Visualization for Security
Aug. 18, 2014•0 likes•7,698 views
Download to read offline
Report
Internet
Vision is a human’s dominant sense. It is the communication channel with the highest bandwidth into the human brain. Security tools and applications need to make better use of information visualization to enhance human computer interactions and information exchange. In this talk we will explore a few basic principles of information visualization to see how they apply to cyber security. We will explore both visualization as a data presentation, as well as a data discovery tool. We will address questions like: What makes for effective visualizations? What are some core principles to follow when designing a dashboard? How do you go about visually exploring a terabyte of data? And what role do big data and data mining play in security visualization? The presentation is filled with visualizations of security data to help translate the theoretical concepts into tangible applications.
Raffael MartyFollow
Recommended
Delivering Security Insights with Data Analytics and VisualizationRaffael Marty
Supply Chain Twin Demo - Companion DeckNeo4j
The Case for Graphs in Supply ChainsNeo4j
Log Analysisn|u - The Open Security Community
Information security management systemArani Srinivasan
Cloud with Cyber SecurityNiki Upadhyay
More Related Content
What's hot
Introduction on Data ScienceEdureka!
2 Security Architecture+DesignAlfred Ouyang
Graph AnalyticsKhalid Salama
Data Analytics for IoT Muralidhar Somisetty
The CIA Triad - Assurance on Information SecurityBharath Rao
Business IntelligenceSukirti Garg
Similar to Visualization for Security
Visualization in the Age of Big DataRaffael Marty
Big Data VisualizationRaffael Marty
AI & ML in Cyber Security - Welcome Back to 1999 - Security Hasn't ChangedRaffael Marty
The Heatmap
- Why is Security Visualization so Hard?Raffael Marty
"Threat Model Every Story": Practical Continuous Threat Modeling Work for You...Izar Tarandach
Software Analytics: Data Analytics for Software Engineering and SecurityTao Xie
![[WSO2Con EU 2017] Deriving Insights for Your Digital Business with Analytics](https://cdn.slidesharecdn.com/ss_thumbnails/ftl1u7i2sbihhixstme6-signature-6abac760590306a9c092f3ba66249d9a805ee6b52c9eb804a80eabb33b95c5ef-poli-171106133401-thumbnail.jpg?width=2048&height=1162&fit=bounds)
More from Raffael Marty
Exploring the Defender's AdvantageRaffael Marty
Extended Detection and Response (XDR) An Overhyped Product Category With Ulti...Raffael Marty
How To Drive Value with Security DataRaffael Marty
Cyber Security Beyond 2020 – Will We Learn From Our Mistakes?Raffael Marty
Artificial Intelligence – Time Bomb or The Promised Land?Raffael Marty
Understanding the "Intelligence" in AIRaffael Marty
Recently uploaded
Common WordPress APIs_ HTTP API.pptxJonathan Bossenger
The value of measuring your accessibility maturityIntopia
Web3_Metaverse_Foundations - DTW Coppenhagen - FINAL - 230919Michael Lesniak
i3.pdfssusere51484
Serverless and event-driven in a world of IoTJimmy Dahlqvist
APrIGF 2023: Sustainability of Complementary Connectivity InitiativesAPNIC
![[FediForum] Reisman FairPay - Rethinking Revenue.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/fediforumreismanfairpay-rethinkingrevenue-230921142132-d55847d0-thumbnail.jpg?width=2048&height=1162&fit=bounds)
Visualization for Security
- 1. Raffael Marty, CEO Visualization for Security Blue Coat - Sunnyvale August, 2014
- 2. Security. Analytics. Insight.2 I am Raffy - I do Viz! IBM Research
- 3. Security. Analytics. Insight.3 What is Security Visualization? Treemap of a Firewall Log • if found(machine) • connect on port 135 • ping scan machines (echo requests) Showing MS Blaster:
- 4. Security. Analytics. Insight.4 Security Visualization Can Be Beautiful Part of Enron Email dataset sender recipient
- 5. Security. Analytics. Insight.5 Security Visualization - Sometimes Abstract Parallel Coordinates of an IDS log Can you find anything interesting?
- 6. Security. Analytics. Insight.6 Security Visualization One destinations is getting hammered! Parallel Coordinates of an IDS log
- 7. Security. Analytics. Insight.7 Security Visualization One destinations is getting hammered! ! Maybe a false positive?
- 8. Visualization
- 9. Security. Analytics. Insight.9 Basic Visualization Principles How many 9’s?
- 10. Security. Analytics. Insight.10 How Many Nines?
- 11. Security. Analytics. Insight.11 What Product has Highest Profit? And Which has Worst Sales?
- 12. Security. Analytics. Insight.12 Table Charts • The exact values are not important • Comparisons • Highlights
- 13. Security. Analytics. Insight.13 Show Context 42
- 14. Security. Analytics. Insight.14 Show Context 42 is just a number and means nothing without context
- 16. Security. Analytics. Insight.16 Use Numbers To Highlight Most Important Parts of Data Numbers Summaries
- 17. Security. Analytics. Insight.17 Visualization Creates Context Visualization Puts Numbers (Data) in Context!
- 18. Security. Analytics. Insight.18 Visualization To … Present / Communicate Discover / Explore
- 19. Data Presentation
- 20. Security. Analytics. Insight.20 • Show comparisons, contrasts, differences • Show causality, mechanism, explanation, systematic structure. • Show multivariate data; that is, show more than 1 or 2 variables. ! by Edward Tufte Principals of Analytic Design
- 21. Security. Analytics. Insight.21 Comparison (to Normal) DNS Reflection • 1:100 Amplification with DNS zone transfer for ripe.net domain • 309Gbps for 28 minutes, 30956 open resolver IPs, 3 networks that allowed spoofing, 5-7 compromised servers March 20, 2013
- 22. Security. Analytics. Insight.22 Causality / Explanation
- 23. Security. Analytics. Insight.23 Multi-Variate Data
- 24. Security. Analytics. Insight.24 Choosing Visualizations Objective AudienceData
- 25. 25
- 26. Charts 26
- 27. Security. Analytics. Insight.27 More Advanced Graphs • Parallel Coordinates • Treemaps • Link Graphs • etc.
- 28. Security. Analytics. Insight.28 Additional information about objects, such as: • machine • roles • criticality • location • owner • … • user • roles • office location • … Add Context source destination machine and user context machine role user role
- 29. Security. Analytics. Insight.29 Traffic Flow Analysis With Context
- 30. Security. Analytics. Insight.30 Intra-Role Anomaly - Random Order users time dc(machines)
- 31. Security. Analytics. Insight.31 Add Context - User Roles Administrator Sales Development Finance Admin???
- 32. Security. Analytics. Insight.32 http://www.scifiinterfaces.com/ • Black background • Blue or green colors • Glow Aesthetics Matter
- 33. Dashboards
- 34. Security. Analytics. Insight.34 • Audience, audience, audience! • Comprehensive Information (enough context) • Highlight important data • Use graphics when appropriate • Good choice of graphics and design • Aesthetically pleasing • Enough information to decide if action is necessary • No scrolling • Real-time vs. batch? (Refresh-rates) • Clear organization Dashboard Design Principles
- 35. Security. Analytics. Insight.35 Netflix Dashboard http://blog.fusioncharts.com/2014/04/how-netflix-plans-to-improve-its-operational-visibility-with-real-time-data-visualization/#more-7243
- 36. Security. Analytics. Insight.36
- 37. 37 Data Discovery & Exploration
- 38. Security. Analytics. Insight.38 Visualize Me Lots (>1TB) of Data
- 39. Security. Analytics. Insight.39 Data Visualization Workflow Overview Zoom / Filter Details on Demand Principle by Ben Shneiderman
- 40. Security. Analytics. Insight.40 This visualization process requires: • Low latency, scalable backend (columnar, distributed data store) • Efficient client-server communications and caching • Assistance of data mining to • Reduce overall data to look at • Highlight relationships, patterns, and outliers • Assist analyst in focussing on ‘important’ areas Backend Support
- 41. Security. Analytics. Insight.41 What I am Working On Data Stores Analytics Forensics Models Admin 10.9.79.109 --> 3.16.204.150 10.8.24.80 --> 192.168.148.193 10.8.50.85 --> 192.168.148.193 10.8.48.128 --> 192.168.148.193 10.9.79.6 --> 192.168.148.193 10.9.79.6 10.8.48.128 80 53 8.8.8.8 127.0.0.1 Anomalies Decomposition Data Seasonal Trend Anomaly Details “Hunt” ExplainCommunicate
- 42. Security. Analytics. Insight.42 Visualization Principles • Use numbers to highlight most important data • Use visualizations to put data in context • Show comparisons, causality, and multivariate data • To find the right visualization, focus on: Objective, Data, Audience • Use data context to augment data and tell a story Visualization can be used for for presentation and/or exploration • Exploration paradigm: Overview first, zoom and filter, details on demand Recap
- 43. 43 raffael.marty@pixlcloud.com http://slideshare.net/zrlram http://secviz.org and @secviz Further resources: