Abstract
Every day, networks are flooded with data that far exceeds what humans can feasibly comb through in a timely manner. Security analysts have turned to visualization techniques to in an attempt to streamline the identification of network threats. The problem is that most security visualization techniques do not take into account the cognitive principles that enable human beings to rapidly process information visually. We propose a tool, called the Converged Security Visualization Tool (Cover-VT), designed on these cognitive principles. Our tool facilitates rapid identification of threats by minimizing the cognitive obstacles to efficient threat location. Cover-VT is scalable meaning that analysts can identify threats from a global view or drill down to a pinpoint view to identify the source of an infection. Cover-VT was also designed with usability in mind, making it easy to comprehend regardless of the level of user experience.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Shelly, D., Dunlop, M., Marchany, R., Sforza, P.: Using geographic information systems for enhanced security visualization. In: The 1st International Conference on Computing for Geospatial Research and Application, COM. Geo. (June 2010)
Taylor, S.M.: How much information is enough? decision-making and cognitive analysis. In: 10th International Command and Control Research and Technology Symposium (June 2005)
Miller, G.: The magical number seven, plus or minus two: Some limits on our capacity for processing information. The Psychological Review 63(2), 81–97 (1956)
Wegman, E.J.: Visual data mining. Statistics in Medicine 22(9), 1383–1397 (2003)
Snort, http://www.snort.org/ (accessed April 2, 2010)
Conti, G., Abdullah, K., Grizzard, J., Stasko, J., Copeland, J., Ahamad, M., Owen, H., Lee, C.: Countering security information overload through alert and packet visualization. IEEE Computer Graphics and Applications 26(2), 60–70 (2006)
Wegman, E.J.: Huge data sets and the frontiers of computational feasibility. Journal of Computational and Graphical Statistics 4(4), 281–295 (1995)
Steinman, S.B.: Serial and parallel search in pattern vision? Perception 16(3), 389–398 (1987)
Healey, C.G.: Perception in visualization, http://www.csc.ncsu.edu/faculty/healey/PP/index.html (last updated May 11, 2009)
Rosenholtz, R., Li, Y., Nakano, L.: Measuring visual clutter. Journal of Vision 7(2), 1–22 (2007)
Phillips, R.J.: An investigation of visual clutter in the topographic base of a geological map. The Cartographic Journal 19(2), 122–132 (1982)
Nowell, L., Hetzler, E., Tanasse, T.: Change blindness in information visualization: A case study. In: INFOVIS 2001: the IEEE Symposium on Information Visualization, pp. 15–22. IEEE Computer Society, Washington, DC (2001)
Simons, D.J.: Current approaches to change blindness. Visual Cognition 7(1), 1–15 (2000)
Rensink, R.A., O’Regan, J.K., Clark, J.J.: To See or Not to See: The Need for Attention to Perceive Changes in Scenes. Psychological Science 8, 368–373 (1997)
Rensink, R.A.: The need for attention to see change, http://www.psych.ubc.ca/~rensink/flicker/index.html (accessed April 25, 2010)
Patcha, A., Park, J.M.: A revised taxonomy for intrusion-detection systems. Annals of Telecommunications 55(7-8), 361–378 (2000)
Kasemsri, R.R.: A Survey, Taxonomy, and Analysis of Network Security Visualization Techniques. Master’s thesis, Georgia State University (2005)
Patcha, A., Park, J.M.: An overview of anomaly detection techniques: Existing solutions and latest technological trends. Computer Networks 51(12), 3448–3470 (2007)
Open Source Security Information Management (OSSIM), http://www.alienvault.com/community.php?section=Home (accessed April 9, 2010)
DShield, http://www.dshield.org/ (accessed April 9, 2010)
Koike, H., Ohno, K.: SnortView: visualization system of Snort logs. In: The 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pp. 143–147. ACM, New York (2004)
ArcSight ESM Enterprise Security Manager, http://www.arcsight.com/products/products-esm/ (accessed April 9, 2010)
SnoGE, http://leonward.wordpress.com/snoge/ (accessed April 16, 2010)
RUMINT, http://www.rumint.org/ (accessed April 16, 2010)
Yin, X., Yurcik, W., Treaster, M., Li, Y., Lakkaraju, K.: VisFlowConnect: netflow visualizations of link relationships for security situational awareness. In: The 2004 ACM Workshop on Visualization and Data Mining for Computer Security (VizSEC/DMSEC 2004), pp. 26–34. ACM, New York (2004)
AfterGlow, http://afterglow.sourceforge.net/ (accessed April 9, 2010)
Shannon, C.E.: A mathematical theory of communications. The Bell Systems Technical Journal 27 (1948)
Open Geospatial Consortium KML, http://www.opengeospatial.org/standards/kml/ (accessed April 21, 2010)
Wolfe, J.M., Cave, K.R., Franzel, S.L.: uided search: an alternative to the feature integration model for visual search. Journal of Experimental Psychology: Human Perception and Performance 27(3), 419–433 (1989)
Woodruff, A., Landay, J., Stonebraker, M.: Constant information density in zoomable interfaces. In: The 4th International Working Conference on Advanced Visual Interfaces (AVI 1998), pp. 57–65 (1998)
Stroe, I.D., Rundensteiner, E.A., Ward, M.O.: Scalable Visual Hierarchy Exploration. In: Ibrahim, M., Küng, J., Revell, N. (eds.) DEXA 2000. LNCS, vol. 1873, pp. 784–793. Springer, Heidelberg (2000)
Jacko, J.A., Sears, A. (eds.): The human-computer interaction handbook: fundamentals, evolving technologies and emerging applications. L. Erlbaum Associates Inc., Hillsdale (2003)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Dunlop, M., Urbanski, W., Marchany, R., Tront, J. (2012). Leveraging Cognitive Principles to Improve Security Visualization. In: Benlamri, R. (eds) Networked Digital Technologies. NDT 2012. Communications in Computer and Information Science, vol 294. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-30567-2_22
Download citation
DOI: https://doi.org/10.1007/978-3-642-30567-2_22
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-30566-5
Online ISBN: 978-3-642-30567-2
eBook Packages: Computer ScienceComputer Science (R0)