Detecting and analyzing relationships among anomalies

The HRL anomaly analysis tool was developed as part of the IEEE VAST Challenge 2009. One of the tasks involved processing badge and network traffic in order to detect and identify a fictitious embassy employee suspected of leaking information. The tool is designed to assist an analyst in detecting, analyzing, and visualizing anomalies and their relationships. Two key visualizations in our submission present how we identified the suspicious traffic using network visualization and how subsequently we connected that activity to an employee using an alibi table.