Hierarchical Visualization of Network Intrusion Detection Datain the IP Address Space
Takayuki ITOH1,2 Hiroki TAKAKURA2
Atsushi SAWADA2 Koji KOYAMADA3
1) Department of Information Sciences, Faculty of Science, Ochanomizu University
2) Academic Center for Computing and Media Studies, Kyoto University
3) Center for the Promotion of Excellence in Higher Education, Kyoto University
itot@computer.org, {takakura, sawada, koyamada}@media.kyoto-u.ac.jp
are often too busy to take the time to operate the GUI.

1. Introduction

Recently various studies on intrusion analysis and secure

Intrusion detection is an active area of research. Many

network management have been reported [1,2]. In addition to

Intrusion Detection System (IDS) products are available, andthose, visualization of incidents is very effective forthese systems generally detect network intrusions and record

intuitively and quickly understanding their distribution.

the intrusions into log files. To understand the performanceThis paper presents a new technique to visualize theand limitations of these systems, we have conducted a study

contents of huge IDS log files. The goals of the visualization

on several of the IDS products that are deployed on open andtechnique are to make the available statistics from IDS

large-scale computer networks.

systems understandable and to offer an interactive way of

We have identified thefollowing issues:•

exploring detailed information. Another feature of thee-mails to network

visualization technique is representing the distribution ofadministrators for each incident (i.e., an intrusion

incidents in IP-address spaces, revealing the relevancy of therecord). They often send enormous numbers of e-mails

distribution to the organizational structure of real society.

Several

IDS

systems

send

if the network is large-scale.

••Moreover, it is very

The technique first forms a four-level hierarchy ofdifficult to understand the relevancy and statistics ofcomputers, by grouping the computers according to their IP

aggregate incidents by only receiving the alerts foraddresses byte-by-byte. It then visualizes the hierarchical data

individual incidents.

as bars and nested rectangles [3,4], where bars denotecomplicatedcomputers and rectangles denote groups of computers. It

combinations of various incidents. Intelligent, intuitive,

finally represents the statistics of incidents by mapping theand real-time solutions are required for an overall

number of incidents of each computer as heights of the bars.

understanding of the complicated behavior.

The technique can represent the distribution of incidents in

Databases for storing IDS logs often grow huge, andlarge-scale computer networks consisting of several thousand

therefore usability of the databases is often problematic.

computers.

Recentattacks

often

consistof

Solutions that assist the user in querying for data are•

The technique helps the user intuitively understand thedesirable to reduce query operations.

distribution and trend of enormous numbers of incidents inGUIs of current IDS products visualize information

IP-address spaces of computer networks. It also helps thevery superficially. For example, the time sequence of

discovery of relevant relationships between distributions of

numbers of incidents of the whole domain may be

incidents and the organization of real society, because IP

visualized as simple bar charts or polygonal charts. The

addresses are usually assigned according to the organization

user may need to perform many operations to exploreof real society.

detailed information, but in many cases administrators

Moreover, the technique can provide the capability toexplore detailed information about incidents for each•Many computers attack one computer simultaneously.

computer, by representing computers as clickable icons. This•

When a computer is attacked and virus is placed on thecapability assists users in exploring the detailed information

computer, it then turns to attack other computers.
•of incidents for each computer.
This paper presents experimental results on visualizing

One (or more) computers attack other computers in thesame group or department.

enormous numbers of real incidents, and describes what kindWith these features, the presented visualization techniqueof trends are observed from the experimental results.

complements existing techniques well.

2. Related works

3. Hierarchical data visualization
3.1 Rectangle packing for hierarchical data

Many IDS products provide detection, warning, and analysis
capabilities for incidents, but they have not completely solved

The proposed technique applies a hierarchical data

the issues described in Section 1. Several recent works

visualization technique presented in [3,4]. Figure 1 is an

improve the issues.

example of the visualization by this technique, which

On the other hand, it is important to minimize damage byrepresents leaf-nodes as black square icons, and branch-nodes

discovering

as rectangular borders enclosing the icons.

high-security

incidents

intuitively

and

immediately, and information visualization is a valuable
technology for this task. As described in the sidebar“Visualization for computer network and intrusion detection”,
recent works for visualization of network intrusion include
the following features:•

Visualization and detail-on-demand user interfaces
showing time sequences of network traffic,•

Filtering of error detection or unimportant malicious
accesses from visualization results,•

Visual data mining for discovery of suspicious traffic
patterns from general log files, and•Visualizationof

distributionoftrafficonIP-address-oriented display spaces.

