Security visualization tools and IPv6 addresses
Security visualization tools and IPv6 addresses
复制标题
安全可视化工具和 IPv6 地址
DOI：
10.1109/vizsec.2009.5375538
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
P. V. Oorschot
中科院分区：
文献类型：
--
作者：
David Barrera;P. V. Oorschot
安全分析人员使用可视化来帮助检测大量网络流量数据中的模式和趋势。随着IPv6在全球范围内的缓慢部署，网络入侵者开始调整他们的工具和技术以适应IPv6（相对于IPv4）。许多用于可视化网络活动的工具，虽然对检测大规模攻击和网络行为异常很有用，但仍然只支持IPv4。在本文中，我们探讨了一些流行的安全可视化工具对IPv6支持的现状，并确定了阻止这些工具支持新协议的障碍。我们提出了一种过滤技术，有助于减少图上IPv6源的遮挡。我们还建议使用树状图来直观地表示IPv6中远程地址的巨大空间。
Visualization is used by security analysts to help detect patterns and trends in large volumes of network traffic data. With IPv6 slowly being deployed around the world, network intruders are beginning to adapt their tools and techniques to work over IPv6 (vs. IPv4). Many tools for visualizing network activity, while useful for detecting large scale attacks and network behavior anomalies still only support IPv4. In this paper, we explore the current state of IPv6 support in some popular security visualization tools and identify the roadblocks preventing those tools from supporting the new protocol. We propose a filtering technique that helps reduce the occlusion of IPv6 sources on graphs. We also suggest using treemaps for visually representing the vast space of remote addresses in IPv6.