Visualizing Network Traffic: for SiLK Data Exploration and Scan Detection - Softcover

El-Shehaly, Mai

Softcover

ISBN 10: 3639251407 ISBN 13: 9783639251401

Publisher: VDM Verlag Dr. Müller, 2010

Synopsis

Network packet traces, despite having a lot of noise, contain priceless information, especially for investigating security incidents and performance problems. However, given the gigabytes of ?ow crossing a typical enterprise network every day, spotting malicious activity and analyzing trends become tedious tasks. Therefore, the appropriate representation of traffic data to the human user is crucial to network security. In this book, we bring together two powerful tools from different areas of application: SiLK (System for Internet-Level Knowledge), for command-based network trace analysis; and ComVis, a generic information visualization tool. We integrate the powers of both tools by aiding simplified interaction between them, using a simple GUI, for the purpose of visualizing network traces, characterizing interesting patterns, and ?ngerprinting related activity. The main contribution of this research is a protocol-specific framework of visualization for ICMP and UDP traffic data. The Guidelines we infer can be vital in the creation of ?smart books? describing best practices in using visualization and interaction techniques to maintain network security.

Edition details

• Publisher: VDM Verlag Dr. Müller
• Publication date: 2010
• Language: English
• ISBN 10: 3639251407
• ISBN 13: 9783639251401
• Binding: Paperback
• Number of pages: 200