Real-Time Visualization of Network Behaviors for Situational Awareness

Conference · Tue Sep 14 04:00:00 EDT 2010

DOI:https://doi.org/10.1145/1850795.1850805· OSTI ID:988662

Best, Daniel M; Bohn, Shawn J; Love, Douglas V; Wynne, Adam S; Pike, William A

Plentiful, complex, and dynamic data make understanding the state of an enterprise network difficult. Although visualization can help analysts understand baseline behaviors in network traffic and identify off-normal events, visual analysis systems often do not scale well to operational data volumes (in the hundreds of millions to billions of transactions per day) nor to analysis of emergent trends in real-time data. We present a system that combines multiple, complementary visualization techniques coupled with in-stream analytics, behavioral modeling of network actors, and a high-throughput processing platform called MeDICi. This system provides situational understanding of real-time network activity to help analysts take proactive response steps. We have developed these techniques using requirements gathered from the government users for which the tools are being developed. By linking multiple visualization tools to a streaming analytic pipeline, and designing each tool to support a particular kind of analysis (from high-level awareness to detailed investigation), analysts can understand the behavior of a network across multiple levels of abstraction.

• Research Organization: Pacific Northwest National Laboratory (PNNL), Richland, WA (US)
• Sponsoring Organization: USDOE
• DOE Contract Number: AC05-76RL01830
• OSTI ID: 988662
• Report Number(s): PNNL-SA-72442
• Country of Publication: United States
• Language: English

Related Subjects

97 MATHEMATICS AND COMPUTING
Behavior
COMPUTER GRAPHICS
COMPUTER NETWORKS
Flow
High-Throughput
M CODES
MONITORING
Modeling
Network
PERFORMANCE
REAL TIME SYSTEMS
Real-Time
SECURITY
Symbolic aggregate approximation
Visualization