SecViz has a mailinglist!
The charter for the list is the same as for the SecViz Web site: share, discuss, challenge, and learn about security visualization. The mailinglist should help to have more in-depth discussions and get quicker responses on specific topics. I am looking forward to some good discussions around visualization applications, visualization methods, use-cases, etc. Fire away!
Note that the list keeps a public archive!
VizSec 2009
Workshop on Visualization for Cyber Security
October 11, 2009 / Atlantic City, NJ USA
http://vizsec.org/vizsec2009/
The 6th International Workshop on Visualization for Cyber Security is a forum that brings together researchers and practitioners in information visualization and security to address the specific needs of the cyber security community through new and insightful visualization techniques. Co-located this year with IEEE InfoVis/Vis/VAST, VizSec will continue to provide opportunities for the two communities to collaborate and share insights into providing solutions for security needs through visualization approaches. Accepted papers will be published by the IEEE and archived in the IEEE Digital Library. The authors of the best papers will be invited to extend and revise their paper for journal publication in a special issue of Information Visualization.
This year our focus is on advancing Visualization for Cyber Security as a scientific discipline. While art, engineering, and intuitions regarding the human element will always remain important if we are to obtain useful cyber security visualizations, advances in the scientific practice of research are needed. The scientific aspects of visualization for cyber security draw both on empirical observation (similar to many natural and social sciences) and formal science (such as the formal derivations in mathematics). Barriers confronting current researchers include concerns about available data, lack of a common agreement about what constitutes sound experimental design, the difficulties of measuring the relative effectiveness of security visualizations in practice, and the lack of a common understanding of user requirements. While many researchers are making progress in these and other critical areas, much work yet remains.
What To Submit
Papers offering novel contributions in security visualization are solicited. Papers may present technique, applications, practical experience, theory, or experiments and evaluations. Papers are encouraged on technologies and methods that have been demonstrated to be useful for improving information systems security and that address lessons from actual application. We encourage papers that report results on visualization techniques and systems in solving all aspects of cyber security problems, including how visualization applies to:
*Different aspects of security: software, networks and log files (e.g., Internet routing, packet traces and network flows, intrusion detection alerts, attack graphs, application security, etc.)
*Application of visualization techniques in formalizing, defining and analyzing security policies
*Forensic analysis, correlating events, cyber-defense task analysis
*Computer network defense training and offensive information operations
*Building rules, feature selection, and detecting anomalous activity
*Software, software security, and viruses
*Deployment and field testing of VizSec systems
*Evaluation and user testing of VizSec systems
*User and design requirements for VizSec systems
*Lessons learned from development and deployment of VizSec systems
*“Field Research” Best Practices
*Interaction with domain experts – best practices, lessons learned
*Differentiating the needs of different domains and time frames
*Best practices for obtaining and sharing potentially sensitive data for purposes of visualization and assessment, including how to approach personal privacy, regulatory, and organizational issues
*Metrics and measurements (e.g., criteria for the relative effectiveness of cyber visualizations)
*Handling large datasets, scalability issues, and providing real time or near-real time visualizations
Accepted papers will be published by the IEEE and made available through the IEEE Digital Library.
Paper Format:
Submitted papers must not substantially overlap papers that have been published or that are simultaneously submitted to a journal or a conference with proceedings. All submissions should be appropriately anonymized (i.e., papers should not contain author names or affiliations, or obvious citations). Submissions are to be made to the submission web site at http://www.vizsec.org/vizsec2009/submit. Only pdf files will be accepted. Papers should be formatted using the IEEE templates (see http://www.vizsec.org/vizsec2009/ for instructions).
*Full papers should be at most 12 pages, including the bibliography and appendices.
*Short papers should be at most 6 pages, including the bibliography and appendices.
Committee members are not required to read the appendices, and so the paper should be intelligible without them. Submissions not meeting these guidelines risk rejection without consideration of their merits. Authors of accepted papers must guarantee that their papers will be presented at the conference.
Papers must be received by the deadline of April 24, 2009, for long papers and May 22, 2009, for short papers.
Journal Special Issue
The authors of the best papers from the accepted program will be invited to extend and revise their paper for a special issue of Information Visualization (IVS), an international, peer-reviewed journal publishing articles on fundamental research and applications of information visualization. These papers will be chosen by the program committee.
Paper Award
There will be an award for the best paper from the accepted program. The best paper award will be given to the paper judged to have the highest overall quality. A key element of the best paper selection process will be whether the results are believed to be repeatable by other scientists based on the algorithms and data provided in the paper. This award will be chosen by the program committee.
Scholarships
A limited number of scholarships will be available for students and first-year faculty who have had papers accepted to VizSec.
