Discussions

This is where you can start discussions around security visualization topics.

NOTE: If you want to submit an image, post it in the graph exchange library!

You might also want to consider posting your question or comment on the SecViz Mailinglist!

Discussion Entries

Visual Analytics Workshop - Link Collection Part V - Big Data

This next module of the Visual Analytics Workshop is about Big Data. And here are the links that show up during this section. Keep in mind that especially this module is constantly evolving and has in the last months. New sections and links will be added to the training class very frequently.

Looking for the previous list of links for the workshop?

- Introductionary Links
- Data Sources
- Data Processing
- Log Management and SIEM

Wanna know more about the visualization workshop? Email me or visit http://pixlcloud.com/training

Stay tuned for the next link collection!

Visual Analytics Workshop - Link Collection Part IV - Log Management and SIEM

This is the Labor Day issue of the link collection series. The third module of the Visual Analytics Workshop is about Log Management and SIEM.

Looking for the previous list of links for the workshop?

- Introductionary Links
- Data Sources
- Data Processing

Wanna know more about the visualization workshop? Email me or visit http://pixlcloud.com/training

Stay tuned for the next link collection which will be on big data!

Visual Analytics Workshop - Link Collection Part III - Data Processing

Here is part three of the link collection series. The second module of the Visual Analytics Workshop is about Log Data Processing.

- CommandlineFu
- Regex Lib
- Regular Expressio Information
- Regex One
- RegExr
- Geo Lookup On The Commandline
- Log Analysis Scripts
- DAVIX
- httpry
- dnstop
- Emerging Threats
- HoneySnap
- LogParser
- LogParser Studio

Looking for the previous list of links for the workshop?

- Introductionary Links
- Data Sources

Wanna know more about the visualization workshop? Email me or visit http://pixlcloud.com/training

Next workshop is in Amsterdam

Visual Analytics Workshop - Link Collection Part II - Data Sources

The first module of the Visual Analytics Workshop is about Data Sources.

As a foundation for later visualizations, we need to first understand what the data means. Following are the links of tools and additional material we are going through: (Note that the links might not cover all of the tools in this module. They are merely all the links that show up on the slides.)

Find the previous list of links at the first link collection post.

Wanna know more about the visualization workshop? Email me or visit http://pixlcloud.com/training

Visual Analytics Workshop - Link Collection

During my Visual Analytics Workshop I mention a ton of tools, Web sites, and projects. Students attending the class get a list of all the links to these items in a summary file.

I decided that the list of links would be something useful for everyone to look at. Over the next few weeks I will be posting all the links on here.

Today we start with a few links of my previous work and the links of the workshop introduction slides:

Raffael Marty:
- Heatmaps - Why is Security Visualization So Hard?
- Cyber Security - How Visual Analytics Unlock Insight
- VizSec 2012 Keynote
- All the Data That's Fit to Visualize
- Security Visualization - Learning From The New York Times
- Mining Your Logs - Gaining Insight Through Visualization
- Application Logging Guidelines
- Visualization Workshops
- PixlCloud

Introduction:
- Binary Visualization Tool (VizBin)
- BinVis
- BinVis Discussion
- Cantor Dust
- Vera
- Periodic Table of Visualizations
- Minard
- Hans Rosling and Gapminder
- Hans Rosling TED talk
- MYO Interface
- Microsoft Kinect
- Leap Motion
- Make It So

Wanna know more about the workshop? Email me.

VizSec 2014 [Deadline Extended]

### VizSec deadline EXTENDED by 1 week! See http://vizsec.org for new schedule. ###

The 11th Visualization for Cyber Security (VizSec) is a forum that brings together researchers and practitioners from academia, government, and industry to address the needs of the cyber security community through new and insightful visualization and analysis techniques. VizSec provides an excellent venue for fostering greater exchange and new collaborations on a broad range of security- and privacy-related topics. VizSec will be held in Paris, France on November 10, 2014 in conjunction with IEEE VIS.

Important research problems often lie at the intersection of disparate domains. Our focus is to explore effective, scalable visual interfaces for security domains, where visualization may provide a distinct benefit, including computer forensics, reverse engineering, insider threat detection, cryptography, privacy, preventing user assisted attacks, compliance management, wireless security, secure coding, and penetration testing in addition to traditional network security. Human time and attention are precious resources. We are particularly interested in visualization and interaction techniques that effectively capture the insights of human analysts so that further processing may be handled by machines, freeing analysts for other tasks. For example, a malware analyst might use a visualization system to analyze a new piece of malicious software that facilitates generating a signature for future machine processing. When appropriate, research that incorporates multiple data sources, such as network packet captures, firewall rule sets and logs, DNS logs, web server logs, and/or intrusion detection system logs, is particularly desirable.

Full papers describing novel contributions in security visualization are solicited. Papers may present techniques, applications, practical experience, theory, analysis, or experiments and evaluations.

Update: Poster are also solicited. Posters may showcase late-breaking results, work in progress, preliminary results, or visual representations relevant to the VizSec community.

More information can be found here.

