Transcript Document
Network Attack Visualization Greg Conti www.cc.gatech.edu/~conti Disclaimer The views expressed in this presentation are those of the author and do not reflect the official policy or position of the United States Military Academy, the Department of the Army, the Department of Defense or the U.S. Government. image: http://www.leavenworth.army.mil/usdb/standard%20products/vtdefault.htm information visualization is the use of interactive, sensory representations, typically visual, of abstract data to reinforce cognition. http://en.wikipedia.org/wiki/Information_visualization An Art Survey… A B C http://www.clifford.at/cfun/progex/ http://www.muppetlabs.com/~breadbox/bf/ http://www.geocities.com/h2lee/ascii/monalisa.html http://www.artinvest2000.com/leonardo_gioconda.htm Why InfoVis? Views • • • • • • • Patterns Anomalies Comparisons Outliers/Extremes Big Picture & Details Interaction Large Datasets Replies Packet Capture Visualizations EtherApe Ethereal Tcpdump image: http://www.bgnett.no/~giva/pcap/tcpdump.png TCPDump can be found at http://www.tcpdump.org/ Ethereal image: http://www.linuxfrance.org/prj/edu/archinet/AMSI/index/images/ethereal.gif Ethereal by Gerald Combs can be found at http://www.ethereal.com/ TCP Dump EtherApe image: http://www.solaris4you.dk/sniffersSS.html Etherape by Juan Toledo can be found at http://etherape.sourceforge.net/ So What? • Go Beyond the Algorithm – Complement current systems • Make CTF a Spectator Sport • Enhance forensic analysis – Mine large datasets – Logs • Monitor in real time – Allow big picture, but details on demand – Fingerprint attacks/tools (people?) – Alerts (2-3 Million /day) • Observe attacker behavior (example) What tasks do you need help with? Destination IP Recon Focused Attacks Next Wave Time Classical InfoVis Research InfoVis Mantra Overview First Zoom and Filter Details on Demand http://www.cs.umd.edu/~ben/ Overview and Detail Examples by Dr. John Stasko, see www.cc.gatech.edu/classes/AY2002/ cs7450_spring/Talks/09-overdetail.ppt for more details. Game shown is Civilization II Focus and Context Table Lens Fisheye View Examples by Dr. John Stasko, see www.cc.gatech.edu/classes/AY2001/ cs7450_fall/Talks/8-focuscontext.ppt for more details. Table lens (right) is from Xerox Parc and Inxight For more information… •Courses (free) •Conferences •Systems •Research Groups Bookmarks on CD Example Classical InfoVis Systems example 1 - data mountain http://www1.cs.columbia.edu/~paley/spring03/assignments/HW3/gwc2001/mountain.jpg example 2 - filmfinder http://transcriptions.english.ucsb.edu/archive/colloquia/Kirshenbaum/filmfinder.gif example 3 - parallel coordinates MPG 35 0 A. Inselberg and B. Dimsdale. Parallel coordinates: A tool for visualizing multidimensional geometry. Proc. of Visualization '90, p. 361-78, 1990. http://davis.wpi.edu/~xmdv/images/para.gif example 4 informative art http://www.viktoria.se/fal/projects/infoart/ examples 5 - 72 (on CD) Many, many untapped security applications… More Information Information Visualization • • • • • • • Envisioning Information by Tufte The Visual Display of Quantitative Information by Tufte Visual Explanations by Tufte Beautiful Evidence by Tufte (due this year) Information Visualization by Spence Information Visualization: Using Vision to Think by Card See also the Tufte road show, details at www.edwardtufte.com images: www.amazon.com Representative Security Visualization Research Routing Anomalies Soon Tee Teoh http://graphics.cs.ucdavis.edu/~steoh/ See also treemap basic research: http://www.cs.umd.edu/hcil/treemap-history/index.shtml