DocumentCode :
3390732
Title :
Visualization of security events using an efficient correlation technique
Author :
Qishi Wu ; Ferebee, D. ; Yunyue Lin ; Dasgupta, D.
Author_Institution :
Dept. of Comput. Sci., Univ. of Memphis, Memphis, TN
fYear :
2009
fDate :
March 30 2009-April 2 2009
Firstpage :
61
Lastpage :
68
Abstract :
The timely and reliable data transfer required by many networked applications necessitates the development of comprehensive security solutions to monitor and protect against an increasing number of malicious attacks. However, providing complete cyber space situation awareness is extremely challenging because of the lack of effective translation mechanisms from low-level situation information to high-level human cognition for decision making and action support. We propose an adaptive cyber security monitoring system that integrates a number of component techniques to collect time-series situation information, perform intrusion detection, keep track of event evolution, characterize and identify security events, and present a visual representation in order to provide comprehensive situational view so that corresponding defense actions can be taken in a timely and effective manner. We explore the principles of designing and applying appropriate visualization techniques for situation monitoring by defining graphical representations of security events. This differs from the traditional rule-based pattern matching techniques in that security events in the proposed system are represented as forms of correlation networks using random matrix theory and identified through the computation of network similarity measurement. The events and corresponding event types are visualized using a stemplot to show location and quantity. Extensive simulation results on event identification illustrate the efficacy of the proposed system.
Keywords :
Internet; decision making; matrix algebra; security of data; time series; action support; adaptive cyber security monitoring system; correlation networks; correlation technique; cyber space situation awareness; data transfer; decision making; event evolution; human cognition; intrusion detection; malicious attacks; network similarity measurement; random matrix theory; security events; stemplot; time-series situation information; translation mechanisms; Cognition; Computer security; Data security; Data visualization; Decision making; Humans; Information security; Intrusion detection; Monitoring; Protection; Cyber security; event correlation; information visualization; random matrix theory; visual analysis;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Computational Intelligence in Cyber Security, 2009. CICS '09. IEEE Symposium on
Conference_Location :
Nashville, TN
Print_ISBN :
978-1-4244-2769-7
Type :
conf
DOI :
10.1109/CICYBS.2009.4925091
Filename :
4925091
Link To Document :
بازگشت