Fast detection and visualization of network attacks on parallel coordinates
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Choi, Hyunsang | - |
dc.contributor.author | Lee, Heejo | - |
dc.contributor.author | Kim, Hyogon | - |
dc.date.accessioned | 2021-09-08T15:39:01Z | - |
dc.date.available | 2021-09-08T15:39:01Z | - |
dc.date.created | 2021-06-10 | - |
dc.date.issued | 2009-07 | - |
dc.identifier.issn | 0167-4048 | - |
dc.identifier.uri | https://scholar.korea.ac.kr/handle/2021.sw.korea/119697 | - |
dc.description.abstract | This article presents what we call the parallel coordinate attack visualization (PCAV) for detecting unknown large-scale Internet attacks including Internet worms, DDoS attacks and network scanning activities. PCAV displays network traffic on the plane of parallel coordinates using the flow information such as the source IP address, destination IP address, destination port and the average packet length in a flow. The parameters are used to draw each flow as a connected line on the plane, where a group of polygonal lines form a particular shape in case of attack. From the observation that each attack type of significance forms a unique pattern, we develop nine signatures and their detection mechanism based on an efficient hashing algorithm. Using the graphical signatures, PCAV can quickly detect new attacks and enable network administrators to intuitively recognize and respond to the attacks. Compared with existing visualization works, PCAV can handle hyperdimensions, i.e., can visualize more than 3 parameters if necessary, which significantly reduces false positives. As a consequence, Internet worms are more precisely detectable by machine and more easily recognizable by human. Another strength of PCAV is handling flows instead of packets. Per-flow visualization greatly reduces the processing time and further provides compatibility with legacy routers which export flow information, e.g., as NetFlow does in Cisco routers. We demonstrate the effectiveness of PCAV using real-life Internet traffic traces. The PCAV program is publicly available. (C) 2008 Elsevier Ltd. All rights reserved. | - |
dc.language | English | - |
dc.language.iso | en | - |
dc.publisher | ELSEVIER ADVANCED TECHNOLOGY | - |
dc.title | Fast detection and visualization of network attacks on parallel coordinates | - |
dc.type | Article | - |
dc.contributor.affiliatedAuthor | Lee, Heejo | - |
dc.contributor.affiliatedAuthor | Kim, Hyogon | - |
dc.identifier.doi | 10.1016/j.cose.2008.12.003 | - |
dc.identifier.scopusid | 2-s2.0-67349158355 | - |
dc.identifier.wosid | 000266469200004 | - |
dc.identifier.bibliographicCitation | COMPUTERS & SECURITY, v.28, no.5, pp.276 - 288 | - |
dc.relation.isPartOf | COMPUTERS & SECURITY | - |
dc.citation.title | COMPUTERS & SECURITY | - |
dc.citation.volume | 28 | - |
dc.citation.number | 5 | - |
dc.citation.startPage | 276 | - |
dc.citation.endPage | 288 | - |
dc.type.rims | ART | - |
dc.type.docType | Article | - |
dc.description.journalClass | 1 | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Information Systems | - |
dc.subject.keywordAuthor | Internet attack visualization | - |
dc.subject.keywordAuthor | Parallel coordinates | - |
dc.subject.keywordAuthor | Internet worms | - |
dc.subject.keywordAuthor | DDoS attacks | - |
dc.subject.keywordAuthor | Parallel coordinate attack visualization (PCAV) | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
(02841) 서울특별시 성북구 안암로 14502-3290-1114
COPYRIGHT © 2021 Korea University. All Rights Reserved.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.