Cyber security: how visual analytics unlock insight
Cyber security: how visual analytics unlock insight
复制标题
网络安全：可视化分析如何释放洞察力
DOI：
10.1145/2487575.2491132
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
R. Marty
中科院分区：
文献类型：
--
作者：
R. Marty
在网络安全领域，我们已经收集“大数据”近二十年了。我们的数据量和种类都非常大，但理解和捕获数据的语义更是一个挑战。人们从许多不同的角度尝试了大海捞针。在本次演讲中，我们将了解哪些方法已被探索、哪些有效、哪些无效。我们将看到仍有大量工作要做，数据挖掘将发挥核心作用。我们将努力激励，为了成功找到坏人，我们必须采用一种解决方案，该解决方案不仅利用巧妙的数据挖掘，而且在人机界面、数据挖掘和可扩展数据平台之间采用正确的组合。传统上，网络安全一直面临着数据挖掘的挑战。我们不同。我们将探讨如何将数据挖掘算法应用于安全领域。有些方法（例如预测分析）即使不是不可能，也是极其困难的。您如何预测下一次网络攻击？其他的则需要根据安全域进行定制才能发挥作用。可视化和可视化分析似乎非常有希望解决网络安全问题。态势感知、大规模数据探索、知识捕获和取证调查是我们将讨论的四个主要用例。然而，仅仅可视化并不能解决安全问题。我们需要支持可视化的算法。例如，减少数据量，以便分析师可以在数量和语义上处理数据。
In the Cyber Security domain, we have been collecting 'big data' for almost two decades. The volume and variety of our data is extremely large, but understanding and capturing the semantics of the data is even more of a challenge. Finding the needle in the proverbial haystack has been attempted from many different angles. In this talk we will have a look at what approaches have been explored, what has worked, and what has not. We will see that there is still a large amount of work to be done and data mining is going to play a central role. We'll try to motivate that in order to successfully find bad guys, we will have to embrace a solution that not only leverages clever data mining, but employs the right mix between human computer interfaces, data mining, and scalable data platforms. Traditionally, cyber security has been having its challenges with data mining. We are different. We will explore how to adopt data mining algorithms to the security domain. Some approaches like predictive analytics are extremely hard, if not impossible. How would you predict the next cyber attack? Others need to be tailored to the security domain to make them work. Visualization and visual analytics seem to be extremely promising to solve cyber security issues. Situational awareness, large-scale data exploration, knowledge capture, and forensic investigations are four top use-cases we will discuss. Visualization alone, however, does not solve security problems. We need algorithms that support the visualizations. For example to reduce the amount of data so an analyst can deal with it, in both volume and semantics.