• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.6
• /
• pp.1197-1213
• /
• 2014

Due to the increase in size of the computer network, the network security systems such as a firewall, IDS, IPS generate much more vast amount of information related to network security. So detecting signs of hidden security threats has become more difficult. Security personnels' 'Network Security Situational Awareness(NSSA)' is effectively determining the security situation of overall computer network on the basis of the relation between the security events that occur in the several views. The process of situational awareness is divided into three stages of the 'identification,' 'understanding' and 'prediction'. And 'identification' and 'understanding' are prerequisites for 'predicting' and the following appropriate responses. But 'identification' and 'understanding' in the vast amount of information became more difficult. In this paper, we propose Honeycomb security situational awareness visualization system that is designed to help NSSA in large-scale networks by using visualization techniques known effective to the 'identification' and 'understanding' stages. And we identified the empirical effects of this system on the basis of the 'VAST Challenge 2012' data.

• International Journal of Computer Science & Network Security
• /
• v.23 no.6
• /
• pp.68-76
• /
• 2023

Nowadays, the power of data analytics in general and visual data analytics, in particular, have been proven to be an important area that would help development in any domain. Many well-known IT services best practices have touched on the importance of data analytics and visualization and what it can offer to information technology service management. Yet, little research exists that summarises what is already there and what can be done to utilise further the power of data analytics and visualization in this domain. This paper is divided into two main parts. First, a number of IT service management tools have been summarised with a focus on the data analytics and visualization features in each of them. Second, interviews with five senior IT managers have been conducted to further understand the usage of these features in their organisations and the barriers to fully benefit from them. It was found that the main barriers include a lack of good understanding of some visualization design principles, poor data quality, and limited application of the technology and shortage in data analytics and visualization expertise.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.3
• /
• pp.107-117
• /
• 2009

Network administrator recognizes the abnormal phenomenon in the managed network by using the alert messages generated in the security devices including the intrusion detection system, intrusion prevention system, firewall, and etc. And then the series of task, which searches for the traffic related to the alert message and analyzes the traffic data, are required to determine where the abnormal phenomenon is the real network security threat or not. There are many alert messages to have to inspect in order to determine the network security situation. Also the much times are needed so that the network administrator can analyze the security condition using existing methods. Therefore, in this paper, we proposed an efficient method for analyzing network security situation using visualization. The proposed method monitors anomalies occurred in the entire IP address's space and displays the detail information of a security event. In addition, it represents the physical locations of the attackers or victims by linking GIS information and IP address. Therefore, it is helpful for network administrator to rapidly analyze the security status of managed network.

• Smart Media Journal
• /
• v.7 no.4
• /
• pp.70-78
• /
• 2018

Current trends in information system have led many companies to adopt security solutions. However, even with a large budget, they cannot function properly without proper security monitoring that manages them. Security monitoring necessitates a quick response in the event of a problem, and it is needed to design appropriate visualization dashboards for monitoring purposes so that necessary information can be delivered quickly. This paper shows how to visualize a security log using the open source program Elastic Stack and demonstrates that the proposed method is suitable for network security monitoring by implementing it as a appropriate dashboard for monitoring purposes. We confirmed that the dashboard was effectively exploited for the analysis of abnormal traffic growth and attack paths.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.11 no.4
• /
• pp.47-60
• /
• 2015

In this paper, we propose a simple and useful method using a port role to visualize the network attacks. The port role defines the behavior of the port from the source and destination port number of network session. Based on the port role, the port provides the brief security features of each node as an attacker, a victim, a server, and a normal host. We have automatically classified and identified the type of node based on the port role and security features. We detected and visualized the network attacks using these features of the node by the port role. In addition, we are intended to solve the problems with existing visualization technologies which are the reflection problem caused an undirected network session and the problem caused decreasing of distinct appearance when occurs a large amount of the sessions. The proposed method monitors anomalies occurring in an entire network and displays detailed information of the attacker, victim, server, and hosts. In addition, by providing a categorized analysis of network attacks, this method can more precisely detect and distinguish them from normal sessions.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.6
• /
• pp.2801-2816
• /
• 2016

