Biik a zoomable, context-aware visualization system for Snort - Llaneta, Dan Christian O.; Matriano, Kristel L.; Ragasa, Roger John E. (2008.)
Information visualization has gained attention for the past few years for its benefits in the area of network security. Currently, visualizations that assist network intrusion detection by visualizing packet information exist, allowing analysts to identify malicious traffic by studying visual patters. This research builds an improvement upon the current visualization systems by following recommendations from previous works and by adding context-specific information to assist in intrusion analysis. The system implemented a design where the main visualization captures the system state more succinctly, emphasizing on the frequency and classification of intrusion alerts. More specific views show visualizations that are pertinent to the alert classification, taking into account the relevant visualizations methods in analyzing intrusions. The system used the logs of SNORT, a popular open source Intrusion Detection System as well as the DARPA 1999 data set that simulates malicious traffic. It was also evaluated by SNORT users with promising feedback on potential use. Its current version is released as free and open source (FOSS) software.
Thesis (B.S. Computer Science)--University of the Philippines, Diliman.
Keywords: Visualization; Computer networks -- Security measures; Computer security; Biik