Visualization of Network Security Information Based on Slow and Stealth Scan

Abstract:

To date, network security analysts depend only on some network secure products to study large amounts of log information as to analyze and cope with network anomalies. With dramatic increase of network data volumes, diversities of attack types and more complexity, the traditional analytical means are no longer effective. How to enable those analysts to quickly figure out network status by advantage of cumbersome high-dimensional data information has become a critical concern in the field of network safety. Here it develops a visualized technique for detecting network safety information by port scanning. After the analysis of network data packets and the use of information visualization technique, the visualized port scanning and detection system ScanViewer is designed and developed. The experiment reveals that it can detect slow scan, distributed scan, various TCP stealth scan and so on. With the method, people have got out of helpless embarrassment by the weak scan.

• Periodical: Applied Mechanics and Materials (Volumes 543-547)
• Pages: 3173-3176
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.543-547.3173
• Online since: March 2014
• Authors: Dong Sheng Zhang*
• Keywords: Information Visualization, Network Security, Port Scan

References

[1] Taylor.T., S.B., and J. McHugh, NetBytes Viewer: An Entity-Based NetFlow Visualization Utility for Identifying Intrusive Behavior. Proceedings of Workshop on Visualization for Computer Security, VizSEC 2007, 2007: 101-114.

DOI: 10.1007/978-3-540-78243-8_7

[2] J. Stoll, D.M., M. Gregory, V. Crow, andW.K. Edwards, Adapting Personas for Use in Security Visualization Design. Proceedings of Workshop on Visualization for Computer Security, VizSEC 2007, 2007: 39-52.

DOI: 10.1007/978-3-540-78243-8_3

[3] Jonathan McPherson, K. -L.M., Paul Krystosk, Tony Bartoletti, and Marvin Christensen, Portvis: a tool for port-based detection of security events Visualization and Data Mining for Computer Security, 2004: 73-81.

DOI: 10.1145/1029208.1029220

[4] X. Yin, W.Y., M. Treaster, Y. Li, and K. Lakkaraju, VisFlowConnection: netflow visualizations of link relationships for security situational awareness, in Visualization and Data Mining for Computer Security(VizSEC/DMSEC). 2004: 26-34.

DOI: 10.1145/1029208.1029214

[5] Kiran Lakkaraju, W.Y., and Adam J. Lee. NVisionIP: netflow visualizations of system state for security situational awareness. in Visualization and Data Mining for Computer Security(VizSEC/DMSEC) 2004: 65-72.

DOI: 10.1145/1029208.1029219