多源网络安全数据时序可视分析方法研究  

Visualization of Multi-source Network Security Data Based on Stacked Stream Graph

作　　者：赵颖[1] 樊晓平[1,2] 周芳芳[1] 杨梦洁[3] 黄叶子[3] 

机构地区：[1]中南大学信息科学与工程学院,长沙410083 [2]湖南财政经济学院网络化系统实验室,长沙410205 [3]中南大学软件学院,长沙410075

出　　处：《小型微型计算机系统》2014年第4期906-910,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(61103108)资助;湖南省科技计划博士后专项项目(2012RS4049)资助;国家科技支撑计划(2012BAH08B01)资助;中南大学博士后启动资金项目资助;湖南省自然科学基金项目(12JJ3062)资助

摘　　要：网络安全可视化通过提供有效的信息可视化工具,提升网络安全分析师在解决网络安全问题过程中的认知能力,从而更高效地识别网络异常和分析安全趋势.堆叠流图是一种新颖的可视化技术,它优美地展示了多时间序列数据在时间线上的相互关系与发展趋势.本文将堆叠流图引入网络安全可视化中,并根据网络安全事件的多源关联性,提出了擅长多时序对比分析的堆叠流图设计方法,研究了传统堆叠流图和对比堆叠流图在实现过程中堆叠基准函数计算、曲线插值、排序和标签布局算法等问题,最后通过实验验证了基于对比堆叠流图的多源网络安全数据时序可视分析方法的有效性.Network security visualization provides the analysts with better tools to detect anomalies, identify correlations of security e- vents and predict the trends of network security. Stacked stream graphfocuses on temporal thematic change of multiple time series data over time and allows users to discern patterns that suggest their relationships or trends. In this paper, stacked stream graph is intro- duced to the visualization of network security. Methods of the analysis of network security incidents based on multi-source are pro- posed and a comparative stacked stream graph for multi-subject is implemented, and then the problems of baseline function, curve in- terpolation, layer ordering and labeling for standard and comparative stacked stream graph are discussed. Finally, the effectiveness of system based on stacked stream graph is verified through some experiments and evaluations.

关 键 词：可视化 可视分析 网络安全 堆叠流图 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]