A Visual Analytics Field Experiment to Evaluate Alternative Visualizations for Cyber Security Applications
A Visual Analytics Field Experiment to Evaluate Alternative Visualizations for Cyber Security Applications
复制标题
评估网络安全应用替代可视化的视觉分析现场实验
DOI：
--
复制
发表时间：
2014
期刊：
影响因子：
--
通讯作者：
D. Keim
中科院分区：
文献类型：
--
作者：
Fabian Fischer;J. Davey;Johannes Fuchs;Olivier Thonnard;J. Kohlhammer;D. Keim
分析和探索互联网中新出现的威胁对于更好地了解攻击者的行为和开发加强网络安全的新方法非常重要。完全自动化的算法本身往往无法提供有关威胁形势的可操作见解。因此，我们结合联合收割机的多标准聚类算法，量身定制的识别这种攻击活动与三个交互式的可视化，即树图表示，交互式节点链接图，和弦图，让分析师直观地探索，并使所产生的多维集群的意义。为了展示该系统的潜力，我们与安全响应团队的专家分享了我们在进行现场实验时学到的经验教训，并展示了它如何帮助他们获得对各种威胁形势的新见解。
The analysis and exploration of emerging threats in the Internet is important to better understand the behaviour of attackers and develop new methods to enhance cyber security. Fully automated algorithms alone are often not capable of providing actionable insights about the threat landscape. We therefore combine a multi-criteria clustering algorithm, tailor-made for the identification of such attack campaigns with three interactive visualizations, namely treemap representations, interactive node-link diagrams, and chord diagrams, to allow the analysts to visually explore and make sense of the resulting multi-dimensional clusters. To demonstrate the potential of the system, we share our lessons learned in conducting a field experiment with experts in a security response team and show how it helped them to gain new insights into various threat landscapes.