MVSec: multi-perspective and deductive visual analytics on heterogeneous network security data
MVSec: multi-perspective and deductive visual analytics on heterogeneous network security data
复制标题
DOI：
10.1007/s12650-014-0213-6
复制
发表时间：
2014-07
影响因子：
1.7
通讯作者：
Ying Zhao;Xing Liang;Xiaoping Fan;Yiwen Wang;Mengjie Yang;Fangfang Zhou
中科院分区：
文献类型：
--
作者：
Ying Zhao;Xing Liang;Xiaoping Fan;Yiwen Wang;Mengjie Yang;Fangfang Zhou
在本文中，我们提出了一个可视化分析系统MVSec，它可以帮助分析人员更好地了解网络安全数据集下的信息流动。本工作的主要贡献包括：(1)采用统一的事件元组和统计元组数据结构，提出了多异构数据集的数据融合策略，压缩了大规模数据集，为协同可视化分析奠定了基础；(2)多个协同视图，为分析人员提供多个视觉视角，以表征数据集中的重大事件、挖掘细微事件和研究事件之间的关系；(3)基于演绎观点的语境视觉分析，激励分析者从视觉叙事中探索假设并推理他们的推论。在案例研究中，我们详细展示了该系统如何帮助分析人员绘制分析故事线并更好地理解2013年VAST挑战赛中的网络情况。此外，我们还讨论了在设计我们的系统和参加2013年VAST挑战赛中所学到的经验教训，这些经验教训不仅适用于类似的网络安全系统，也适用于面临视觉分析挑战的其他领域。图形抽象
AbstractIn this article, we present a visual analytics system, MVSec, which helps analysts understand better what information flows under network security datasets. The major contributions of this work include: (1) a data fusion strategy for multiple heterogeneous datasets by using unified event tuple and statistic tuple data structure, which compress large scale datasets and lays the foundation of cooperative visual analysis; (2) multiple coordinated views, which provide analysts with multiple visual perspectives to characterize loud events, dig out subtle events and investigate relations of events in datasets; and (3) a contextual visual analysis with deductive viewpoints, which inspires analysts to explore hypotheses and reason their deductions from visual narratives. In case studies, we demonstrate in detail how the system helps analysts draw an analytical storyline and understand network situations better in VAST Challenge 2013. Additionally, we discuss lessons learned in designing our system and participating in VAST Challenge 2013, which is helpful and applicable not only to similar network security systems but also to other domains facing visual analytics challenges.Graphical abstract