基于Snort的多视图网络流量可视化系统

Snort-based multi-view network traffic visualization system

现今网络恶意行为成爆炸性增长,而传统的基于文本的网络入侵检测系统在面对海量网络数据时存在认知负担过重、交互性不够等问题.网络安全可视化技术则可以将海量数据以图形图像的方式表现出来,在人与数据之间实现图像通信,从而使人能够快速发现网络流量中潜在的安全威胁.本文利用Java可视化工具包实现了一个基于Snort的多视图网络流量可视化系统,该系统能对从数据库中提取出的流量警报数据进行多视图动态展示和交互操作,在一定程度上减轻了网络分析员的负担,加快了查找网络问题的进度.

Nowadays malicious behaviors are growing rapidly on the Internet,however,there are some limitations when handle the massive network data by the traditional text-based network intrusion detection system,such as heavy cognitive burden,lack of interaction and so on. Network security visualization techniques can convert massive data into graphic to achieve image communication between man and data communications,people can find the network traffic potential security threats quickly. This paper implements a Snort-based multi-view network traffic visualization system by java visualization toolkit,extracting traffic alerts in the database for multi-view dynamic display and interaction to help network administrators to understand network security posture easily.