Visual Analytics for Root DNS Data

作者: Eric Krokos , Alexander Rowden , Kirsten Whitley , Amitabh Varshney

DOI: 10.1109/VIZSEC.2018.8709205

关键词: The InternetData visualizationNetwork securityInformation retrievalNetwork packetBig dataComputer scienceDNS root zoneDenial-of-service attackVisual analytics

摘要: The analysis of vast amounts network data for monitoring and safeguarding a core pillar the internet, root DNS, is an enormous challenge. Understanding distribution queries received by how those change over time, in intuitive manner sought. Traditional query performed packet packet, lacking global, temporal, visual coherence, obscuring latent trends clusters. Our approach leverages pattern recognition computational power deep learning with 2D 3D rendering techniques quick easy interpretation interaction amount DNS traffic. Working real-world experts, our visualization reveals several surprising clusters queries, potentially malicious benign, discovers previously unknown characteristics DDOS attack, uncovers unforeseen changes time. These discoveries will provide analysts deeper understanding nature traffic under their charge, which help them safeguard against future attack.

参考文章(38)
Bin Yu, Les Smith, Mark Threefoot, Semi-supervised Time Series Modeling for Real-Time Flux Domain Detection on Passive DNS Traffic machine learning and data mining in pattern recognition. pp. 258- 271 ,(2014) , 10.1007/978-3-319-08979-9_20
Qingnan Lai, Changling Zhou, Hao Ma, Zhen Wu, Shiyang Chen, Visualizing and characterizing DNS lookup behaviors via log-mining Neurocomputing. ,vol. 169, pp. 100- 109 ,(2015) , 10.1016/J.NEUCOM.2014.09.099
Stephen G. Eick, Engineering Perceptually Effective Visualizations for Abstract Data Scientific Visualization, Overviews, Methodologies, and Techniques. pp. 191- 210 ,(1994)
Geoffrey E. Hinton, Vinod Nair, Rectified Linear Units Improve Restricted Boltzmann Machines international conference on machine learning. pp. 807- 814 ,(2010)
Steve Mansfield-Devine, The growth and evolution of DDoS Network Security archive. ,vol. 2015, pp. 13- 20 ,(2015) , 10.1016/S1353-4858(15)30092-1
Troy Nunnally, Penyen Chi, Kulsoom Abdullah, A. Selcuk Uluagac, John A. Copeland, Raheem Beyah, P3D: A parallel 3D coordinate visualization for advanced network scans 2013 IEEE International Conference on Communications (ICC). pp. 2052- 2057 ,(2013) , 10.1109/ICC.2013.6654828
Daisuke Inoue, Masashi Eto, Koei Suzuki, Mio Suzuki, Koji Nakao, DAEDALUS-VIZ Proceedings of the Ninth International Symposium on Visualization for Cyber Security - VizSec '12. pp. 72- 79 ,(2012) , 10.1145/2379690.2379700
Troy Nunnally, Kulsoom Abdullah, A. Selcuk Uluagac, John A. Copeland, Raheem Beyah, NAVSEC: a recommender system for 3D network security visualizations visualization for computer security. pp. 41- 48 ,(2013) , 10.1145/2517957.2517963
Gregory Conti, Mustaque Ahamad, John Stasko, Attacking information visualization system usability overloading and deceiving the human symposium on usable privacy and security. pp. 89- 100 ,(2005) , 10.1145/1073001.1073010