Visual analytics of dynamic computer network data

Abstract

This paper presents how visual analytic techniques can be used for analyzing netflow information and thereby finding network attacks. Network security is a field of increasing importance, but also of increasing complexity. Today networks grow and are common in any larger company. At the same time the attacks increase and sensible data is less secure than before. Systems are built for analyzing network datasets in order to prevent file stealing or other large damages. Those systems try to use as much information as possible, but the large data amounts are difficult to be processed by human insight alone. In such cases automation methods can be of great help in preprocessing the data. On the other hand especially network security datasets with a lot of noise are hard to be solved completely by automation methods. Here human input can help to guide the calculation process. Visual analytics tries to combine both approaches. Most systems, built to solve this dilemma, are a collection of visualizations that show different aspects of a system. To give the user a simpler approach for analyzing such complex datasets, the presented system, named AnNetTe, was built around one clear three-step interaction pipeline. First the users get an overview of all available data and select a time range. Second they examine the interaction in the network and decide which connections to focus on. Third they explore how the network and the connections they selected interact with each other in detail. Every single step of this pipeline will be presented and by doing so, it will be shown how the best fitting visualization has been found. In the end this system is tested in a small user study and the results of their usability feedback are evaluated.