skip to main content
10.1145/1850795.1850801acmotherconferencesArticle/Chapter ViewAbstractPublication PagesvizsecConference Proceedingsconference-collections
research-article

PeekKernelFlows: peeking into IP flows

Published: 14 September 2010 Publication History

Abstract

This paper introduces a new method for getting insights into IP related data flows based on a simple visualization technique that leverages kernel functions defined over spatial and temporal aggregated IP flows. This approach was implemented in a visualization tool called PeekKernelFlows. This tool simplifies the identification of anomalous patterns over a time period. An intuitive adapting image allows network operators to detect attacks. We validated our method on a real use-case scenario, where we inspected traffic of a high-interaction honeypot.

References

[1]
K. Cho, R. Kaizaki and A. Kato, Aguri: An aggregation-based traffic profiler, QoflS2001, LNCS 2156, pp. 222--242, Springer Verlag, 2001.
[2]
M. F. Cowlishaw, Fundamental Requirements for picture presentation, In Proc. of the Society for picture presentation, vol. 26 no. 2, pp. 101--107, 1985.
[3]
S. Foresti, J. Agutter, Y. Livnat, Yarden, S. Moon, R. Erbacher, Visual Correlation of Network Alerts, IEEE Comput. Graph. Appl., vol. 26 n. 2, pp. 48--59, IEEE Computer Society Press, Los Alamitos, CA, USA, 2009.
[4]
J. Glanfield, S. Brooks, T. Taylor, D. Paterson, C Smith, C. Gates, J. McHugh, OverFlow: An Overview Visualization for Network Analysis, 6th International Workshop on Visualization for Cyber Security. Atlantic City, NJ., 2009
[5]
B. Gonzalez-Arevalo, F. Hernandez-Campos, J. S. Marron, C. Park, Visualization Challenges in Internet Traffic Research, Graphics of Large Data Sets: Visualizing a Million, Ed. A. Unwin, M. Theus, H. Hofmann, Springer, New York, pp. 203--226, 2006.
[6]
J. R. Goodall and D. R. Tesone, Visual Analytics for Network Flow Analysis, Conference For Homeland Security, Cybersecurity Applications & Technology, pp. 199--204, IEEE Computer Society, Los Alamitos, CA, USA, 2009.
[7]
R. Kaizaki, O. Nakamura and J. Maurai, Characteristics of Denial of Service Attacks on Internet using Aguri, ICOIN 2003, LNCS 2662, pp. 849--857, Springer Verlag, 2003.
[8]
T. Kohonen, Self-Organizing Maps, 3rd Edition, Springer Verlag, 2001.
[9]
F. Mansmann, F. Fischer, D. A. Keim and S. C. North, Visual support for analyzing network traffic and intrusion detection events using TreeMap and graph representations, CHiMiT'09: ACM Proceedings of the Symposium on Computer Human Interaction for the Management of Information Technology, pp. 19--28, Baltimore, Maryland, 2009.
[10]
V. A. Patole, V. K. Pachghare, P. Kulkarni, Self Organizing Maps to build Intrusion Detection System, International Journal of Computer Applications, 0975-8887, vol. 1 n. 8, 2010.
[11]
L. Spitzner, Honeypots: Tracking Hackers, Addison-Wesley Professional, 2002.
[12]
V. Vapnik, Statistical Learning Theory, Wiley, 1998.

Cited By

View all
  • (2017)FLUKESProceedings of the International Conference on Future Networks and Distributed Systems10.1145/3102304.3102337(1-6)Online publication date: 19-Jul-2017
  • (2016)A Survey on Information Visualization for Network and Service ManagementIEEE Communications Surveys & Tutorials10.1109/COMST.2015.245053818:1(285-323)Online publication date: Sep-2017
  • (2011)Machine learning approach for IP-flow record anomaly detectionProceedings of the 10th international IFIP TC 6 conference on Networking - Volume Part I10.5555/2008780.2008784(28-39)Online publication date: 9-May-2011
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences
VizSec '10: Proceedings of the Seventh International Symposium on Visualization for Cyber Security
September 2010
123 pages
ISBN:9781450300131
DOI:10.1145/1850795
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 14 September 2010

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. IP flow visualisation
  2. honeypot monitoring
  3. machine learning with kernel methods

Qualifiers

  • Research-article

Conference

VizSec '10

Acceptance Rates

VizSec '10 Paper Acceptance Rate 12 of 27 submissions, 44%;
Overall Acceptance Rate 39 of 111 submissions, 35%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)6
  • Downloads (Last 6 weeks)1
Reflects downloads up to 20 Jan 2025

Other Metrics

Citations

Cited By

View all
  • (2017)FLUKESProceedings of the International Conference on Future Networks and Distributed Systems10.1145/3102304.3102337(1-6)Online publication date: 19-Jul-2017
  • (2016)A Survey on Information Visualization for Network and Service ManagementIEEE Communications Surveys & Tutorials10.1109/COMST.2015.245053818:1(285-323)Online publication date: Sep-2017
  • (2011)Machine learning approach for IP-flow record anomaly detectionProceedings of the 10th international IFIP TC 6 conference on Networking - Volume Part I10.5555/2008780.2008784(28-39)Online publication date: 9-May-2011
  • (2011)Machine Learning Approach for IP-Flow Record Anomaly DetectionNETWORKING 201110.1007/978-3-642-20757-0_3(28-39)Online publication date: 2011

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media