Visual Analytics Workshop Is Back at BlackHat 2014


VISUAL ANALYTICS – DELIVERING ACTIONABLE SECURITY INTELLIGENCE


BlackHat 2014 - Las Vegas


The Most Popular Visualization Workshop is Back!
Dates: AUGUST 2,3 & 4,5
Location: Las Vegas, USA

SIGN UP NOW


OVERVIEW

Big data and security intelligence are the two hot topics in security for 2014. We are collecting more and more information from both the infrastructure, but increasingly also directly from our applications. This vast amount of data gets increasingly hard to understand. Terms like map reduce, hadoop, mongodb, etc. are part of many discussions. But what are those technologies? And what do they have to do with security intelligence? We will see that none of these technologies are sufficient in our quest to defend our networks and information. Data visualization is the only approach that scales to the ever changing threat landscape and infrastructure configurations. Using big data data visualization techniques, you can gain a far deeper understanding of what's happening on your network right now. You can uncover hidden patterns of data, identify emerging vulnerabilities and attacks, and respond decisively with countermeasures that are far more likely to succeed than conventional methods. The attendees will learn about log analysis, big data, information visualization, data sources for IT security, and learn how to generate visual representations of IT data. The training is filled with hands-on exercises utilizing the yet to be released DAVIX 2014 live CD.

Here is what students said about the BlackHat 2013 workshop:

"Very good course. The trainer really knows the subject matter and has an incredible delivery of the material."

"Raffy obviously put a lot of time and effort into preparing for this course. Having already read the book, I expected a lot of the material to be a re-hash of what I already saw in the book. I was surprised at how much new material there was to get out of it. Looking forward to applying a lot of these concepts in the real world."

"Raffael did a great job! He knows and understands the subject matter extremely well. I highly recommend this course and instructor."

"One of the best trainings I have ever taken!"

SYLLABUS

Log Analysis

  • Data sources
  • Data Analysis and Visualization Linux (DAVIX)
  • Log data processing

Log Management and SIEM

  • Log management and SIEM overview
  • Application logging guidelines
  • Logging as a service
  • Big data - Hadoop, Lucene, ElasticSearch

Visualization

  • Information visualization history
  • Visualization theory
  • Data visualization tools and libraries
  • Visualization resources

Security Visualization

  • Perimeter threat use-cases
  • Network flow data
  • Firewall data
  • IDS/IPS data
  • Proxy data
  • User activity
  • Host-based data analysis


Sample of Tools and Techniques

Tools to gather data:

  • tcpdump and wireshark to analyze packet captures
  • argus, nfdump, nfsen, and silk to process traffic flows
  • snort, bro, suricata as intrusion detection systems
  • p0f, npad for passive network analysis
  • iptables, pf, pix as examples of firewalls

We are also using a number of visualization tools to analyze example data in the labs:

  • graphviz, tulip, cytoscape, and gephi
  • afterglow
  • treemap
  • mondrian, ggobi

Under the log management section, we are going to discuss:

  • rsyslog, syslog-ng, nxlog
  • logstash, graylog
  • commercial log management and SIEM solutions

The section on big data is covering the following:

  • hadoop (HDFS, map-reduce, HBase, Hive, Impala, Zookeper)
  • search engines like: elastic search, Solr
  • key-value stores like MongoDB, Cassandra, etc.
  • OLAP and OLTP


SIGN UP

TRAINER

Raffael Marty is one of the world’s most recognized authorities on security data analytics. Raffy is the founder and CEO of pixlcloud, the next generation data visualization platform for big data. With a track record at companies including IBM Research and ArcSight, he is thoroughly familiar with established practices and emerging trends in data analytics. He has served as Chief Security Strategist with Splunk and was a co-founder of Loggly, a cloud-based log management solution. Author of 'Applied Security Visualization' and frequent speaker at academic and industry events, Raffy is a leading thinker and advocate of visualization for unlocking insights into data. For more than 14 years, Raffy has lived in the security and log management space to help Fortune 500 companies defend themselves against sophisticated adversaries and train organizations around the world in the art of data visualization for security. Practicing zen has become an important part of Raffy's life.

Applications of Mind Mapping automation in the analysis of information security log files

I have started developping applications based on Mind Mapping to help professionals in the analysis of security log files.

My first example, to start with something easy, has been creating a program to analyze Endpoint Protector log files.

Here is a presentation about this issue.

I plan to create more complex applications in case they can be useful to the information security community.

I would like to get feedback about the first impressions about the possibilities of Mind Mapping in Security Visualization.

Visualizing and Cleaning Traffic Logs - Hands On Guide

I have spent quite a bit of time with the VAST 2013 Mini Challenge 1. The given network traffic log is interesting, but bears some challenges. One of them is the ominous source/destination confusion where the network flow collector didn't correctly record the client side of the connection as the source, but recorded it as the destination. That will create all kinds of problems in your data analysis and you therefore have to fix that first.

