Ecole d'ingénieur et centre de recherche en Sciences du numérique

VisTracer: a visual analytics tool to investigate routing anomalies in traceroutes

Fischer, Fabian; Fuchs, Johannes; Vervier, Pierre-Antoine; Mansmann, Florian; Thonnard, Olivier

VIZSEC 2012, 9th International Symposium on Visualization for Cyber Security, October 15, 2012, Seattle, WA, USA

Routing in the Internet is vulnerable to attacks due to the insecure design of the border gateway protocol (BGP). One possible exploitation of this insecure design is the hijacking of IP blocks. Such hijacked IP blocks can then be used to conduct malicious activities from seemingly legitimate IP addresses. In this study we actively trace and monitor the routes to spam sources over several consecutive days after having received a spam message from such a source. However, the real challenge is to distinguish between legitimate routing changes and those ones that are related to systematic misuse in so-called spam campaigns. To combine the strengths of human judgement and computational efficiency, we thus present a novel visual analytics tool named Vistracer in this paper. This tool represents analysis results of our anomaly detection algorithms on large traceroute data sets with the help of several scalable representations to support the analyst to explore, identify and analyze suspicious events and their relations to malicious activities. In particular, pixel-based visualization techniques, novel glyph-based summary representations and a combination of temporal glyphs in a graph representation are used to give an overview of route changes to specific destinations over time. To evaluate our tool, real-world case studies demonstrate the usage of Vistracer in practice on large-scale data sets.  

Document Doi Bibtex

Titre:VisTracer: a visual analytics tool to investigate routing anomalies in traceroutes
Mots Clés:Network Security, Visual Analytics, Traceroutes, Anomalies
Type:Conférence
Langue:English
Ville:Seattle
Pays:ÉTATS-UNIS
Date:
Département:Sécurité numérique
Eurecom ref:3872
Copyright: © ACM, 2012. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in VIZSEC 2012, 9th International Symposium on Visualization for Cyber Security, October 15, 2012, Seattle, WA, USA http://dx.doi.org/10.1145/2379690.2379701
Bibtex: @inproceedings{EURECOM+3872, doi = {http://dx.doi.org/10.1145/2379690.2379701 }, year = {2012}, title = {{V}is{T}racer: a visual analytics tool to investigate routing anomalies in traceroutes}, author = {{F}ischer, {F}abian and {F}uchs, {J}ohannes and {V}ervier, {P}ierre-{A}ntoine and {M}ansmann, {F}lorian and {T}honnard, {O}livier}, booktitle = {{VIZSEC} 2012, 9th {I}nternational {S}ymposium on {V}isualization for {C}yber {S}ecurity, {O}ctober 15, 2012, {S}eattle, {WA}, {USA}}, address = {{S}eattle, {\'{E}}{TATS}-{UNIS}}, month = {10}, url = {http://www.eurecom.fr/publication/3872} }
Voir aussi: