트래픽 세션의 포트 역할을 이용한 네트워크 공격 시각화
Network Attacks Visualization using a Port Role in Network Sessions
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
In this paper, we propose a simple and useful method using a port role to visualize the network attacks. The port role defines the behavior of the port from the source and destination port number of network session. Based on the port role, the port provides the brief security features of each node as an attacker, a victim, a server, and a normal host. We have automatically classified and identified the type of node based on the port role and security features. We detected and visualized the network attacks using these features of the node by the port role. In addition, we are intended to solve the problems with existing visualization technologies which are the reflection problem caused an undirected network session and the problem caused decreasing of distinct appearance when occurs a large amount of the sessions. The proposed method monitors anomalies occurring in an entire network and displays detailed information of the attacker, victim, server, and hosts. In addition, by providing a categorized analysis of network attacks, this method can more precisely detect and distinguish them from normal sessions.
Abstract
In this paper, we propose a simple and useful method using a port role to visualize the network attacks. The port role defines the behavior of the port from the source and destination port number of network session. Based on the port role, the port provides the brief security features of each node as an attacker, a victim, a server, and a normal host. We have automatically classified and identified the type of node based on the port role and security features. We detected and visualized the network attacks using these features of the node by the port role. In addition, we are intended to solve the problems with existing visualization technologies which are the reflection problem caused an undirected network session and the problem caused decreasing of distinct appearance when occurs a large amount of the sessions. The proposed method monitors anomalies occurring in an entire network and displays detailed information of the attacker, victim, server, and hosts. In addition, by providing a categorized analysis of network attacks, this method can more precisely detect and distinguish them from normal sessions.
참고문헌 (17)
- A. Oline, "Exploring Three- Dimensional Visualization for Intrusion Detection", Proceedings of the IEEE Workshop on Visualization for Computer Security, pp.113~120 (2005)
- E. L. Malécot, "Interactively Combining 2D and 3D Visualization for Network Traffic Monitoring", Proceedings of the 3rd International Workshop on Visualization for Computer Security, pp.123~127 (2006)
- 장범환, "종단간의 유사 연결 패턴을 갖는 정상 서버 활동과 공격의 구분 및 탐지 방법", 정보보호학회논문지, 22(6), pp.1315~1324 (2012), 한국정보보호학회
- 장범환, "보안 이벤트 시각화를 이용한 보안 상황 인지 기술", 정보보호학회지, 16(2), pp.18~25 (2006)
- 정치윤, "시각화 기반의 효율적인 네트워크 보안 상황 분석 방법", 정보보호학회논문지, 19(3), pp.107~117 (2009), 한국정보보호학회
- Beom-Hwan Chang, "An Efficient Network Attack Visualization Using Security Quad and Cube", ETRI Journal, 33(5), pp.770~779 (2011), 한국전자통신연구원
- A. Giani, "Attribution and Aggregation of Network Flows for Security Analysis", Proceedings of the 2006 CERT FloCon Workshop, pp.1~4 (2006)
- E. W. Bethel, "Accelerating Network Traffic Analytics Using Query-Driven Visualization", Proceedings of the 2006 IEEE Symposium on Visual Analytics Science and Technology, pp.115~122 (2006)
- K. Lakkaraju, "NVisionIP: Netflow Visualizations of System State for Security Situational Awareness", Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pp.65~72 (2004)
- R. Ball, "Home-Centric Visualization of Network Traffic for Security Administration", Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pp.55~64 (2004)
- Y. Hu, "Adaptive Flow Aggregation–A New Solution for Robust Flow Monitoring under Security Attacks", Proceedings of the 10th IEEE, 2006, 424~435
- X. Yin, "The Design of VisFlowConnect-IP: A Link Analysis System for IP Security Situational Awareness", Proceedings of the 3rd IEEE International Workshop on Information Assurance, pp.141~153 (2005)
- T. Taylor, "FloVis: Flow visualization system", Conference For Homeland Security, 2009. CATCH'09. Cybersecurity Applications & Technology, pp.186~198 (2009)
- S. Krasser, "Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization", Proceedings of the 2005 IEEE Workshop on Information Assurance Workshop, pp.42~49 (2005)
- G. Conti, "Passive Visual Fingerprinting of Network Attack Tools", Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pp.45~54 (2004)
- 장범환, "스마트그리드 전력망의 NSM 기반 보안관리시스템 설계 및 구현", (사)디지털산업정보학회 논문지, 9(3), pp.107~117 (2013), (사)디지털산업정보학회
- 최희식, "SIP 플러딩 탐지 차단 실험방법에 대한 연구", (사)디지털산업정보학회 논문지, 7(2), pp.39~46 (2011), (사)디지털산업정보학회