Figure 1. Example of hierarchical data visualization using a
rectangle packing algorithm.

The technique presented in this paper can be categorized as“visualization of IP-address-oriented spaces” here the

The visualization technique places thousands of leaf-nodes

difference of this technique over existing techniques is that

into one display space while satisfying the following

this technique attempts to maximize the density of theconditions:information on display. This feature represents computers as•

small clickable icons, enabling a user interface that presents
its detail on-demand for each computer.

single hierarchy of other nodes,•

Also, the technique is useful for discovering the behavior ofincidents relevant to the distribution of computers and theorganizational structure of real society. For example, itvisualizes the following behaviors:•

One computer attacks many others simultaneously.

It never overlaps the leaf-nodes and branch-nodes in a

It attempts to minimize the display area requirement,and•It draws all leaf-nodes by equally shaped and sizedicons.

[3] for hierarchical data visualization, but an improved
rectangle packing algorithm has been later presented in [4].
Both algorithms place icons and rectangles one-by-one onto
display spaces, while the algorithms choose their positions
from multiple candidate positions.
As shown in Figure 2, the improved rectangle packing
algorithm [4] applies grid-like subdivision of a display area
using extension lines of edges of previously placed rectangles.
The algorithm quickly generates multiple candidate positions?

for the rectangle currently being placed by referring to thegrid-like subdivision. It generates at most four candidates atthe corner of empty subspaces of the grid-like space, where: candidate position

the current rectangle can be placed without yielding any
unnecessary gaps with previously placed rectangles. The
algorithm then decides the position of the rectangle while it
avoids overlapping the rectangle with previously placed ones,
and attempts to minimize the area and aspect ratio of thewhole grid-like space. If there is no adequate candidate
position to place the rectangle, the algorithm additionallygenerates several candidate positions outside the grid-likeFigure 2. Improved rectangle packing algorithm.

space, and selects one of the candidates to place the rectangle.

(Upper) Previously-placed rectangles, and grid-like
subdivision of a display space. (Center) Candidate

3.2 Visualization in the IP address spacepositions for placing the current rectangle. (Lower)

The presented technique groups the computers according toPlacement of the current rectangle, and the update of

their IP addresses to form hierarchical data. It first groups

grid-like subdivision.

them according to the first byte of the IP addresses. It againgroups them according to the second byte of the IP addresses,

This representation style is suitable to equally visualize

and finally groups according to the third byte of the IP

thousands of leaf-nodes of hierarchical data in one display

addresses. Consequently the technique forms four-level

space. We applied the technique to visualization of bioactive

hierarchical data as shown in Figure 3(Left). The techniquechemicals [4], distribution of jobs in parallel computing

visualizes the structure of computer network by representing

environments [5], and so on.

the hierarchical data as shown in Figure 3(Right). Here, black

The technique first packs icons, and then encloses them inicons in Figure 3(Right) represent computers, and therectangular borders. Similarly, it packs a set of rectangles thatrectangular borders represent groups of computers.

belong to higher levels, and generates the larger rectangles

We think that the technique is useful for the visualization ofthat enclose them. Repeating the process from the lowest

computer network spaces because:level toward the highest level, the technique places all of the•

The technique visualizes large-scale hierarchical data

data onto the layout area. The packing algorithm for icons andcontaining thousands of leaf-nodes without overlapping,rectangles is the key technology for the visualizationand therefore it can represent thousands of computers astechnique. Itoh et al. proposed a rectangle packing algorithm

clickable icons in one display space. The technique is•therefore useful as a GUI to directly explore detailed

the incidents in the following processing order:

information about incidents of arbitrary computers in

RDB-like data structure:large-scale computer networks.

Consuming the log file, the presented technique forms a data

The technique visualizes a hierarchy of computers

structure like a relational database (RDB), as shown in Figure

according to their IP addresses. Therefore, it can briefly

4(2). It constructs tables for time, signature IDs, security

represent the correlation between incidents and groups

levels, senders’ IP addresses, and receivers’ IP addresses. The

of computers in real society, because IP addresses aredata structure accelerates the aggregation of incidents.

often assigned according to the structure of a real

Construction of hierarchical data:

organization.

