Visual Analysis of Network Flow Data with Timelines and Event Plots

• Doantam Phan, John Gerth, Marcia Lee, Andreas Paepcke, and Terry Winograd. (Stanford)
• Proc. VizSec? 2007

Abstract

This paper describes Isis, a system that uses progressive multiples of timelines and event plots to support the iterative investigation of intrusions by experienced analysts using network flow data. The visual representations have been designed to make temporal relationships apparent, allow visual classification of events with dynamic brushing, and enable users to organize their visualizations to reveal traffic structure and patterns by reordering rows. Isis combines visual affordances with SQL to provide a flexible tool for investigation. We present an annotated case study using anonymized data of a real intrusion that demonstrates the features of Isis.

Annotations

• A visualization tool on network flow data captured from campus gateway
• each flow summarizes the time and ruation of a network connection and packets counts and bytes.
• stored in MySQL? database
• 2 visualizations of temporal sequences of network flow
• timeline
  • useful for overview of traffic
• event plot
  • useful for unaggregated flows in a small time window

• case study
  • begin with a anomalous local IP 75.64.71.22 (many IRC traffic)
  • an aggregated 63,000 flows on port 6667.