PERCIVAL: proactive and reactive attack and response assessment for cyber incidents using visual analytics
PERCIVAL: proactive and reactive attack and response assessment for cyber incidents using visual analytics
复制标题
PERCIVAL：使用可视化分析对网络事件进行主动和被动攻击和响应评估
DOI：
10.1109/vizsec.2015.7312764
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
G. Santucci
中科院分区：
文献类型：
--
作者：
M. Angelini;N. Prigent;G. Santucci
态势感知是网络防御的一个关键概念。它的目标是让用户了解他或她正在监视的网络的不同和复杂的方面。本文提出了PERCIVAL，一种新的可视化分析环境，有助于态势感知，让用户了解网络安全状态，并监控系统上发生的安全事件。所提出的可视化允许将主动安全分析与实际攻击进度进行比较，提供有关系统针对攻击触发的缓解措施的有效性的见解，并概述可能的攻击演变。此外，相同的可视化可以有效地用于主动分析，因为它允许获得计算的攻击路径的细节，并评估系统主动计算的缓解措施。初步的用户研究对系统的原型实施提供了积极的反馈。该系统的视频可在https://youtu.be/uMpYCJCX95k上获得。
Situational awareness is a key concept in cyber-defence. Its goal is to make the user aware of different and complex aspects of the network he or she is monitoring. This paper proposes PERCIVAL, a novel visual analytics environment that contributes to situational awareness by allowing the user to understand the network security status and to monitor security events that are happening on the system. The proposed visualization allows for comparing the proactive security analysis with the actual attack progress, providing insights on the effectiveness of the mitigation actions the system has triggered against the attack and giving an overview of the possible attack's evolution. Moreover, the same visualization can be fruitfully used in the proactive analysis since it allows for getting details on computed attack paths and evaluating the mitigation actions that have been proactively computed by the system. A preliminary user study provided a positive feedback on the prototype implementation of the system. A video of the system is available at: https://youtu.be/uMpYCJCX95k.