# Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization  
Eric Muhati  
1 Data Science and Cybersecurity Center (DSC\({}^{\text{2}}\)), Department of Electrical Engineering and Computer Science, Howard University, Washington, DC 20059, USA 1  
Danda Rawat  
1 Data Science and Cybersecurity Center (DSC\({}^{\text{2}}\)), Department of Electrical Engineering and Computer Science, Howard University, Washington, DC 20059, USA 1  
Footnote 1: [[https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp)]([https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp))  
Footnote 2: [[https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp)]([https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp))  
Footnote 3: [[https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp)]([https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp))  
Footnote 4: [[https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp)]([https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp))  
Footnote 5: [[https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp)]([https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp))  
Footnote 6: [[https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp)]([https://www.mdpi.com/journal/jcp](https://www.mdpi.com/journal/jcp))  
Footnote 7: https://  
reveal defensive mechanisms to attackers, providing them with information that could be exploited in future attacks [4]. Additionally, the vast amount of data generated by modern networked systems can strain the processing capabilities of NIDSs, affecting their real-time detection performance [5]. In response to these challenges, there is a growing inclination in the cybersecurity domain towards the integration of visualization techniques with traditional NIDSs [6, 7, 8]. Despite this interest, many current visualization approaches fall short in effectively representing the technical ramifications of cyberattacks [6, 7, 8]. There remains a significant need for a cyber visualization tool that seamlessly integrates with NIDS alerts and provides real-time comprehensive insights into the threat landscape. In the context of these cybersecurity challenges, a synergy between streamlined abstraction and the visualization of security events may offer a robust solution for network anomaly detection [9]. The adversarial tactics, techniques, and procedures detailed in [10] span seven distinct phases. Within this schema, adversaries first undertake reconnaissance, subsequently weaponize malware, devise a delivery mechanism, exploit identified vulnerabilities, and eventually escalate and sustain the attack while maintaining persistent network connectivity. Notably, the execution of the latter five stages hinges on a successful breach, emphasizing the significance of network connectivity and the absence of effective NIDS intervention. Given that adversarial actions invariably leave detectable footprints within network traffic [11], an incisive focus on specific traffic patterns and behaviors can prevent sub-optimal network traffic analysis. \"Footprints\" are signs that indicate potential security threats within network traffic, including unusual patterns like spikes in traffic or unexpected request types, which can suggest malicious activities. For instance, if a server typically receives 100 connection requests per time interval but suddenly receives \(10,000\) requests/probes as an outlier considering all other network constants, that can be a clear footprint of a potential distributed denial of service (DDoS) attack. In light of the aforementioned context, our research introduces a novel model characterized by the following model objectives (MO):  
* MO-1: We present a low-cost and straightforward technique for extracting network data using _open-source_ scanning tools designed to dynamically capture network connections, facilitating the efficient identification of potentially malicious hosts.