Vision is a human’s dominant sense. It is the communication channel with the highest bandwidth into the human brain. Security tools and applications need to make better use of information visualization to enhance human computer interactions and information exchange.
In this talk we will explore a few basic principles of information visualization to see how they apply to cyber security. We will explore both visualization as a data presentation, as well as a data discovery tool. We will address questions like: What makes for effective visualizations? What are some core principles to follow when designing a dashboard? How do you go about visually exploring a terabyte of data? And what role do big data and data mining play in security visualization?
The presentation is filled with visualizations of security data to help translate the theoretical concepts into tangible applications.
3. Security. Analytics. Insight.3
What is Security Visualization?
Treemap of a Firewall Log
• if found(machine)
• connect on port 135
• ping scan machines
(echo requests)
Showing MS Blaster:
20. Security. Analytics. Insight.20
• Show comparisons, contrasts, differences
• Show causality, mechanism, explanation, systematic
structure.
• Show multivariate data; that is, show more than 1 or 2
variables.
!
by Edward Tufte
Principals of Analytic Design
21. Security. Analytics. Insight.21
Comparison (to Normal)
DNS Reflection
• 1:100 Amplification with DNS zone transfer for ripe.net domain
• 309Gbps for 28 minutes, 30956 open resolver IPs, 3 networks that allowed
spoofing, 5-7 compromised servers
March 20, 2013
28. Security. Analytics. Insight.28
Additional information about
objects, such as:
• machine
• roles
• criticality
• location
• owner
• …
• user
• roles
• office location
• …
Add Context
source destination
machine and
user context
machine role
user role
34. Security. Analytics. Insight.34
• Audience, audience, audience!
• Comprehensive Information (enough context)
• Highlight important data
• Use graphics when appropriate
• Good choice of graphics and design
• Aesthetically pleasing
• Enough information to decide if action is necessary
• No scrolling
• Real-time vs. batch? (Refresh-rates)
• Clear organization
Dashboard Design Principles
40. Security. Analytics. Insight.40
This visualization process requires:
• Low latency, scalable backend (columnar, distributed data store)
• Efficient client-server communications and caching
• Assistance of data mining to
• Reduce overall data to look at
• Highlight relationships, patterns, and outliers
• Assist analyst in focussing on ‘important’ areas
Backend Support
41. Security. Analytics. Insight.41
What I am Working On
Data Stores Analytics Forensics Models Admin
10.9.79.109 --> 3.16.204.150
10.8.24.80 --> 192.168.148.193
10.8.50.85 --> 192.168.148.193
10.8.48.128 --> 192.168.148.193
10.9.79.6 --> 192.168.148.193
10.9.79.6
10.8.48.128
80
53
8.8.8.8
127.0.0.1
Anomalies
Decomposition
Data
Seasonal
Trend
Anomaly Details
“Hunt” ExplainCommunicate
42. Security. Analytics. Insight.42
Visualization Principles
• Use numbers to highlight most important data
• Use visualizations to put data in context
• Show comparisons, causality, and multivariate data
• To find the right visualization, focus on: Objective, Data, Audience
• Use data context to augment data and tell a story
Visualization can be used for for presentation and/or exploration
• Exploration paradigm: Overview first, zoom and filter, details on demand
Recap