Visualizing large scale IP traffic flows

Transcription

1 Networks and Distributed Systems Visualizing large scale IP traffic flows Authors: Florian Mansmann, University of Konstanz Fabian Fischer, University of Konstanz Daniel A, Keim, University of Konstanz Stephen C. North, AT&T Research Course: Networks and Distributed Systems (320422) Instructor: Prof. Jürgen Schönwälder Student: Nikolay Melnikov

2 Overview Introduction Efficient querying of large IP related data sets Related work Hierarchical Network Map (HNM) Dealing with multiple sources and destinations Summary and conclusion Applications

3 Introduction Intrusion Detection signature based anomaly based Hierarchical Network Maps prefix > AS > country > continent Edge bundles accumulative effect display

4 Efficient querying of large IP related data sets OnLine Analytical Processing (OLAP) Multidimensional data model: data cube, facts, measures Queries aggregate values over a range of dimensions Dimensions: IP, time, port Logical multidimensional model, [2]

5 Efficient querying of large IP related data sets Example cube with 3 dimensions, [9]

6 Efficient querying of large IP related data sets Snowflake schema Separate table for each level of the dimension Pre joining lowest with highest level IP hierarchy Avoids expensive operations during interactive analysis IP address is grouped by: IP prefix > AS > country > continent Specifying the database query and visualization parameters IP/AS hierarchy

7 Related Work Most of other researches in the field performed well, BUT... :) Common way to display hierarchy place child inside parent Treemaps: slice and dice, squarified Non treemap layout algorithms are mentioned Five primary treemap algorithms, [4]

8 Related Work Slice and dice, [6] Squarified, [6]

9 Related Work Display of network traffic as lines problem HNM supports formation of mental model Flow maps Bundling of lines that connect leaf nodes edge bundles Flow map, [7]

10 Hierarchical Network Map [2]

11 Hierarchical Network Map Child within a parent Benefits: semantic meaning of unstructured data parent child relationship for country & AS Country AS relationship is not clear (GeoIP stats problem) Mental model & continent/country visualization Ordered treemap (lower aspect ratios) pruning nodes with little or no traffic hierarchy level can be drilled down or rolled up

12 Hierarchical Network Map

13 Hierarchical Network Map Pixel showing individual host, [9]

14 Hierarchical Network Map Large size differences challenging to compare Scaling of IP prefix sizes Log normalized coloring Effects of scaling on the space filling

15 Hierarchical Network Map Area colors Mapping values to colors using different normalization schemes, [9]

16 Drawing routed traffic for multiple sources and destinations (a)obvious problems (b)hierarchy is ambiguous (c)edge bundles and transparency effect Different strategies to draw relationships

17 Drawing routed traffic for multiple sources and destinations Use of splines (B spline, degree 6) taking into account the hierarchy Spline (red), control polygon (gray) IP/AS Hierarchy determines the control polygon Edge coloring next 2 slides

18 Drawing routed traffic for multiple sources and destinations 1. Use of color to convey the amount of traffic transferred

19 Drawing routed traffic for multiple sources and destinations 2. Use of color to distinguish edges... Distraction problem

20 Summary and conclusion Interaction spline or region selection transparency effects IP prefix substitution Large scale networks monitoring improvement

21 Applications Comparison of traffic at different time spans, [9]

22 Applications 100 splines/4hnmap's major traffic at Uni Konstanz gateway, [9]

23

24

25

26 Thank you for attention!

27 References 1. F. Mansmann and F. Fischer and D. A. Keim and S. C. North: Visualizing large scale IP traffic flows. Proc. 12th International Workshop Vision, Modeling, and Visualization, F. Mansmann and S. Vinnik: Interactive Exploration of Data Traffic with Hierarchical Network Maps. IEEE Transactions on Visualization and Computer Graphics, vol.12/6, Nov B. Johnson and Ben Shneiderman: Tree maps: A space filling approach to the visualization of hierarchical information structures. In VIS 91: Proceedings of the 2nd IEEE Conference on Visualization, pages , / html 7. Doantam Phan, Ling Xiao, Ron Yeh, Pat Hanrahan, and Terry Winograd: Flow map layout. In INFOVIS 05: Proceedings of the Proceedings of the 2005 IEEE Symposium on Information Visualization, page 29, Washington, DC, USA, IEEE Computer Society. 8. Florian Mansmann, Daniel A. Keim, Stephen C. North, Brian Rexroad, Daniel Sheleheda: Visual Analysis of Network Traffic for Resource Planning, Interactive Monitoring, and Interpretation of Security Threats, IEEE Transactions on Visualization and Computer Graphics (Proceedings Visualization / Information Visualization 2007), Vol. 13, No. 6, Ieee Press, Florian Mansmann: Visual Analysis of Network Traffic Interactive Monitoring, Detection, and Interpretation of Security Threats, University Of Konstanz, 2008, Ph.d. Thesis.