An intelligent, interactive tool for exploration and visualization of time-oriented security data

摘要: The detection of known and unknown attacks usually requires the interpretation presentation very large amounts time-oriented security data. Using regular means for displaying data, such as text or tables, is often ineffective. Furthermore, only raw data not sufficient, because expert still required to derive meaningful conclusions from In addition, in many cases (e.g., detecting a virus spreading network), an aggregated view multiple network devices more effective than each individual device. this paper we propose intelligent interface used by distributed architecture that was described our previous work, specific tasks knowledge-based interpretation, summarization, query, visualization interactive exploration numbers order support computation process, provide automated mechanisms perform derivation context-specific, interval-based abstract interpretations (also Temporal Abstractions) time-stamped using domain-specific knowledge-base period 5 hours, during night, high number FTP connections within context No User Activity, which might indicate existence Trojan computer). proposed tool includes several functionalities querying, both abstracted regarding single devices.