We present a visualization design to enhance the ability of an administrator to detect and investigate anomalous traffic between a local network and external domains. Central to the design is a parallel axes view which displays NetFlow records as links between two machines or domains while employing a variety of visual cues to assist the user. We describe several filtering options that can be employed to hide uninteresting or innocuous traffic such that the user can focus his or her attention on the more unusual network flows.This design is implemented in the form of VisFlowConnect, a prototype application which we used to study the effectiveness of our visualization approach. Using VisFlowConnect, we were able to discover a variety of interesting network traffic patterns. Some of these were harmless, normal behavior, but some were malicious attacks against machines on the network.

VisFlowConnect: netflow visualizations of link relationships for security situational awareness

Most visualizations of security-related network data require large amounts of finely detailed, high-dimensional data. However, in some cases, the data available can only be coarsely detailed because of security concerns or other limitations. How can interesting security events still be discovered in data that lacks important details, such as IP addresses, network security alarms, and labels? In this paper, we discuss a system we have designed that takes very coarsely detailed data--basic, summarized information of the activity on each TCP port during each given hour--and uses visualization to help uncover interesting security events.

PortVis: a tool for port-based detection of security events

We present a novel paradigm for visual correlation of network alerts from disparate logs. This paradigm facilitates and promotes situational awareness in complex network environments. Our approach is based on the notion that, by definition, an alert must possess three attributes, namely: what, when, and where. This fundamental premise, which we term w/sup 3/, provides a vehicle for comparing between seemingly disparate events. We propose a concise and scalable representation of these three attributes, that leads to a flexible visualization tool that is also clear and intuitive to use. Within our system, alerts can be grouped and viewed hierarchically with respect to both their type, i.e., the what, and to their where attributes. Further understanding is gained by displaying the temporal distribution of alerts to reveal complex attack trends. Finally, we propose a set of visual metaphor extensions that augment the proposed paradigm and enhance users' situational awareness. These metaphors direct the attention of users to many-to-one correlations within the current display helping them detect abnormal network activity.

A visualization paradigm for network intrusion detection

We present a novel visual correlation paradigm for situational awareness (SA) and suggest its usage in a diverse set of applications that require a high level of SA. Our approach is based on a concise and scalable representation, which leads to a flexible visualization tool that is both clear and intuitive to use. Situational awareness is the continuous extraction of environmental information, its integration with previous knowledge to form a coherent mental picture, and the use of that picture in anticipating future events. In this paper we build on our previous work on visualization for network intrusion detection and show how that approach can be generalized to encompass a much broader class of SA systems. We first propose a generalization that is based on what we term, the w/sup 3/ premise, namely that each event must have at least the what, when and where attributes. We also present a second generalization, which increases flexibility and facilitates complex visual correlations. Finally, we demonstrate the generality of our approaches by applying our visualization paradigm in a collection of diverse SA areas.

Visual correlation for situational awareness

Reliable data transfer is one of the most difficult tasks to be accomplished in multihop wireless networks. Traditional transport protocols like TCP face severe performance degradation over multihop networks given the noisy nature of wireless media as well as unstable connectivity conditions in place. The success of TCP in wired networks motivates its extension to wireless networks. A crucial challenge faced by TCP over these networks is how to operate smoothly with the 802.11 wireless MAC protocol which also implements a retransmission mechanism at link level in addition to short RTS/CTS control frames for avoiding collisions. These features render TCP acknowledgments (ACK) transmission quite costly. Data and ACK packets cause similar medium access overheads despite the much smaller size of the ACKs. In this paper, we further evaluate our dynamic adaptive strategy for reducing ACK-induced overhead and consequent collisions. Our approach resembles the sender side's congestion control. The receiver is self-adaptive by delaying more ACKs under nonconstrained channels and less otherwise. This improves not only throughput but also power consumption. Simulation evaluations exhibit significant improvement in several scenarios

/pdf/a-smart-tcp-acknowledgment-approach-for-multihop-wireless-3m8lm1pyrx.pdf

A Smart TCP Acknowledgment Approach for Multihop Wireless Networks

Network protocol designers face many difficult tasks, including simultaneously monitoring state in a potentially large number of nodes, understanding and analyzing complex message exchanges, and characterizing dynamic interactions with competing traffic. Traditionally they have used packet traces to accomplish these tasks, but traces have two major drawbacks: they present an incredible amount of detail, which challenges the designer's ability to comprehend the data; and they are static, which hides an important dimension of protocol behavior. As a result, detailed analysis frequently becomes tedious and error-prone. Although network simulators such as the VINT project's ns can easily generate numerous detailed traces, they provide limited help for analyzing and understanding the data. Nam, the network animator that we developed in our work at the VINT project, provides packet-level animation, protocol graphs, traditional time-event plots of protocol actions, and scenario editing capabilities. Nam benefits from a close relationship with ns, which can collect detailed protocol information from a simulation. With some preprocessing. Nam can visualize data taken directly from real network traces.

S. McCanne

Papers

Network visualization with Nam, the VINT network animator