NVisionIP: netflow visualizations of system state for security situational awareness

The number of attacks against large computer systems is currently growing at a rapid pace. Despite the best efforts of security analysts, large organizations are having trouble keeping on top of the current state of their networks. In this paper, we describe a tool called NVisionIP that is designed to increase the security analyst’s situational awareness. As humans are inherently visual beings, NVisionIP uses a graphical representation of a class-B network to allow analysts to quickly visualize the current state of their network. We present an overview of NVisionIP along with a discussion of various types of security-related scenarios that it can be used to detect. Categories and Subject Descriptors C.2.0 [Computer-Communication Networks]: General— Security; H.5.2 [Information Interfaces and Presentation]: User Interfaces; K.6.5 [Management of Computing and Information Systems]: Security and Protection—invasive software General Terms Security, Management, Human Factors Keywords...

• Type: Conference
• Year: 2004
• Where: VIZSEC
• Authors: Kiran Lakkaraju, William Yurcik, Adam J. Lee
• Keywords: Current State, Security Analyst, Situational Awareness, VIZSEC 2004