Simultaneously the technique lists the IP addresses of senders
and receivers, and forms hierarchical data by referring to IP
addresses byte-by-byte, as shown in Figure 4(3).
1.2.3.4
1.2.3.5

1.*.*.*
1.2.*.*
1.2.3.* 1.2.4.*

1.2.4.6

Here allthe computers described in the log file are registered in thehierarchical data.

1.2.4.5
1.3.*.*

1.3.3.4
2.3.5.5
2.3.5.7
3.5.6.8
2.*.*.*

3.*.*.*

Figure 3. (Left) Hierarchy of computers according totheir IP addresses. (Right) Illustration of visualization
results of the hierarchical data.

4. Implementation
4.1 Network intrusion detection data
The presented technique consumes the log files of acommercial IDS system (Cisco Secure IDS 4320 [6]). The

Figure4.

Processing

order

of

the

proposedvisualization technique.

system detects incidents based on signatures that predefine
the typical patterns of malicious accesses. The technique

Aggregation of incidents for each computer:

inputs the following items from the description of the log files,

The technique then counts the total number of sending andas shown in Figure 4(1):receiving incidents for each computer. Here it can specify the•

IP address of a computer sending incidents.

conditions, such as signature IDs, security levels, and range of•IP address of a computer receiving incidents.

times, to filter non-important incidents. If a signature ID is•Date and time.

specified, the technique counts them, referring to the•

Positive integer ID (signature ID) that denotes thesignature ID table. Similarly, it refers to the time or security

specific signature.

level tables if the range of time or the security level is

Security level (1, 2, 3, 4, and 5).

specified.

•

Representation:

4.2 Visualization procedure

The technique then visualizes the hierarchical data. Here it

Consuming the log files, the presented technique visualizes

represents the numbers of sending and receiving incidents foreach computer, by mapping the numbers as heights ofleaf-nodes. As shown in Figure 5, the technique represents the

The technique can control the level of detail of visualization

numbers of sending and receiving incidents by assigningby eliminating or assigning dark colors to leaf-nodes

different colors. Examples shown in Figures 8 to 10 represent

corresponding to low-security computers.

the number of sent incidents as blue, and the number of

Also, it can assign bright colors to leaf-nodes corresponding

received incidents as red.

to computers sending or receiving pre-defined high-security
incidents, to alert administrators of the return of known
attacks. The example shown in Figure 10 represents
computers sending or receiving high-security incidents inyellow.

4.3 GUI capability
We developed the GUI of the presented technique as a JavaApplet. The features of the GUI are as follows.
Figure 5. Illustration of visualizing the numbers of

Dialog windowforincidents as heights of leaf-nodes.

counting incidents:

configuringconditionsfor

The GUI pops up a dialog window for configuring conditions
Configuration of high-security (or low-security)

for counting incidents, including signature IDs, security levels,

incidents:

ranges of times, and IP addresses. Figure 6(Upper) shows anGenerally an IDS does not always provide adequate warning

example of the dialog window. Given the conditions, theof the security level of incidents because impact of incidents

technique only counts incidents satisfying the conditions. The

strongly depends on each computer network’s situation. The

GUI enables more focused visualization, for example:

presented technique consumes the description of signature•“The network was damaged during 13:05 to 13:10, so I

IDs and IP addresses of experienced high-security (orwould like to visualize the distribution of incidents

low-security) incidents, as shown in Figure 4(4). Thisduring that time,”

capability

allowsanadministrator

toconfigure

the•“The network was damaged by the specific signatures,visualization results according to his or her preferences, for

so I would like to visualize the distribution of theexample:signatures,” or•••''Incidents which have specific signature IDs are always•“This specific computer is often problematic, so I would

erroneous or ignorable in this network'',

like to visualize the distribution of incidents related to''Incidents which have specific signature IDs havethe computer by specifying its IP address.”damaged this network in the past'', andDialog window for listing incidents for specific''Incidents which have specific IP addresses of senders

computer:have damaged this network in the past''.

The GUI pops up a dialog window that displays the list of

Also, the capability allows configuring the following

incidents for a specific computer that is the sender or thecomputers as high-security:

receiver. The dialog window pops up when a leaf-node is•''Computers that sent or received more than a constantclicked, and then shows the list of incidents for the specificnumber of incidents in a constant time'', andcomputer corresponding to the clicked leaf-node. Figure''Computers whose number of sending or receiving

6(Lower-left) shows an example of the dialog window.

incidents drastically increases.''

