多视图合作的网络流量时序数据可视分析

Collaborative Visual Analytics for Network Traffic Time-Series Data with Multiple Views

网络安全可视化作为一个交叉应用研究领域,为传统网络安全数据分析方法注入了新的活力.但已有研究过于注重网络安全数据的可视表达,而忽视了对分析流程的支持.抽象了网络安全分析人员用网络流量时序数据检测网络异常的过程,提出了一个自顶向下的网络流量时序分析流程模型.以该模型为指导,设计并实现了一个多视图合作的网络流量时序数据可视分析原型系统.在分析端口扫描和DDo S攻击等常见网络异常的案例中,该系统中的4个协同交互、简单易用的可视视图,可以较好地支撑分析人员由整体到个体、由点到面以及由历史到未来的网络流量时序数据分析过程.

Cyber security visualization is a multi-discipline research field. Visualization techniques have injected new vitality into traditional analysis methods for cyber security. However, most existing studies focus on the visual expression and overlook the visual support for the data analysis process. This paper presents a top-down model for anomaly detection on network traffic time-series data drawing from the experience of cyber security analysts. A prototype system is designed based on this model, and it includes four collaborative views with direct and rich interactions. A number of experiments, including port scanning and DDo S attacking, are carried out to demonstrate that this system can support network traffic time-series analysis on overview to detail, point to area and past to future process flows.