Book
PCAV: Internet Attack Visualization on Parallel Coordinates.
| Title: | PCAV: Internet Attack Visualization on Parallel Coordinates. |
|---|---|
| Authors: | Sihan Qing, Wenbo Mao, Lopez, Javier, Guilin Wang, Hyunsang Choi, Heejo Lee |
| Source: | Information & Communications Security (9783540309345); 2005, p454-466, 13p |
| Abstract: | This paper presents PCAV (Parallel Coordinates Attack Visualizer), a real-time visualization system for detecting large-scale Internet attacks including Internet worms, DDoS attacks and network scanning activities. PCAV displays network traffic on the plane of parallel coordinates using the source IP address, destination IP address, destination port and the average packet length in a flow. These four values are used to draw each flow as a connected line on the plane and surprisingly a group of lines forms a particular shape in case of attack. Thus, a simple but novel way of displaying traffic reveals ongoing attacks. From the fact that numerous types of attacks form a specific pattern of graphs, we have developed nine signatures and their detection mechanism using an efficient hashing algorithm. Using the graphical signatures, PCAV can quickly detect new attacks and enables network administrators to instantly recognize and respond to the attacks. Another strength of PCAV comes from handling flows instead of packets. Per-flow visualization greatly reduces the processing time and further provides compatibility with legacy routers which export flow information such as NetFlow in Cisco routers. We have demonstrated the effectiveness of PCAV using real attack traffics. [ABSTRACT FROM AUTHOR] |
| Copyright of Information & Communications Security (9783540309345) is the property of Springer eBooks and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| DOI: | 10.1007/11602897_38 |
| Database: | Supplemental Index |
Availability