Dialog for listing records of typical attacks:•

Reflection of previous strong attacks may be good references

GUI to explore the details of incidents if they find malicious

for secure management of computer network. The GUI pops

traffic in the HTML report. Having the Java-based GUI pop

up a dialog window for displaying the list of pre-defined

up with the specified time span from the HTML reportprevious strong attacks, for example:

window may prove useful.

•“A specific computer sent an enormous number of

5. Experimental results

malicious attacks during 12:35 to 12:40 on Feb 21.”
Figure 6(Lower-right) shows an example of the dialog

This section introduces the results of the presented technique.

window, listing date and time, and IP addresses of senders.

We implemented the technique with Java 1.4 and Microsoft

Selecting one of the attacks from the list, the technique

Windows XP on an IBM ThinkPad T42 (CPU 1.8GHz, RAM

visualizes the distribution of corresponding incidents. The

756MB). They developed the GUI using Java Swing library,capability should be useful for administrators who want toand the drawing component using Java AWT library.

share and analyze previous damages. If the display space

Figures 8 to 10 show the visualization results of an IDS log

allows displaying a larger dialog window, additional

file used in a real network environment. Here, the numbers of

information, such as IP addresses of receivers, and signature

sent incidents are represented in blue, and the numbers ofIDs, is presented so that users can easily specify past attacks.

received incidents are represented in red. In the all figures

Segments

viewpoints are right sides of the bars and rectangles.

representing

pairs

of

sendersandreceivers:

Figure 8 shows the time sequence of visualization results

The GUI can display segments connecting pairs of leaf-nodes

using the log file recorded in 6 hours, containing 61822 lines

corresponding to senders and receivers. It displays theand 3984 computers. In our measurement, the implementation

segments for a specific computer when a user clicks atook 120 seconds for reading the log file, 0.6 seconds forleaf-node corresponding to the computer. This capability

forming and visualizing the hierarchy of computers, and 7.1

helps users to explore the propagation of incidents. For

seconds for recounting incidents while GUI operations.

example, many incidents from the same sender concentrate

Figure 8(a) shows the result of amounts of incidents in 5

their attacks on a small number of receivers, or distribute theirminutes, Figure 8(b) shows the result in 5 minutes just after

attacks to large numbers of receivers. Figure 9 shows thethe time of Figure 8(a), Figure 8(c) shows the result in 5

example of the segments.

minutes 2 hours after the time of Figure 8(b), and Figure 8(d)shows the result in 5 minutes 2 hours after the time of Figure

4.4 HTML-based reporting8(c).

We developed a component to generate JPEG-format image

Figure 8(a) shows several computers that sent incidents tofiles of visualization results. We also developed a component

other several computers. It might mean that the senders

to generate HTML-based reports using the image generation

randomly searched for the targets of attacks. Figure 8(b)component. The implementation of the reporting component

shows that a sender found a specific computer as the target of

frequently repeats generating image files while counting thethe attack, and the sender concentrated to send the incidents

incidents, finally generating HTML files as indices of theto it. Figure 8(c) shows that the sender shown in Figure 8(b)image files. Figure 7 shows an example of the Web page

had been disconnected, but several new senders attempted togenerated by this function. Sharing the HTML and image files,

attack several computers. One of the new receivers was in themultiple administrators can easily exchange knowledge ofdifferent department from the continuously attacked receivers.

incidents to remotely manage the network.

Figure 8(d) shows that some of the senders and receivers

The report itself does not support GUI capabilities describedshown in Figure 8(c) had been disconnected, but manyin the Section 4.3. Administrators should use the Java-based

computers in the same department received incidents in a

structure of real society.

short time. The incidents might be a scan attack for the
specific department.

