All, I've decided to make the source / xcode project for pkviz (packet structure visualizer/animator) available for free download under GPL3. Check out the details here:

pkviz source

From that link you can find the zipped project as well as a link to the google code project for it if you'd like to contribute. OS X only, unfortunately.

I was just looking for some examples of IPv4 Hilbert Curves and realized there were non in the image gallery. Does anyone have examples of IPv4 space visualizations of that sort? They are also called IPv4 Heatmaps. I have never generated any of them myself and didn't just want to post a screenshot of someone else's images.
Anyone?

FOSE is a conference focused around Technology Solutions for the Business of Government. The FOSE conference donated a free conference pass for the secviz readers. In order to get the pass, tweet the following:

@secviz is raffling off a ticket to the FOSE conference, which is taking part March 23-25, 2010. Retweet to be part of the raffle. See http://secviz.org for details. #FOSETix

UPDATE: We have a winner: @fifth_sentinel ! Congrats!

The winner will be the tweeter that tweeted exactly at the position in the middle of all tweets. So, if there were 20 tweets, the 10th tweeter (we'll round down for odd numbers).

Here is a word from the sponsor:

Explore targeted technology areas, educational theaters, and thousands of cutting edge products. Plus, network with a wealth of industry experts.

*FOSE is a must-attend free show for government, military, and government contractors.

The goal is to analyze Snort logs in order to get a general view of the network events. At your left you have the atacker view, where is ploted a sector graph with quantity(radius) and priorities of atack (red, yellow, green) at your right you have the victims view with same information. there is the abilty to filter by protocol ( TCP, UDP, ICMP ) and priorities, this graph have interaction, and you can get the original log with a mouse right click .
This is the abstract of the paper, the original was written in portuguese.
ABSTRACT
The compromising of computer systems generate evidences on various devices such as routers, operating systems and applications. Monitoring and analyzing this large amount of data is a challenge for network administrators. One way for analyzing large amounts of data like the generated in these cases, is to use information visualization to provide one or more graphics capable to summarize data and translating them into information. This work presents a study on the use of visualization techniques applied to information security and monitoring of computer networks, with emphasis on visual analysis of logs generated by the intrusion detection system Snort. It also reports the development of a software called Apoena, which aims to analyze the alerts generated by Snort, using graphs and pie charts for displaying of the network events.

I've tried to add a new visualization for the cisco part of the upcomig (very very soon) of the 2.1 release of soi. Tell me what you think , im still tweaking it so this is a rough view...I'll still keep the map, timeline matrix etc for the pix but just wanted to add a different view for it...(oh and the colors will be more "pastel"....:) )

International Symposium on Visualization for Cyber Security (VizSec)
14 Sept 2010
Ottawa Canada
Co-Located the Internat’l Symposium on Recent Advances in Intrusion Detection
http://www.vizsec2010.org/

The International Symposium on Visualization for Cyber Security (VizSec) brings together researchers and practitioners in information visualization to provide opportunities for the two communities to collaborate and share insights about meeting security needs through visualization approaches.
VizSec 2010 will be held on September 14th in Ottawa, Canada and is co-located with 11th International Symposium on Recent Advances in Intrusion Detection (RAID). This year our focus is on understanding what makes effective visual interfaces for different cyber security tasks.

Papers offering novel contributions in security visualization are solicited. Papers may present techniques, applications, practical experience, theory, or experiments and evaluations. Papers are encouraged on technologies and methods that have been demonstrated to be useful for improving information systems security and that address lessons from actual application.

Information regarding submission dates will be available on the website.

Hi , im an apprentice to Sec Viz technology.
I used Afterglow to do some visualizing. i need to know how to do aggregation in that.Though I used the coding in Raffy's book, I couldn't make it. I am using the DAVIX and it's sample.properties file.The code that I have used was

color=”yellow” if (field() =~ /ˆ111\.222\..*/);
color.event=”green” if ($fields[1]<1024)
color.sourcetarget="blue"
cluster.target=regex_replace("(\\d\+)\\.\\d+")."/8"
if ($fields[1] eq "80")

Is this Ok? I don't get a different output .Pls let me know where have i gone wrong...

Cheers!!!
SmP.

Per my earlier packet visualizer post, I have an app available for Mac OS X users to download. You can grab it here:

http://sintixerr.wordpress.com/pkviz-packet-visualizer-and-animator/

The app takes tcpdump ascii-hex output (the -X option) and animates through all the packets in a file. It splits the packets into bytes, with position in the packet providing the X axis values and byte value in a given position providing the Y values. You can select a window of packets to display at once (defaults to 30) to see patterns over time. If packet headers are more interesting than payload, there is an option to expand the proportion of space taken by header data so it's easier to see. There are also options to pause the animation, move fwd and back one packet at a time, and jump to specific packts. Finally, if you want to look at the base data for a given packet, you can display the packet in hex.

