# Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization
* MO-2: We automate the network data extraction mechanism to ensure its replicability for subsequent research endeavors. * MO-3: We overlay our anomaly detection framework with a cyber visualization layer, capturing benign or malicious connections. This visualization granularity is derived from computed attack and defense metrics, as illustrated in Figure 1.
* MO-4: Finally, we incorporate proactive mitigation strategies within our visual module, where link hues transition from red to blue, signifying the successful counteraction of cyber threats, and conversely from blue to red upon detecting malicious activities. Our proposed model case study can be described as an analysis of temporal and behavioral patterns' network traffic, distinguishing between normal operations and potential threats. An anomaly is detected when a surge in failed connection attempts is observed, deviating from a baseline of established connections typically seen from benign hosts. Unlike traditional systems that might flag this as a mere spike in traffic, our proposed model assesses the failure rate in conjunction with established connections to flag attack attempts.This is also summarized in Figure 1 to depict the novelty of the model's ability to accurately identify threats by analyzing nuanced patterns of network interactions, thereby giving an improved and effective NIDS. The essence of our paper revolves around addressing specific and prevalent threats related to DoS and malware probing. It is pertinent to emphasize that while the cybersecurity domain is vast and multifaceted, zooming in on specific threat vectors offers the advantage of depth, precision, and optimized solutions. While there exists a multitude of cyber threats like malware command and control, command/SQL injection, and drive-by download attacks, our targeted approach is towards DoS and malware probing threats. This focus is substantiated by evidence of their disruptive capabilities on cyber-physical systems, as highlighted in [12]. DoS attacks, for example, are shown to significantly impair communications between physical and computing systems, thereby demonstrating their potential to disrupt operations. Focusing our analytical techniques on these specific threat vectors allows us to deliver a highly refined and effective detection mechanism [12]. TCP connectivity-based analysis, in particular, has shown to be adept at uncovering the subtle nuances and patterns related to these threats [13]. Integrating machine learning (ML) techniques or rule-based detection mechanisms can provide an enriched detection landscape [1]. However, introducing them without a well-defined scope might lead to a dilution of precision, increased false positives and potential inefficiencies [3; 11]. Our current approach sets a strong foundation upon which subsequent research can build, expanding to other threats and incorporating diverse detection mechanisms. TCP connectivity-based analysis, in particular, has shown to be adept at uncovering the subtle nuances and patterns related to these threats. The remainder of this paper is organized as follows: Section 2 delineates the existing research gap; Section 3 provides the foundational background; Section 4 details our model's implementation. Our performance evaluation and its empirical results are presented in Section 5, while Section 6 describes the design of our visual prototype. We conclude the paper in Section 7. Figure 1: Model flow diagram.