2015 IEEE Symposium on Visualization for Cyber Security (VizSec)最新文献

Unlocking user-centered design methods for building cyber security visualizations 解锁以用户为中心的设计方法，构建网络安全可视化

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312771

Sean McKenna, D. Staheli, Miriah D. Meyer

引用次数: 65

SNAPS: Semantic network traffic analysis through projection and selection SNAPS:通过投影和选择进行语义网络流量分析

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312768

B. Cappers, J. V. Wijk

{"title":"SNAPS: Semantic network traffic analysis through projection and selection","authors":"B. Cappers, J. V. Wijk","doi":"10.1109/VIZSEC.2015.7312768","DOIUrl":"https://doi.org/10.1109/VIZSEC.2015.7312768","url":null,"abstract":"Most network traffic analysis applications are designed to discover malicious activity by only relying on high-level flow-based message properties. However, to detect security breaches that are specifically designed to target one network (e.g., Advanced Persistent Threats), deep packet inspection and anomaly detection are indispensible. In this paper, we focus on how we can support experts in discovering whether anomalies at message level imply a security risk at network level. In SNAPS (Semantic Network traffic Analysis through Projection and Selection), we provide a bottom-up pixel-oriented approach for network traffic analysis where the expert starts with low-level anomalies and iteratively gains insight in higher level events through the creation of multiple selections of interest in parallel. The tight integration between visualization and machine learning enables the expert to iteratively refine anomaly scores, making the approach suitable for both post-traffic analysis and online monitoring tasks. To illustrate the effectiveness of this approach, we present example explorations on two real-world data sets for the detection and understanding of potential Advanced Persistent Threats in progress.","PeriodicalId":240847,"journal":{"name":"2015 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130344083","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 26

Visual analytics for cyber red teaming 网络红队的可视化分析

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312765

Joseph Yuen, B. Turnbull, Justin Hernandez

引用次数: 9

Visualizing the insider threat: challenges and tools for identifying malicious user activity 可视化内部威胁:识别恶意用户活动的挑战和工具

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312772

P. Legg

{"title":"Visualizing the insider threat: challenges and tools for identifying malicious user activity","authors":"P. Legg","doi":"10.1109/VIZSEC.2015.7312772","DOIUrl":"https://doi.org/10.1109/VIZSEC.2015.7312772","url":null,"abstract":"One of the greatest challenges for managing organisational cyber security is the threat that comes from those who operate within the organisation. With entitled access and knowledge of organisational processes, insiders who choose to attack have the potential to cause serious impact, such as financial loss, reputational damage, and in severe cases, could even threaten the existence of the organisation. Security analysts therefore require sophisticated tools that allow them to explore and identify user activity that could be indicative of an imminent threat to the organisation. In this work, we discuss the challenges associated with identifying insider threat activity, along with the tools that can help to combat this problem. We present a visual analytics approach that incorporates multiple views, including a user selection tool that indicates anomalous behaviour, an interactive Principal Component Analysis (iPCA) tool that aids the analyst to assess the reasoning behind the anomaly detection results, and an activity plot that visualizes user and role activity over time. We demonstrate our approach using the Carnegie Mellon University CERT Insider Threat Dataset to show how the visual analytics workflow supports the Information-Seeking mantra.","PeriodicalId":240847,"journal":{"name":"2015 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"73 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127387466","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 43

Contextual network navigation to provide situational awareness for network administrators 上下文网络导航，为网络管理员提供态势感知

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312769

C. Gray, Panagiotis D. Ritsos, Jonathan C. Roberts

引用次数: 11

Ocelot: user-centered design of a decision support visualization for network quarantine Ocelot:以用户为中心的网络隔离决策支持可视化设计

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312763

Dustin L. Arendt, R. Burtner, D. Best, Nathan D. Bos, J. Gersh, C. Piatko, C. L. Paul

引用次数: 36

PERCIVAL: proactive and reactive attack and response assessment for cyber incidents using visual analytics PERCIVAL:使用可视化分析对网络事件进行主动和被动攻击和响应评估

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312764

M. Angelini, N. Prigent, G. Santucci

引用次数: 47

A visual analytics loop for supporting model development 支持模型开发的可视化分析循环

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312767

S. Walton, E. Maguire, Min Chen

引用次数: 9

Discovery of rating fraud with real-time streaming visual analytics 利用实时流媒体可视化分析发现评级欺诈

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312770

Kodzo Wegba, Aidong Lu

{"title":"Discovery of rating fraud with real-time streaming visual analytics","authors":"Kodzo Wegba, Aidong Lu","doi":"10.1109/VIZSEC.2015.7312770","DOIUrl":"https://doi.org/10.1109/VIZSEC.2015.7312770","url":null,"abstract":"The rating fraud in online e-commerce stores targets at receiving large revenues through boosting the popularity of selected items with fake ratings. The challenges of detecting rating frauds come from discovering small scale abnormal activities in a large amount of data and detecting frauds in a time-critical manner from online rating streams. This paper presents a real-time visual analytics system that consists of two essential components: a server for automatically handling data streams and a visual analytics interface for performing interactive analysis. Based on the features of rating frauds, we present a detection solution which balances computationally expensive algorithms and interactive analysis between the server and analysts. Specifically, our detection system filters data through performing an initial suspicion level detection on the server, and analysts can combine different statistical analysis of the user / item matrix through a co-mapped singular value decomposition (SVD) diagram, re-ordered matrix representation, and the temporal view. We demonstrate our approach with case studies of different fraud scenarios and show that rating frauds can be effectively detected.","PeriodicalId":240847,"journal":{"name":"2015 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127645351","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 14

Ensemble visualization for cyber situation awareness of network security data 面向网络安全数据态势感知的集成可视化

2015 IEEE Symposium on Visualization for Cyber Security (VizSec) Pub Date : 2015-10-25 DOI: 10.1109/VIZSEC.2015.7312766

L. Hao, C. Healey, Steve E. Hutchinson

{"title":"Ensemble visualization for cyber situation awareness of network security data","authors":"L. Hao, C. Healey, Steve E. Hutchinson","doi":"10.1109/VIZSEC.2015.7312766","DOIUrl":"https://doi.org/10.1109/VIZSEC.2015.7312766","url":null,"abstract":"Network security analysis and ensemble data visualization are two active research areas. Although they are treated as separate domains, they share many common challenges and characteristics. Both focus on scalability, time-dependent data analytics, and exploration of patterns and unusual behaviors in large datasets. These overlaps provide an opportunity to apply ensemble visualization research to improve network security analysis. To study this goal, we propose methods to interpret network security alerts and flow traffic as ensemble members. We can then apply ensemble visualization techniques in a network analysis environment to produce a network ensemble visualization system. Including ensemble representations provide new, in-depth insights into relationships between alerts and flow traffic. Analysts can cluster traffic with similar behavior and identify traffic with unusual patterns, something that is difficult to achieve with high-level overviews of large network datasets. Furthermore, our ensemble approach facilitates analysis of relationships between alerts and flow traffic, improves scalability, maintains accessibility and configurability, and is designed to fit our analysts' working environment, mental models, and problem solving strategies.","PeriodicalId":240847,"journal":{"name":"2015 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"103 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122399997","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 26