多种可视化技术相结合的网络安全数据分析研究

Network-Security-Data Analysis and Research Implemented by Combining Multiple Visulization Technologies

网络安全可视化是网络安全研究中的重要环节,它通过可视分析,为网络安全员提供一种分析网络结构和识别网络异常的新方法。针对网络监控日志数据量大、维度高等特点,对网络安全可视化分析方法进行研究和实验。采用网络拓扑图、散点图、柱状图、平行坐标等可视化方法,对网络的体系结构、异常行为、通信模式进行可视分析。使用China Vis2016挑战赛的数据对以上可视化方法进行验证,实验结果表明,以上几种可视方法都能针对不同的问题给出解决方案,其对分析网络安全数据可行、有效。

Network security visualization, as an important part of network security reaearch, could provide a new method for network security officer to visually analyze the network structure and identify the abnormity of network security. In view of large amount of log data for network monitoring and high dimension, the visualization of network security analysis method is studied and verified. With network topology, scatter diagram, histogram, parallel coordinate and other visualization methods, the visual analysis could be done on network architecture, abnormal behavior, and communication mode. The experiment with the data of China Vis2016 challenge verifies the above visualization methods, and also indicates that the above several visual methods can give solutions for different problems, and thus are feasible and effective for visual analysis of network security data.