Sharing Network Security Information

To date, network security analysts depend only on some network secure products to study large amounts of log information as to analyze and cope with network anomalies. With dramatic increase of network data volumes, diversities of attack types and more complexity, the traditional analytical means are no longer effective. How to enable those analysts to quickly figure out network status by advantage of cumbersome high-dimensional data information has become a critical concern in the field of network safety. Here it develops a visualized technique for detecting network safety information by port scanning. After the analysis of network data packets and the use of information visualization technique, the visualized port scanning and detection system ScanViewer is designed and developed. The experiment reveals that it can detect slow scan, distributed scan, various TCP stealth scan and so on. With the method, people have got out of helpless embarrassment by the weak scan.

Download Full-text

Coordinated Displays to Assist Cyber Defenders

Proceedings of the Human Factors and Ergonomics Society Annual Meeting ◽

10.1177/1541931213601078 ◽

2016 ◽

Vol 60 (1) ◽

pp. 344-348 ◽

Cited By ~ 8

Author(s):

Alex Vieane ◽

Gregory Funke ◽

Vincent Mancuso ◽

Eric Greenlee ◽

Gregory Dye ◽

...

Keyword(s):

Network Security ◽

Relevant Information ◽

Current Experiment ◽

Multiple Sources ◽

Cyber Defense ◽

Modest Increase ◽

Security Information ◽

Correlate Data ◽

Suspicious Activity

Cyber network analysts must gather evidence from multiple sources and ultimately decide whether or not suspicious activity represents a threat to network security. Information relevant to this task is usually presented in an uncoordinated fashion, meaning analysts must manually correlate data across multiple databases. The current experiment examined whether analyst performance efficiency would be improved by coordinated displays, i.e., displays that automatically link relevant information across databases. We found that coordinated displays nearly doubled performance efficiency, in contrast to the standard uncoordinated displays, and coordinated displays resulted in a modest increase in threat detections. These results demonstrate that the benefits of coordinated displays are significant enough to recommend their inclusion in future cyber defense software.

Download Full-text