Figures 8 and 9 demonstrate that the technique visualizes

Figure 9 shows the pairs of senders and receivers by yellow

interesting behavior about multiple computers in the same

segments. When a user clicks a leaf-node on the display, thedepartment. Figure 10 is useful for finding dangerous

technique extracts incidents that the computer corresponding

incidents from thousands of computers.

to the clicked leaf-node is sender or receiver, and represents

In addition to the above experiments, we think that thethe incidents as the yellow segments. The segments connect

technique is useful for:to the same tall red bar in the upper side of the figure, from−

IP-address-oriented spaces,

multiple blue bars in small rectangles in the center of the
figure. This example shows that many computers, in the same−observing if malicious computers attack an entire−

discovering that computers receive attacks fromdomain or only specific IP address blocks, ordepartment denoted as a small rectangle, concentrated to send
incidents to the same computer.

observing the drastic change of incident patterns inFigure 10 shows an example that the technique highlights

multiple computers, where most of the attacks areleaf-nodes corresponding to the senders or receivers ofignorable but a few others are serious.

Here,

On the other hand, the technique still has the following

administrators of the computer network used for these figures

issues, which will be the focus of future work for the

disconnected the senders or receivers of incidents 16 times in

improvement of the technique.

two months, because of pernicious attacks. We found in thisScalability:

enormous number of incidents that the signature IDs and IP

Figures 8 to 10 shows that the technique is feasible foraddresses of the sender were identical in 5 of 16 attacks. Theyvisualization of incidents of 4000 computers, but it might bealso found in another large group of incidents that thedifficult for a user to comprehend the distribution of

signature IDs and IP addresses of senders were identical in 3

intrusions and explore detailed information if there are moreof 16 attacks. These experiences mean that same kinds ofcomputers. There are several ideas for this problem, but weincidents are often repeated for specific attack purposes.

have not implemented any of them.

Therefore, the presented technique can contribute to alert the1)high-security

incidents

on

the

real

network.

A zooming interface can be applied to the problem. Hereadministrators by highlighting leaf-nodes corresponding to

we can switch the representation into two modes:

the senders or receivers of high-security incidents. Also, theoverview mode and clickable mode. The former modetechnique can register previous damages, so that users canjust represents the nest of IP addresses and highlights

select the damages via the dialog shown in Figure

interesting areas, and the latter mode zooms into the6(Lower-right).

interesting areas so that the display space can represent

Figure 11 shows closer-up views of above visualization

computers as clickable bars.

results, including receivers in Figure 8(a), and senders and a
receiver in Figure 9.

2)Another idea is removal of computers whose numbers ofsending/receiving incidents are zero, and packing therepresentations of remaining computers into a smaller

6. Discussion

display space. The idea has a problem of stability of

As described in the Section 1, a feature of the presented

display layout since the content of computers changes

technique is the representation of:over time, but the problem can be solved by applying−

statistics of incidents for thousands of computers,

layout template presented in the Section 5 of [3].

−distribution of incidents on IP-address spaces, andOcclusion:−

relevancy of the distribution to the organizational

The presented technique applies 3D representation for thestatistics of incidents, but this style yields occlusions among

We plan to prove the effectiveness of the technique by

metaphor of computers. One idea is applying multiple

observing with real network management and users. Also, thedisplays with independent viewpoints. Currently we arefollowing issues, as well as issues discussed in Section 6, will

discussing to split the visualization technique into three

be the focus of future work based on this technique:displays per console. Another idea for minimizing the•

Combination with intelligent techniques, such as data

occlusions is applying the viewing optimization problem somining and knowledge management, to effectively

that entropy of the visualization result is maximized. However,discover and alert high-security incidents.

this approach may cause instability of viewing parameters.

•

Visualization of statistics of incidents in larger time

This is not only security-specific but also a general problem

span, such as a week or a month. We think that thefor 3D information visualization, and we think this area isnumber of incidents becomes less important as the timeripe for future work for the enhancement of the presented

span grows, so representation of incidents should behierarchical data visualization technique.

enhanced for long-term visualization.

Visualization results may be crowded when the techniquedeals with long-term periods because numbers of incidents foreach computer increase. In this case the number of occluded
icons may also increase. We think that this problem will be
improved by applying near-real-time observation, e.g., bycounting numbers of incidents and refreshing the display per
minute.
Hierarchy representation:
While currently we represent hierarchy as a single color ofnested rectangular borders, it might be more effective if
different colors are assigned to the borders according to thehierarchy’s depth, if understanding the relationship between
the distribution of intrusions and the hierarchy of anorganization is very critical.

