Visual Correlation of Host Processes and Network Traffic

Anomalous communication patterns are one of the leading indicators of computer system intrusions according to the system administrators we have interviewed. But a major problem is being able to correlate across the host/network boundary to see how network connections are related to running processes on a host. This paper introduces Portall, a visualization tool that gives system administrators a view of the communicating processes on the monitored machine correlated with the network activity in which the processes participate. Portall is a prototype of part of the Network Eye framework we have introduced in an earlier paper [1]. We discuss the Portall visualization, the supporting infrastructure it requires, and a formative usability study we conducted to obtain administrators’ reactions to the tool. CR Categories: H.5.2 [Information Interfaces and Presentation]: User Interfaces—Prototyping, Screen Design, UserCentered Design; K.6.5 [Management of computing and information systems...

• Type: Conference
• Year: 2005
• Where: VIZSEC
• Authors: Glenn A. Fink, Paul Muessig, Chris North
• Keywords: Anomalous Communication Patterns, Network Eye Framework, Paper Introduces Portall, VIZSEC 2005