Extending Web Application IDS Interface: Visualizing Intrusions in Geographic and Web Space

Web application intrusion detection systems (IDSs) are developed with the main objective is to detect web based intrusions as automatically as possible. As a result, these systems´ user interfaces tend to be simple. This creates difficulties when further analyses based on these results are required. To make the outputs of web application IDSs more useful to security administrators, we propose an information visualization technique that displays intrusions as directed links starting in a geographic space and ending in a web space. The benefits in doing so are that it makes the display of intrusions clear, shows the overall results in a compact way, and supports user analysis in a natural manner. To evaluate the proposed technique, we implement a working prototype and use it to experiment with some test scenarios. The experiment results confirm the advantages of our approach compared to the traditional text based display.