The presented technique only represents the link of traffic
only by specifying a computer, as shown in Figure 9. ThisisnotenoughVisualization focusing on time-varying distribution ofincidents. Combining our technique with time-oriented
visualization techniques, such of Mie-log (introduced as[7] in Visualization for Computer Network andIntrusion Detection sidebar) may effectively visualize
the time-varying distribution of intrusions. Some kindsof trends or attack patterns can be also discovered bydeveloping visualizations of the time-sequence of
intrusions.

Acknowledgement
We appreciate the anonymous reviewers’ many fruitfulcomments on this paper.

References[1] Y. D. Cai, D. Clutter, G. Pape, J. Han, M. Welge, L. Auvil,

Many-to-many traffic:

capability

•

for

the

understandingof

many-to-many traffic, for example the result shown in Figure8(a). It would be useful if the implementation automaticallydetects important links and represents them. Parameter
Focusing (introduced as [4] in Visualization for Computer
Network and Intrusion Detection sidebar) may be a goodreference to improve the technique for this issue.

MAIDS: Mining Alarming Incidents from Data Streams,
SIGMOD Conference 2004, pp. 919-920, 2004.
[2] S. J. Stolfo, W. Lee, P. K. Chan, W. Fan, E. Eskin, Data
Mining-based Intrusion Detectors: An Overview of theColumbia IDS, Project. SIGMOD Record, Vol. 30, No. 4, pp.
5-14, 2001.
[3] T. Itoh, Y. Yamaguchi, Y. Ikehata, Y. Kajinaga,
Hierarchical

Data

Rectangle-Packing

Visualization
Algorithm,

IEEE

Using

a

Transactions

Fast
on

Visualization and Computer Graphics, Vol. 10, No. 3, pp.

7. Conclusion
This paper presents a technique for representing the statistics
and trends of incidents in large-scale computer network.

302-313, 2004.
[4] T. Itoh, F. Yamashita, Visualization of multi-dimensional
data of bioactive chemicals using a hierarchical datavisualization

technique“HeiankyoView”,

Asia

Pacific

International 2003, pp. 162-169, 2003.

Symposium on Information Visualization (APVIS) 2006, to[6] Cisco Secure IDS.

be presented.

http://www.cisco.com/japanese/warp/public/3/jp/product/secu[5] Y. Yamaguchi, T. Itoh, Visualization of Distributed

rity/ids/index.html

Processes Using "Data Jewelry Box" Algorithm, CG

Security level
Range of time

IP address

SignatureDate, time, signature ID, security level,
sender, and receiver for a single incident

Date

Range of time

Senders

Figure 6. GUIs for visualization of IDS data. (Upper) Dialog window for configuring conditions for counting
incidents. (Lower-right) Dialog window for listing incidents for specific computer. (Lower-right) Dialog for listing
records of typical attacks.

Figure 7. Report generated as HTML and image files.

Receivers

Senders

Figure 8. (a) Multiple senders and receivers are observed.

Receiver

SenderFigure 8. (b) A sender started concentrating its attack on the single receiver.

New receiver

Continuously
attackedreceiverNew sender

New sender

Figure 8. (c) The sender has been disconnected: however, several other computers turned as new senders, and several
other computers received the attacks. The new senders were in the same department with the previous sender, but the
new receiver was in a different department from the continuously attacked receivers.

Many receivers in thesame department

Figure 8. (d) Many receivers are observed in the same department. This pattern might be a scan attack for specificdepartment.

Multiple senders

Figure 9. Multiple computers in the same organization directed to send incidents to the same computer.

Figure 10. Yellow leaf-nodes represent the computers which sent or received incidents whose IDs and senders weresame as past danger incidents. This representation helps to reduce damages by notifying the past incidents.

Figure 11. Closer-up views of the visualization. (left) Receivers in Figure 8(a). (right) Senders and a receiver inFigure 9.

Visualization for Computer Network and Intrusion Detection[3] B. Cheswick, H. Burch, S. Branigan, Mapping and visualizing the

Visualization of Internet and computer network is a very vitalinternet. Proccedings of the 2000 USENIX Annual Techincal Conference,research topic, and therefore various works have been presented.

2000.

Some works focus on representation of topology of network[4] R. A. Becker, S. G. Eick, A. R. Wilks, Visualizing Network Data, IEEE

connection [1,2,3], and some others focus on representation ofTransactions on Visualization and Computer Graphics, Vol. 1, No. 1, pp.

network traffic [4,5,6]. Visualization for network intrusion

16-28, 1995.

detection has been a vital research topic in these several years.

