Network-wide intrusion detection supported by multivariate analysis and interactive visualization

Roberto Therón Sánchez; Roberto Magán-Carrión; José Camacho; Gabriel Maciá-Fernández

Abstract:

In this paper, we introduce a new visualization tool for network-wide intrusion detection. It is based in multivariate anomaly detection with a combination between Principal Component Analysis (PCA) and a new variant called Group-wise PCA (GPCA). Combining these methodologies with the capabilities of interactive visualization, the resulting tool is a highly flexible and intuitive interface that allows the user to navigate through the enormous amount of data collected in the network, in order to find anomalous or unexpected behaviors. We use a real case study to illustrate the capability of the tool to unveil the complex mixture of information that can be found in network security/traffic data and identify and diagnose anomalies in it.

Research areas:

• Intrusion detection and protection
• Data processing and networkmetrics

Year:

2017

Type of Publication:

Proceedings

Keywords:

Principal Component Analysis; Tools; Anomaly detection; Data visualization; Loading; security; visualization

Publisher:

IEEE

Address:

Phoenix, AZ, USA

Organization:

VizSec 2017

Month:

October

ISBN:

978-1-5386-2693-1

DOI:

10.1109/VIZSEC.2017.8062198