Identifying Suspicious Activities in Company Networks Through Data Mining and Visualization

摘要: Company data are a precious asset which need to be truly authentic and must not disclosed unauthorized parties. In this contribution, we report on ongoing work that aims at supporting human IT security experts by pinpointing significant alerts really closer inspection. We developed an experimental tool environment support the analysis of infrastructure with mining methods. particular, various clustering algorithms used differentiate normal behavior from activities call for intervention through experts. Before being subjected clustering, can pre-processed in ways. categorical values cleverly mapped numerical while preserving semantics as far possible. Resulting clusters visual inspection using techniques such parallel coordinates or pixel-based techniques, e.g. circle segments recursive patterns.