publication series

NameIEEE Pacific Visualization Symposium
ISSN (Print)2165-8765
ISSN (Electronic)2165-8773

Conference

Conference2014 7th IEEE Pacific Visualization Symposium, PacificVis 2014
Country/TerritoryJapan
CityYokohama, Kanagawa
Period03/4/1403/7/14

Keywords

  • Network Anomaly Visualization

Fingerprint

Dive into the research topics of 'Bridging the gap of network management and anomaly detection through interactive visualization'. Together they form a unique fingerprint.

Cite this