NetflowVis: A temporal visualization system for netflow logs analysis

He, L; Tang, B; Zhu, M; Lu, B; Huang, W

NetflowVis: A temporal visualization system for netflow logs analysis

He, L Tang, B Zhu, M Lu, B Huang, W

Permalink

Publisher:: SPRINGER INT PUBLISHING AG
Publication Type:: Conference Proceeding
Citation:: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2016, 9929 LNCS, pp. 202-209
Issue Date:: 2016-01-01

Closed Access

	Filename	Description	Size
	netflowvis.pdf	Accepted version	1.13 MB	Adobe PDF	View/Open

Copyright Clearance Process

Recently Added
In Progress
Closed Access

This item is closed access and not available.

Full metadata record

Field	Value	Language
dc.contributor.author	He, L
dc.contributor.author	Tang, B
dc.contributor.author	Zhu, M
dc.contributor.author	Lu, B
dc.contributor.author	Huang, W https://orcid.org/0000-0002-5190-7839
dc.contributor.editor	Luo, Y
dc.date	2016-10-24
dc.date.accessioned	2023-02-08T21:07:20Z
dc.date.available	2023-02-08T21:07:20Z
dc.date.issued	2016-01-01
dc.identifier.citation	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2016, 9929 LNCS, pp. 202-209
dc.identifier.isbn	9783319467702
dc.identifier.issn	0302-9743
dc.identifier.issn	1611-3349
dc.identifier.uri	http://hdl.handle.net/10453/166010
dc.description.abstract	Netflow logs record the interactions between host pairs on both sides of the monitored border, and have got more attention from researchers for security concerns. Such data allows analysts to find interesting patterns and security anomalies. Visual analytics provides interaction and visualization techniques that can support these tasks. In this paper, we present a system called NetflowVis to analyze communication patterns and network abnormalities from netflow logs. This system consists of four views, including the communication trajectories view, the traffic line view, the snapshot view and the protocol view. The communication trajectories view is a composite view that dynamically describes the communication trajectories. This view combines a link-node tree and an improved ThemeRiver. The protocol view is designed to display statistical data of the upstream and downstream traffic on different protocols, which is an improved radial view based on an area filling strategy. The system provides a multilevel analysis architecture for netflow cognition. In this paper, we also present a case study to demonstrate the effectiveness and usefulness of our system.
dc.language	en
dc.publisher	SPRINGER INT PUBLISHING AG
dc.relation.ispartof	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
dc.relation.ispartof	13th International Conference on Cooperative Design, Visualization, and Engineering (CDVE)
dc.relation.ispartofseries	Lecture Notes in Computer Science
dc.relation.isbasedon	10.1007/978-3-319-46771-9_27
dc.rights	info:eu-repo/semantics/closedAccess
dc.subject.classification	Artificial Intelligence & Image Processing
dc.title	NetflowVis: A temporal visualization system for netflow logs analysis
dc.type	Conference Proceeding
utslib.citation.volume	9929 LNCS
utslib.location.activity	Sydney, AUSTRALIA
pubs.organisational-group	/University of Technology Sydney
pubs.organisational-group	/University of Technology Sydney/Provost
pubs.organisational-group	/University of Technology Sydney/Provost/TD School
utslib.copyright.status	closed_access	*
dc.date.updated	2023-02-08T21:07:18Z
pubs.finish-date	2016-10-27
pubs.publication-status	Published
pubs.start-date	2016-10-24
pubs.volume	9929 LNCS

Abstract:

Netflow logs record the interactions between host pairs on both sides of the monitored border, and have got more attention from researchers for security concerns. Such data allows analysts to find interesting patterns and security anomalies. Visual analytics provides interaction and visualization techniques that can support these tasks. In this paper, we present a system called NetflowVis to analyze communication patterns and network abnormalities from netflow logs. This system consists of four views, including the communication trajectories view, the traffic line view, the snapshot view and the protocol view. The communication trajectories view is a composite view that dynamically describes the communication trajectories. This view combines a link-node tree and an improved ThemeRiver. The protocol view is designed to display statistical data of the upstream and downstream traffic on different protocols, which is an improved radial view based on an area filling strategy. The system provides a multilevel analysis architecture for netflow cognition. In this paper, we also present a case study to demonstrate the effectiveness and usefulness of our system.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/166010