This series of images shows flows originating from a single source IP address going to different destination IP addresses on destination port 445. The traffic indicates suspicious traffic, related with the Zotob series of worms. The figures show flows over a 60 second period.
For more on Flamingo, see http://flamingo.merit.edu.
This graph was generated with psad (http://www.cipherdyne.org/psad/) running in --CSV mode against the iptables logfile that is distributed as a part of the Scan34 Honeynet challenge (see http://www.honeynet.org/scans/scan34/). The graph shows 92-byte ICMP type 8 packets directed against the Honeynet subnet 18.104.22.168/24. These packets are most likely associated with the Nachi worm (see http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_security_notice09186a00801b143a.html). Here is the specific command used to add the 92-byte search criteria:
# psad --CSV -m iptablessyslog --CSV-fields "src dst ip_len:92" --CSV-max 300 \
--CSV-regex "PROTO=ICMP.*TYPE=8" | perl afterglow.pl -c color.properties |neato -Tgif -o nachi_worm.gif
This graph was generated by using psad in --CSV mode against the Honeynet Scan34 challenge iptables logfile (see http://www.honeynet.org/scans/scan34/). This shows outbound traffic from the Honeynet subnet 22.214.171.124/24, and clearly shown are suspicious connections from the host 126.96.36.199 to external SSH and IRC servers; these are good indications that the system has been compromised.
NEXThink is a small Swiss startup which sells a solution in the security/visualization space. They are deploying an agent on the endpoints (machines) and record network activity from them (at least that's whay I understood). The network activity is then visualized with parallel coordinates and starfields.
I was reading a paper about some of the visualization approaches they are taking. To summarize a couple of interesting points from the paper:
The next thing I hope to see from them is that they post some graphs here!
I realized that having a blog and a discussion page is somehow confusing. That's why I moved the blog into the Discussion board. Sorry for the two comments that I had to move and are now posted under my name. I put the author in the first line of the comment though.
I am going to change some more things on the page. Mainly in terms of accessibility and usability of the individual resources. I hope overall the page will get easier to use.
Maybe that's a bit provocative and maybe I am wrong, but let me tell you why I think that the market is not yet ready for security data visualization. If you look at the visualization space, where business intelligence (BI) and other similar technologies reside, you will find that visualization is used in areas where the underlying data is very well understood. For example for sales and marketing data. It is very simple to explain to someone what sales data is all about. People can relate to those pieces of information. They understand it.
Computer security logs are not well understood at all! How do you expect people to understand visualization of security data if nobody really understands the underlying data? What are the best ways to visualize all this data if you cannot even understand the individual textual entries?
What we have to do (and if I say 'we', I mean you guys reading this blog, you guys inerested in this topic), is to go about the problem of log analysis and visualization on a use-case by use-case basis. We cannot solve all the problems at once. Let's be very specific and show for one type of log file, one type of log entries, how they can be visualized and how that helps the user.
I would claim that the companies which have tried to play in the security visualization space have not had much success because they tried (and probably still try) to address the entire problem at once: Visualizing log files. Again, let's go use-case by use-case. Submit them here so people can learn from you and you can learn from others!
This graph combines a heatmap with sparklines showing the utilization of an Unix node over a year. The heatmap reflect the average values within each day, while the sparklines show the intraday trend. While not directly security-oriented, the same combination can be used to show event trends over a large period of time, for example logon events. Can easily be combined with drilldown-functionality for each day or month.
Very cool idea here with this site. Unfortunately I can't see the data in any of the graphs thus far submitted because they are too low resolution. They look cool, and possibly useful -- I'd love to look into them more closely.
Any chance of (much) higher resolution images??