Visualization of security events using an efficient correlation technique

Qishi Wu, Denise Ferebee, Yunyue Lin, Dipankar Dasgupta

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Scopus citations

Abstract

The timely and reliable data transfer required by many networked applications necessitates the development of comprehensive security solutions to monitor and protect against an increasing number of malicious attacks. However, providing complete cyber space situation awareness is extremely challenging because of the lack of effective translation mechanisms from low-level situation information to high-level human cognition for decision making and action support. We propose an adaptive cyber security monitoring system that integrates a number of component techniques to collect timeseries situation information, perform intrusion detection, keep track of event evolution, characterize and identify security events, and present a visual representation in order to provide comprehensive situational view so that corresponding defense actions can be taken in a timely and effective manner. We explore the principles of designing and applying appropriate visualization techniques for situation monitoring by defining graphical representations of security events. This differs from the traditional rule-based pattern matching techniques in that security events in the proposed system are represented as forms of correlation networks using random matrix theory and identified through the computation of network similarity measurement. The events and corresponding event types are visualized using a stemplot to show location and quantity. Extensive simulation results on event identification illustrate the efficacy of the proposed system.

Original languageEnglish (US)
Title of host publication2009 IEEE Symposium on Computational Intelligence in Cyber Security, CICS 2009 - Proceedings
DOIs
StatePublished - Jul 20 2009
Externally publishedYes
Event2009 IEEE Symposium on Computational Intelligence in Cyber Security, CICS 2009 - Nashville, TN, United States
Duration: Mar 30 2009Apr 2 2009

Publication series

Name2009 IEEE Symposium on Computational Intelligence in Cyber Security, CICS 2009 - Proceedings

Other

Other2009 IEEE Symposium on Computational Intelligence in Cyber Security, CICS 2009
CountryUnited States
CityNashville, TN
Period3/30/094/2/09

All Science Journal Classification (ASJC) codes

  • Artificial Intelligence
  • Computational Theory and Mathematics
  • Information Systems
  • Software

Keywords

  • Cyber security
  • Event correlation
  • Information visualization
  • Random matrix theory
  • Visual analysis

Fingerprint Dive into the research topics of 'Visualization of security events using an efficient correlation technique'. Together they form a unique fingerprint.

Cite this