[5] J. Pongsiri, M. Parikh, M. Raspopovic, K. Chandra, Visualization of

Takada et al. presented a technique ''Mie-log''[7]. This techniqueInternet Traffic Features. 12th International Conference of Scientifichorizontally divides a display space. The left-side of the display

Computing and Mathematical Modeling. 1999.

space provides bar charts of statistics of incidents per a constant[6] N. Patwari, A. O. Hero, A. Pacholski, Manifold Learning Visualization oftime, and the right-side provides detailed information of incidents

Network Traffic Data, 2005 Workshop on Mining Network Data, 2005.

of a user-selected time span. The technique simultaneously[7] T. Takada, H. Koike, MieLog: A Highly Interactive Visual Log Browser

provides global and local views, and detail-on-demand operations,

Using Information Visualization and Statistical Analysis, Proceedings offor time sequence of incidents.

LISA XVI Sixteenth Systems Administration Conference, The USENIX

Logs of incidents often contain enormous numbers of error

Association, pp.133-144, 2002.

detections or of ignorable incidents. Koike et al. presented an[8] H. Koike, K. Ohno, SnortView: Visualization System of Snort Logs,

effective visualization technique that indicates only high-danger

CCS Workshop on Visualization and Data Mining for Computer Security

incidents [8]. Axelesson presented a similar visualization technique(VizSEC/DMSEC 04), 2004.

combined with a possibility-based filtering system to eliminate[9] S. Axelsson, Combining A Bayesian Classifer with Visualization:

errors or ignorable incidents [9].

Understanding the IDS, CCS Workshop on Visualization and Data Mining

Some works focused on the visual data mining of non-IDS logs to

for Computer Security (VizSEC/DMSEC 04), 2004.

discover suspicious traffic patterns. Axelsson applied the Parallel[10] S. Axelsson, Visualization for Intrusion Detection Hooking the Worm,

Coordinate technique to visualize the multi-dimensional data ofEuropean Symposium on Research in Computer Security 2003, pp. 309-325,

access log files of Web servers [10]. This technique represents

2003.

various attributes of accesses in one display space, and contributes[11] X. Yin, W. Yuric, M. Treaster, Y. Li, K. Lakkaraju, VisFlowConnect:

to the analysis of unknown attacks. Yin et al. also applied Parallel

Netflow Visualization of Link Relationships for Security Situational

Coordinates to discover suspicious traffic patterns [11]. Tee Teoh et

Awareness, Proceedings of the 2004 ACM workshop on Visualization andal. applied robust visual analysis technology to discover suspicious

data mining for computer security, pp. 26-23, 2004.

traffic from network log files, by the combination of various[12] S. T. Teoh, T. J. Jankun-Kelly, K.-L. Ma, F. Wu, Visual Data Analysis

visualization techniques [12]. Erbacher et al. applied glyph

for Detecting Flaws and Intruders in Computer Network Systems, IEEE

metaphors to represent network traffic and discover suspicious

Computer Graphics and Applications, Vol. 24, No. 5, pp. 27-35, 2004.

accesses [13].

[13] R. F. Erbacher, K. L. Walker, D. A. Fincke, Intrusion and misuse

Some works visualize network traffic in IP-address spaces

detection in large-scale systems. IEEE Computer Graphics and Applications,[14,15]. Their representation style simply maps values of each byte

22(1):38–48, January/February 2002.

of IP-address onto horizontal and vertical axes of display spaces.

[14] W. Yurcik, K. Lakkaraju, J. Barlow, J. Rosendale, A prototype tool for
visual data mining of network traffic for intrusion detection. In Proceedingsof the ICDM Workshop on Data Mining for Computer Security(DMSEC’03), 2003.

References[1] T. Munzner, E. Hoffman, K. Claffy, B. Fenner. Visualizing the global[15] R. Ball, G. A. Fink, C. North, Home-centric visualization of network

topology of the mbone.

traffic for security administration, Proceedings of the 2004 ACM workshop

Proceedings of the 1996 IEEE Symposium on

Information
Visualization, pages 85–92, 1996.
[2] T. Munzner. Exploring large graphs in 3d hyperbolic space. IEEE
Computer Graphics and Applications, 18(4):18–23, July/August 1998.

on Visualization and data mining for computer security, pp. 55-64, 2004.