Organizing Committee
General Chair Deborah Frincke, Pacific Northwest National Laboratory and University of Washington
Program Co-Chair: Carrie Gates, CA Labs
Program Co-Chair: John Goodall, Secure Decisions Division of Applied Visions
Papers Chair: Robert Erbacher, Utah State University
Program Committee
Richard Beijtich, General Electric, USA
Greg Conti, United States Military Academy, USA
Marc Dacier, Symantec Research Labs, France
Anita D’Amico, Secure Decisions div. of Applied Visions, USA
Ron Dilley, Information Security Professional, USA
Dave Ebert, Purdue University, USA
Glenn Fink, Pacific Northwest National Lab, USA
John Gerth, Stanford University, USA
Warren Harrop, Swinburne Univ. of Technology, Australia
Mark Haselkorn, University of Washington, USA
Richard Johnson, Microsoft, USA
Richard Kemmerer, UC Santa Barbara, USA
Toby Kohlenberg, Intel, USA
Florian Mansmann, University of Konstanz, Germany
Raffael Marty, Splunk, USA
Doug Maughan, Department of Homeland Security, USA
John McHugh, Dalhousie Univ., Canada, and Univ. NC, USA
Jan P. Monsch, Dublin City University, Ireland
Chris North, Virginia Tech, USA
Stephen North, AT&T Research, USA
Sean Peisert, UC Davis, USA
Greg Schmidt, SPADAC, USA
George Tadda, Air Force Research Lab, USA
Ed Talbot, Sandia National Laboratories, USA
Joanne Treurniet, Defence R&D Canada, Canada
Grant Vandenberghe, Defence R&D Canada, Canada
Kirsten Whitley, Department of Defense, USA
Pak Chung Wong, Pacific Northwest National Lab, USA
Tamara Yu, Massachusetts Institute of Technology, USA
http://vizsec.org/vizsec2009/
I've been frustrated with large-scale traffic analysis tools for a long time. I recently did some DNS traffic analysis to study possibilities for detecting DNS tunnels.
I wrote up my traffic analysis thoughts in a study of dns. The result of that paper was thresholds of typical DNS hostname request lengths, at least for my traffic. Not satisfied with a static threshold, I built a visualization for the traffic using processing. The writeup of the visualization is available in part ii.
A picture is attached of dns hostname requests when ssh'ing over dns using dns2tcp. The code is available as well; you can visualize your own captures or live traffic off the wire.
enjoy.
tranq
I used a JavaScript tag cloud implementation to visualize some firewall data. I used the source IP address to mimic the words from the tag cloud. Check out a working implementation.
I was just looking at some java script and flash visualization tools: MooWheel, JavaScript Information Visualization ToolKit JIT, Open Flash Chart.
And there it is again, that frustration about data formats. I wanted to try the tools with my own data, just to realize that each and every tool had another input requirements. None of them takes simple CSV input! They want arrays:
var data = [{
id: 'joeb',
text: 'Joe B',
connections: ['ryank', 'charliec']
},My favorite - how can I be surprised - JSON. It had to happen. I hate the Web 2.0 people for this. Sorry.
var json = [
{
"id": "aUniqueIdentifier",
"name": "usually a nodes name",
"data": [
{key:"some key", value: "some value"},
{key:"some other key", value: "some other value"}
],
All of these formats are just absolutely horrible to generate. I have CSV data, or at least I can generate that easily! Will I really have to write converters for all of this?
"Log Analysis and Security Visualization" is a two-day training class held on March 9th and 10th 2009 in Boston during the SOURCE Boston conference that addresses the data management and analysis challenges of today's IT environments.
The students will leave this class with the knowledge to visualize and manage their own IT data. They will learn the basics of log analysis, learn about common data sources, get an overview of visualization techniques, and learn how to generate visual representations of IT data for a number of different use-cases from DoS and worm detection to compliance reporting. The training is filled with hands-on exercises utilizing DAVIX, the open-source data analysis and visualization platform.
The trainer is the author of the book Applied Security Visualization and has been working on log analysis for many years.
Register today to secure your spot.
Are you looking for a little challenge for the days between Christmas and New Year? Yes? Well, then try the 25C3 visualization contest and win a copy of Raffael's book "Applied Security Visualization". For details regarding the task and submission details see the 25C3 DAVIX Visualization Bootcamp page.
Zenmap is a GUI front end for nmap, the popular network and port scanning tool by fyodor.
Introduction
Zenmap is the official graphical user interface (GUI) for the Nmap Security Scanner. It is a multi-platform, free and open-source application designed to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. A command creator allows interactive creation of Nmap command lines. Scan results can be saved and viewed later. Saved scans can be compared with one another to see how they differ. The results of recent scans are stored in a searchable database. A typical Zenmap screen shot is shown in Figure 12.1. See the official Zenmap web page for more screen shots.