Owing to their low scalability, weak support on big data, insufficient data collaborative analysis and inadequate situational awareness, the traditional methods fail to meet the needs of the security data analysis. This paper proposes visualization methods to fuse the multi-source security data and grasp the network situation. Firstly, data sources are classified at their collection positions, with the objects of security data taken from three different layers. Secondly, the Heatmap is adopted to show host status; the Treemap is used to visualize Netflow logs; and the radial Node-link diagram is employed to express IPS logs. Finally, the Labeled Treemap is invented to make a fusion at data-level and the Time-series features are extracted to fuse data at feature-level. The comparative analyses with the prize-winning works prove this method enjoying substantial advantages for network analysts to facilitate data feature fusion, better understand network security situation with a unified, convenient and accurate mode.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.1
• /
• pp.25-38
• /
• 2017

Many security threats are occurring around the world due to the characteristics of industrial control systems that can cause serious damage in the event of a security incident including major national infrastructure. Therefore, the industrial control system network traffic should be analyzed so that it can identify the attack in advance or perform incident response after the accident. In this paper, we research the visualization technique as network forensics to enable reasonable suspicion of all possible attacks on DNP3 control system protocol, and define normal action based rules and derive visualization requirements. As a result, we developed a visualization tool that can detect sudden network traffic changes such as DDoS and attacks that contain anormal behavior from captured packet files on industrial control system network. The suspicious behavior in the industrial control system network can be found using visualization tool with Digital Bond packet.

• Journal of the Korean Society of Surveying, Geodesy, Photogrammetry and Cartography
• /
• v.39 no.6
• /
• pp.477-482
• /
• 2021

The integrated underground space map system provides information on infrastructure that requires security, but to prevent rupture accidents during excavation work at the underground construction site, it must provide information on all underground facilities on the site. Providing additional information other than the object of interest to the user is a factor that increases the risk of information leakage of security data. In this paper, we design the visualization filtering method that when visualizing the integrated underground space map in the field, the visualization of entire underground facilities of interest to workers is performed, but visualization of other underground facilities is minimized to minimize the risk of security data information leakage. To this end, a visualization area of a certain distance for each of the underground facilities of interest was created, and an integrated visualization filter was created with spatial union operation. When the integrated underground map is output on the screen, only the objects located within the filter area are visualized using the generated filter information, and objects that exist outside are not visualized, thereby minimizing the provision of information to the user.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.1
• /
• pp.61-73
• /
• 2015

In order to respond quickly to security threats that are increasing fast and variously, security control personnel needs to understand the threat of a massive amount of logs generated from security devices such as firewalls and IDS. However, due to the limitations of the information processing capability of humans, it takes a lot of time to analyze the vast amount of security logs. As a result, there is problem that the detection and response of security threats are delayed. Visualization technique is an effective way to solve this problem. This paper visualizes the security log using the RGB Palette, offering a quick and effective way to know whether the security threat is occurred. And it was applied empirically in VAST Challenge 2012 dataset.

• Journal of International Society for Simulation Surgery
• /
• v.4 no.1
• /
• pp.17-20
• /
• 2017

Purpose Interactive 3D visualization system through remote data transmission over heterogeneous network is growing due to the improvement of internet based real time streaming technology. Materials and Methods The current internet's IP layer has several weaknesses against IP spoofing or IP sniffing type of network attacks since it was developed for reliable packet exchange. In order to compensate the security issues with normal IP layer, we designed a remote medical visualization system, based on Virtual Private Network. Results Particularly in hospital, if there are many surgeons that need to receive the streaming information, too much load on the gateway can results in deficit of processing power and cause the delay. Conclusion End to end security through the network method would be required.