IDGraphs: Intrusion Detection and Analysis Using Histographs

Traffic anomalies and attacks are commonplace in today’s networks and identifying them rapidly and accurately is critical for large network operators. For a statistical intrusion detection system (IDS), it is crucial to detect at the flow-level for accurate detection and mitigation. However, existing IDS systems offer only limited support for 1) interactively examining detected intrusions and anomalies, 2) analyzing worm propagation patterns, 3) and discovering correlated attacks. These problems are becoming even more acute as the traffic on today’s high-speed routers continues to grow. IDGraphs is an interactive visualization system for intrusion detection that addresses these challenges. The central visualization in the system is a flow-level trace plotted with time on the horizontal axis and aggregated number of unsuccessful connections on the vertical axis. We then summarize a stack of tens or hundreds of thousands of these traces using the Histographs[23] technique, which...

• Type: Conference
• Year: 2005
• Where: VIZSEC
• Authors: Pin Ren, Yan Gao, Zhichun Li, Yan Chen, Benjamin Watson
• Keywords: Intrusion Detection, Statistical Intrusion Detection, VIZSEC 2005, Worm Propagation Patterns