Both of these tools were recently released by Utah State University under the GPL license. You can read more about them by following the links, including sample movies that demonstrate how the tools work. The tools were created by Rian Shelley.
IPVisualizer
IPVisualizer is a visualization in which a range of IP addresses are represented as dots on a screen. The shape, intensity, and color of the dot indicate the direction, count, and type of the traffic, respectively.
OIP
OIP is a visualization in which individual machine IPs are placed randomly on a display, and packets are visualized as different sized dots flowing from one machine to another.
I just wrote a blog entry about some ideas of displaying time in link graphs. This is a problem that has bugged me for a while and I still don't have a good solution. The blog entry outlines some ideas and alternatives. Maybe you have a better way to visualize relationships and time in the same graph?
I have made a minor change with regards to letting people post comments to discussion entries. It used to be the case that anyone was able to post comments on the site. Unfortunately that meant that I got spammed quite badly. I realized that I had a huge approval queue for comments. I went through some of them and published them. Sorry if I deleted a comment of yours. Please repost if your comment got lost.
From now on, new comments can only be posted when logged in. Sorry for the inconvenience, but this should help a lot to make discussions more interactive through the comments.
Thanks for everybody that commented on broken links and such. I hope I fixed everything at this point. As always, if you have any input for the site, please let me know. Either by sending me an email or posting something here. Thx!
Interested in getting a quick overview of Security Visualization? I am guest-blogging on IT World. There you can find a series of blog entries about how to generate your own security visualizations:
(Update 12/05/08: Fixed the links. Sorry!)
Follow SecViz on the brand new twitter feed: @SecViz.
As part of the ISSummit in Hong Kong, I will be teaching a one day workshop on security visualization. The following is the abstract of the training:
As networks become ever more complex, securing them becomes more and more difficult. The solution is visualization. Using today's state-of-the-art data visualization techniques, you can gain a far deeper understanding of what's happening on your network right now. You can uncover hidden patterns of data, identify emerging vulnerabilities and attacks, and respond decisively with countermeasures that are far more likely to succeed than conventional methods. The attendees will get an overview of visualization, data sources for IT security, and learn how to generate visual representations of IT data. The training is filled with hands-on exercises.
The talk is going over the following individual topics:
I recorded a short, 10 minute video where I am interviewed by Johnvey Hwang about the Applied Security Visualization book. We are talking about why I wrote the book, what the book is about, and also quickly talk about DAVIX. Tune in.
Skyrails is a social network (or any graph really) visualization system. It has a built in programming language for processing (as far as visualisation attributes goes) the graph and its attributes. The system is not only aimed at expert users though, because through the scripting languages menus can be built and the system can be used by any users.
The main distinguishing point of the system comes from the built in scripting language, the added flexibility of how to represent attributes (nodes can be binded to planes and spheres based on their attributes) and the scriptability of the user interface system. This makes skyrails ideal for creating presentations targeted at the average users.
http://cgi.cse.unsw.edu.au/~wyos/skyrails/
skyrails in action:
http://www.youtube.com/watch?v=I2d312_dXEs
For those who are interested, here are the slides from the DAVIX workshop that Jan Monsch and Raffael Marty taught at DefCon 2008 in Vegas. The content is as follows:
Could I possibly get a little help with getting the afterglow / neato tools usefully working. have 291 lines of data and for the life of me the graphs I'm generating are quite poor.
I am not a Perl programmer but have managed to get cygwin working and afterglow & neato working.
using this sample set of the 291 I can get the two diagrams I have attached, but I would dearly like some advise how to generate a more representative image.
If this forum is inappropriate for a little mentoring then please advise / delete as appropriate.
With kind regards,
Stephen
10.140.122.23,10.142.162.88,80
10.142.40.198,10.142.44.233,80
10.129.20.81,10.142.162.88,80
10.142.45.99,10.142.162.88,80
10.142.41.106,10.142.162.88,80
10.142.41.106,10.142.162.88,80
10.142.45.191,10.142.162.88,80
10.239.41.33,10.143.23.79,80
10.142.36.98,10.142.162.88,80
10.142.36.98,10.142.162.88,80
10.142.45.99,10.142.162.88,80
10.142.45.70,10.142.162.88,80
10.142.45.70,10.142.162.88,80
10.143.24.45,10.142.44.233,80
10.142.41.194,10.142.162.88,80
After months of building and testing, the long anticipated release of DAVIX - The Data Analysis & Visualization Linux® - arrived last week during Blackhat/DEFCON in Las Vegas. It is a very exiting moment for us and we are curious to see how the product is received by audience. So far the ISO image has been downloaded at least 600 times from our main distribution server. Downloads from the mirrors are not accounted.
All those eager to get their hands dirty immediately can find a description as well as the download links for the DAVIX ISO image on the DAVIX homepage.
We wish you happy visualizing!
Kind regards
Jan
