PCAV: Internet attack visualization on parallel coordinates

Hyunsang Choi, Heejo Lee

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    17 Citations (Scopus)

    Abstract

    This paper presents PCAV (Parallel Coordinates Attack Visualizer), a real-time visualization system for detecting large-scale Internet attacks including Internet worms, DDoS attacks and network scanning activities. PCAV displays network traffic on the plane of parallel coordinates using the source IP address, destination IP address, destination port and the average packet length in a flow. These four values are used to draw each flow as a connected line on the plane and surprisingly a group of lines forms a particular shape in case of attack. Thus, a simple but novel way of displaying traffic reveals ongoing attacks. From the fact that numerous types of attacks form a specific pattern of graphs, we have developed nine signatures and their detection mechanism using an efficient hashing algorithm. Using the graphical signatures, PCAV can quickly detect new attacks and enables network administrators to instantly recognize and respond to the attacks. Another strength of PCAV comes from handling flows instead of packets. Per-flow visualization greatly reduces the processing time and further provides compatibility with legacy routers which export flow information such as NetFlow in Cisco routers. We have demonstrated the effectiveness of PCAV using real attack traffics.

    Original languageEnglish
    Title of host publicationInformation and Communications Security - 7th International Conference, ICICS 2005, Proceedings
    PublisherSpringer Verlag
    Pages454-466
    Number of pages13
    ISBN (Print)3540309349, 9783540309345
    DOIs
    Publication statusPublished - 2005
    Event7th International Conference on Information and Communications Security, ICICS 2005 - Beijing, China
    Duration: 2005 Dec 102005 Dec 13

    Publication series

    NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
    Volume3783 LNCS
    ISSN (Print)0302-9743
    ISSN (Electronic)1611-3349

    Other

    Other7th International Conference on Information and Communications Security, ICICS 2005
    Country/TerritoryChina
    CityBeijing
    Period05/12/1005/12/13

    ASJC Scopus subject areas

    • Theoretical Computer Science
    • Computer Science(all)

    Fingerprint

    Dive into the research topics of 'PCAV: Internet attack visualization on parallel coordinates'. Together they form a unique fingerprint.

    Cite this