Right now, I've found there's a rough top limit of 3000 packets, but it really depends on your machine.

Does anyone have a parser for using Windows firewall logs with Treemap???

We've been playing around with augmented reality for a time now, the technology seems to be on a tipping point with iphone (not just the overlay - not truly AR, but they do have true AR apps) , android and other forms of capture and processing. To me this is the future of security visualization. I know it is a bold statement to make, but when you start to develop and delve deeper the possiblilities are endless. If you look at my site you will see the direction of our research. ( http://www.manntechcomputersinc.com/Researching_Now.html ) Im going to release a video asap of where we are with our AR. I think the subject of security AR is too important to completely commercialize. With that respect any "breakthrough's" that we are having will be made open source. If some of you are new to the AR scene there is a good open source tool called artoolkit. Google it and you will see it doesn't take an hour to start playing and testing with AR. For those of you interested please drop me a line at darrenmanners@manntechcomputersinc.com.

So I'm almost ready to release a tool that reads/parses ascii tcpdump logs and animates visualizations the structure of the packets in the file in sequence. You can find a video of it here:

http://www.flickr.com/photos/sintixerr/4094209162/

(Try it HD, full screen)

The packets are laid out left to right, from byte 0 to byte 1500ish. The Y axis is based on the value seen in a given position in the packet (0-255). Colors are based on a combination of "value in position difference from average" and "first byte of the source IP". (Although this will eventually be somewhat customizable...it's just what I have in there now.) The app then displays the packets over time....using a window of 1-N packets at a time (depending on the dataset, different windows help you see patterns you wouldnt otherwise). The further back in the window a packet is, the more transparent/faded it is.....this helps distinguish between newer/older packets being seen as well as to help with smoother animations of patterns seen. The app will let you stop the animation at a given point, change how many packets are seen on the fly (so, if you want to see 1 at a time, you can), step manually through the packets (backward or forward). At some point, I hope to be able to show what value/position combination each of the dots represent if you hover over them.

For me, I use this to get in idea of the boundaries of protocols I dont know, look for "unusual" packets, and look for correlations I wasnt previously aware of between values.

(In this set, the far left will be the TCP/IP headers, but the bulk right of that is payload...you can tell most of the payload is human-headable...the values fall into ASCII ranges more than anything else)

http://sintixerr.wordpress.com

Team Cymru launched a Mac OS X screensaver that displays a global infection map on a rotating globe, together with a RSS and Twitter Feed. http://www.team-cymru.org/News/Screensaver/

Hi all, Team Cymru has posted a movie of some of the visualizations we've made on youtube. www.youtube.com/watch?v=8IBy87mVpcw
This movie shows DDoS attacks, botnet command and control servers, malware relationships and similar visualizations.
Other visualizations that might be of interest :
www.team-cymru.org/Monitoring/Malevolence/irccnc.html
www.team-cymru.org/Monitoring/Malevolence/maps.html
Heatmap animation of worldwide compromised machines

Marcel

Mapping links between users sending inappropriate content via emails using Circos
fifth.sentinel

This tool walks the line of being a parser but it is a pretty handy way of converting Windows logins to something useful to graph. Put this in your login scripts and point it at your syslog infrastructure and you get all the gory details about windows who is logging into what system and the IP/NETBIOSNAME/MAC of the system is in a single log line.

LogReporter.c

Im just about to launch 2.1 version of Sphere Of Influence. I have added a summary page. Here I took a typical 800X600 window and made each pixel represent appx 164 ports. I wanted to visualize the entire port spectrum so that an anaylist can drill down on spotted patterns. I have included a screenshot of the new window...in this shot you can see some peer to peer activity at work. The new version will also have a "hourly wrap up" summary which is pretty extensive in its details, also I added a world map for snort. It should be launched in the next few weeks. Remember this is free for state, federal and educational establishments (worldwide)..companies have to pay, but for $89 I think you get a bargain. Im also working on a very cool project for VOIP systems.....stay tuned
www.manntechcomputersinc.com

Happy Hunting

Darren

Note: I have a new video out on youtube (http://www.youtube.com/watch?v=ekOXjrF9enI) that you can see the new visuals....release is very soon!!! (and we added the Cisco IPS into the mix as well)

An other view made from the davix cd.

:-)