CT-ISG: Visual Characterization and Analysis of Network Traffic

CT-ISG：基于可视化的网络性能表征和分析PI：Kwan-Liu Ma，加州大学戴维斯分校项目周期：09/01/2007 - 08/31/2008项目摘要对于一个组织来说，为了保持计算系统的可靠和正常运行，一种策略是密切监视进出其网络的流量，以检测异常，并以强有力和及时的方式应对和追踪攻击。然而，对所有网络协议层、域和应用程序中的通信活动和内容进行表征可能会产生大量信息。目前，这种全互联网分散信息的表示和解释方法仍然很初级。自动化方法往往无法科普系统和操作的动态特性。为了大幅度提高我们实现网络安全的能力，我们建议开发一种新的基于视觉的网络流量表征技术，通过该技术，可以将大量数据流智能地汇总为视觉形式，以便在后续分析步骤中有效地使用。由此产生的可视化，往往是高度抽象的数据概念，使隐藏在过度规模的信息感知。我们将把重点放在视觉手段和交互方法的开发上，再加上机器学习，以表征网络流量和连接信息。我们的研究打算使用大量和详尽的会议摘要数据收集提供的合作者在劳伦斯利弗莫尔国家实验室。因此，我们的研究成果将直接使工作分析师受益。我们希望最终将这种新的基于可视化的方法纳入网络安全信息管理系统的各个方面，并由我们在英特尔公司的合作伙伴提供协助，以大幅提高反应式和主动式系统的有效性，可用性和可扩展性，以对抗恶意网络攻击和滥用。这个为期一年的项目使我们有机会朝着这个方向努力。

CT-ISG: Visualization-Based Characterization and Analysis of Network TrafficPI: Kwan-Liu Ma, University of California at DavisProject Period: 09/01/2007 - 08/31/2008Project SummaryFor an organization to maintain trustworthy and normal operation of computing systems, one strategy is to closely monitor the traffic in and out of its networks for detecting anomalies, and responding to and tracking down attacks in a robust and timely manner. However, characterizing the communication activities and content across all network protocol layers, domains, andapplications can result in vast amounts of information. Current representation and interpretation methods for such Internet-wide decentralized information are still quite rudimentary. Automated methods often fail to cope with the dynamic nature of the systems and operations. In order to drastically increase our capability to achieve cyber security, we propose to develop a new visualbased network traffic characterization technology with which massive data flows be intelligently summarized into visual forms that can be efficiently employed in subsequent analysis steps. The resulting visualization, often highly abstracted notion of the data, makes what hidden in the information of excessive scale perceivable. We will place our focus on the development of visual means and interaction methodologies coupled with machine learning for characterizing network traffic and connectivity information. Our study intends to use massive and exhaustive collections of session summary data provided by our collaborators at the Lawrence LivermoreNational Laboratory. Our research results will thus directly benefit working analysts. We would like to eventually incorporate such new visualization based approach into all facets of a cyber security information management system, assisted by our collaborators at the Intel Corporation,in order to drastically enhance the effectiveness, usability and extensibility of both reactive andproactive systems to fight malicious cyber attacks and abuse. This one-year project gives us the opportunity to work towards this direction.