I wrote a blog entry on Cleaning Up Network Traffic Logs where I am going step by step through the network logs to determine which records need to be turned around. I am using both SQL and some parallel coordinate visualizations to get the job done. The final outcome is this one-liner Perl hack to actually fix the data:

$ cat nf*.csv | perl -F\,\ -ane 'BEGIN {@ports=(20,21,25,53,80,123,137,138,389,1900,1984,3389,5355);
%hash = map { $_ => 1 } @ports; $c=0} if ($hash{$F[7]} && $F[8}>1024)
{$c++; printf"%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s",
$F[0],$F[1],$F[2],$F[3],$F[4],$F[6],$F[5],$F[8],$F[7],$F[9],$F[10],$F[11],$F[13],$F[12],
$F[15],$F[14],$F[17],$F[16],$F[18]} else {print $_} END {print "count of revers $c\n";}

Read the full article here: Cleaning Up Network Traffic Logs

If you want to know how to setup a columnar data store to query the network flows, I also wrote a quick step by step guide on loading the network traffic logs into Impala with a Parquet storage engine.

Security Visualization Workshops in Dubai and Seattle Offered by World’s Leading Security Visualization Expert


VISUAL ANALYTICS – DELIVERING ACTIONABLE SECURITY INTELLIGENCE


Big data and security intelligence are the two hot topics in security for 2013. We are collecting more and more information from both the infrastructure, but increasingly also directly from our applications. This vast amount of data gets increasingly hard to understand. Terms like map reduce, hadoop, mongodb, etc. are part of many discussions. But what are those technologies? And what do they have to do with security intelligence? We will see that none of these technologies are sufficient in our quest to defend our networks and information. Data visualization is the only approach that scales to the ever changing threat landscape and infrastructure configurations. Using big data visualization techniques, you can gain a far deeper understanding of what's happening on your network right now. You can uncover hidden patterns of data, identify emerging vulnerabilities and attacks, and respond decisively with countermeasures that are far more likely to succeed than conventional methods. The attendees will learn about log analysis, big data, information visualization, data sources for IT security, and learn how to generate visual representations of IT data. The training is filled with hands-on exercises utilizing the DAVIX live CD.

This class features brand-new material, first presented at BlackHat USA in July 2013. Here is what students said:

"Very good course. The trainer really knows the subject matter and has an incredible delivery of the material."

"Raffy obviously put a lot of time and effort into preparing for this course. Having already read the book, I expected a lot of the material to be a re-hash of what I already saw in the book. I was surprised at how much new material there was to get out of it. Looking forward to applying a lot of these concepts in the real world."

"Raffael did a great job! He knows and understands the subject matter extremely well. I highly recommend this course and instructor."

"One of the best trainings I have ever taken!"


Visual Analytics - Delivering Actionable Security Intelligence

Dates: December 9-10 & 11-12, 2013
Location: Washington State Convention Center
Seattle, Washington, USA
Sign Up Now
Early registration discount ends October 24th!


Network Forensics and Security Visualization

Date: November 3-4, 2013
Location: Dubai, UAW
Sign Up Now





Sample of Tools and Techniques

Tools to gather data:

  • tcpdump and wireshark to analyze packet captures
  • argus, nfdump, nfsen, and silk to process traffic flows
  • snort, bro, suricata as intrusion detection systems
  • p0f, npad for passive network analysis
  • iptables, pf, pix as examples of firewalls

We are also using a number of visualization tools to analyze example data in the labs:

  • graphviz, tulip, cytoscape, and gephi
  • afterglow
  • treemap
  • mondrian, ggobi

Under the log management section, we are going to discuss:

  • rsyslog, syslog-ng, nxlog
  • logstash, graylog
  • commercial log management and SIEM solutions

The section on big data is covering the following:

  • hadoop (HDFS, map-reduce, HBase, Hive, Impala, Zookeper)
  • search engines like: elastic search, Solr
  • key-value stores like MongoDB, Cassandra, etc.
  • OLAP and OLTP


About the Trainer

Raffael Marty is one of the world's most recognized authorities on security data analytics. The author of Applied Security Visualization and creator of the open source DAVIX analytics platform, Raffy is the founder and ceo of PixlCloud, a next-generation data visualization application for big data. With a track record at companies including IBM Research and ArcSight, Raffy is thoroughly familiar with established practices and emerging trends in data analytics. He has served as Chief Security Strategist with Splunk and was a co-founder of Loggly, a cloud-based log management solution. For more than 12 years, Raffy has helped Fortune 500 companies defend themselves against sophisticated adversaries and has trained organizations around the world in the art of data visualization for security. Practicing zen has become an important part of Raffy's life.


SYLLABUS

Log Analysis

  • Data sources
  • Data Analysis and Visualization Linux (DAVIX)
  • Log data processing

Log Management and SIEM

  • Log management and SIEM overview
  • Application logging guidelines
  • Logging as a service
  • Big data technologies

Visualization

  • Information visualization history
  • Visualization theory
  • Data visualization tools and libraries
  • Visualization resources

Security Visualization

  • Perimeter threat use-cases
  • Network flow data
  • Firewall data
  • IDS/IPS data
  • Proxy data
  • User activity
  • Host-based data analysis