Secure Scope http://www.securedecisions.com/main.htm Starlight http://starlight.pnl.gov/ Open Source Security Information Management (OSSIM) http://www.ossim.net/screenshots/metrics.jpg TCP/IP Sequence Number Generation Michal Zalewski Linux 2.2 TCP/IP sequence numbers are not as good as they might be, but are certainly adequate, and attack feasibility is very low. x[n] = s[n-2] - s[n-3] y[n] = s[n-1] - s[n-2] z[n] = s[n] - s [n-1] x[n] = s[n-2] - s[n-3] y[n] = s[n-1] - s[n-2] z[n] = s[n] - s [n-1] Follow-up paper - http://lcamtuf.coredump.cx/newtcp/ Initial paper - http://razor.bindview.com/publish/papers/tcpseq/print.html Wireless Visualization http://www.ittc.ku.edu/wlan/images_all_small.shtml Observing Intruder Behavior Dr. Rob Erbacher – Visual Summarizing and Analysis Techniques for Intrusion Data – Multi-Dimensional Data Visualization – A Component-Based EventDriven Interactive Visualization Software Architecture http://otherland.cs.usu.edu/~erbacher/ Glyphs Dr. Rob Erbacher http://otherland.cs.usu.edu/~erbacher/ examples 9 - 45 (to be posted) Hot Research Areas… • • • • • • • • • • • visualizing vulnerabilities visualizing IDS alarms (NIDS/HIDS) visualizing worm/virus propagation visualizing routing anamolies visualizing large volume computer network logs visual correlations of security events visualizing network traffic for security visualizing attacks in near-real-time security visualization at line speeds dynamic attack tree creation (graphic) forensic visualization http://www.cs.fit.edu/~pkc/vizdmsec04/ More Hot Research Areas… • • • • • • • • • • feature selection and construction incremental/online learning noise in the data skewed data distribution distributed mining correlating multiple models efficient processing of large amounts of data correlating alerts signature and anomaly detection forensic analysis http://www.cs.fit.edu/~pkc/vizdmsec04/ Building a System Visual IDS System Architecture Ethernet tcpdump (pcap, snort) winpcap Perl VB Parse Perl VB Process Packet Capture tcpdump capture files Creativity xmgrace (gnuplot) VB Plot rumint tool components (CD) parallel port views External IP 255.255.255.255 0.0.0.0 Internal IP 255.255.255.255 0.0.0.0 External Port 65,535 0 Internal Port 65,535 0 External IP 255.255.255.255 0.0.0.0 Internal Port 65,535 0 External IP 255.255.255.255 0.0.0.0 External Port Internal Port Internal IP 65,535 65,535 255.255.255.255 0 0 0.0.0.0 Also a Port to IP to IP to Port View sara 5.0.3 (port to port view) Light Medium Heavy Tool Fingerprinting (port to port view) nmap 3 (RH8) nmap 3 UDP (RH8) scanline 1.01 (XP) NMapWin 3 (XP) nmap 3.5 (XP) nikto 1.32 (XP) SuperScan 3.0 (XP) SuperScan 4.0 (XP) time sequence data (external port vs. packet) superscan 3 ports ports nmap win packets packets Also internal/external IP and internal port packet length and protocol type over time ports packets length 30 days on the Georgia Tech honeynet External IP Internal Port External Port Internal Port Demo’s rumint xmgrace treemap worm propagation survey x 2 .ppt links classic infovis survey (on CD) rumint tool (on CD) security infovis survey (www.cc.gatech.edu/~conti) bookmarks (on CD) perl/linux/xmgrace demo (on CD) this talk (on CD & www.cc.gatech.edu/~conti) Acknowledgements • 404.se2600 – – – – – Clint Hendrick icer Rockit StricK • Dr. John Stasko – http://www.cc.gatech.edu/~john.stasko/ • Dr. Wenke Lee – http://www.cc.gatech.edu/~wenke/ • Dr. John Levine – http://www.eecs.usma.edu/ • Julian Grizzard – http://www.ece.gatech.edu/ Questions? http://carcino.gen.nz/images/index.php/04980e0b/53c55ca5