Slides from my talk at the IEEE Symposium on Visualization for Cyber Security, 2017 in Phoenix (Arizona), United States

1. Towards Designing Effective Visualizations
for DNS-based Network Threat Analysis
Rosa Romero-Gómez, Yacin Nadji, and Manos Antonakakis
{rgomez30,yacin,manos}@gatech.edu

2. What is Network Threat Analysis?
2

3. Analyst
Alerts Threat Intelligence
The Domain Name System (DNS) is an essential protocol used by
both legitimate Internet applications and cyber attacks
[Building a Dynamic Reputation System for DNS, Antonakakis et al. 2010]
3

4. Challenges
4

5. Threat Intelligence Acquisition
“Security analysts are still collecting threat intelligence via
email, spreadsheets, and cutting/pasting information from
web-based sources. Obviously, these manual processes
don’t scale”
[Enterprise Strategy Group (ESG) Research Report: Threat Intelligence and Its Role Within Enterprise
Cybersecurity Practices,
June 2015]
5

6. Analytics
“Threat intelligence may offer clues but human beings are
left to do the heavy lifting by investigating and analyzing
the data on their own”
[ESG Research Report: Threat Intelligence and Its Role Within Enterprise Cybersecurity Practices,
June 2015]
6

7. Our Approach:
Open Source THreat Analysis COnsole
(THACO)
Open Datasets Visualization Techniques
7

8. 8
Classless Inter-Domain Routing (CIDR)
Notation
192.0.0.0/8
192.1.0.0/16 192.2.0.0/16
192.168.16.0/24
192.3.0.0/16
192.2.3.0/24
192.2.3.1/32
192.2.3.12/32
/8
/16
/24
/32

9. Access to THACO live demo: https://ipviz.gtisc.gatech.edu/
9

10. User-centered Visualization Design
Domain Problem /
Data Characterization
Design Prototype Evaluation
10

11. Domain Problem & Data
Characterization
• Procedure: informal interviews with two domain experts
in network threat analysis during two months
• Output: two main high-level categories of tasks and
data requirements:
Top-down network
threat analysis
or
Threat Hunting
Bottom-up network
threat analysis
or
Incident Response
11

12. Domain Problem & Data
Characterization
• Effective threat intelligence involves the combination of
multiple data sources:
• Active DNS datasets (https://www.activednsproject.org/)
• Public Domain Blacklists such as abuse.ch
• Malware Traces (https://www.virustotal.com)
• Domain WHOIS records (https://www.threatminer.org/)
12

13. Design
• Design Goals
1. Multiple views
2. Different levels of detail
3. Scalability
Multi-grouping, zoomable treemap
13

14. Evaluation
• Participants:
• Network threat analysts are hard to find
• Seven in-situ and thirty-one online network threat
analysts from both academia and industry
• Years of experience ranging < 1 year to > 10 years
• Procedure:
• In-situ evaluation: tasks scenarios and semi-structured
interviews
• Online evaluation: web-based survey (SUS, System
Usability Scale)
14

15. Evaluation
• Main Results:
• Threat analysis experience of participants affects
neither task completion rates nor task completion
times using THACO
• Experience analysts satisfaction garnered THACO an
“A” grade in usability
• Limitations:
• THACO could be improved for tasks involving
keeping track of different pieces of information over
time
15

16. Want data?
Active DNS datasets: https://
www.activednsproject.org/
16

17. Want a demo?
THACO live demo: https://
ipviz.gtisc.gatech.edu/
17

18. Want code?
Source code on GitHub: https://
github.com/Astrolavos/THACO
18

19. Questions?
19

20. Towards Designing Effective Visualizations
for DNS-based Network Threat Analysis
Rosa Romero-Gómez, Yacin Nadji, and Manos Antonakakis
{rgomez30,yacin,manos}@gatech.edu