1718t1is428T12

200px

PROPOSAL

POSTER

APPLICATION

RESEARCH PAPER

Problem Statement

In data analytics and visualization, there are unique challenges faced in the security realm as compared to conventional Business Intelligence analytics; rare events (i.e. attacks) within massive volumes of data need to be detected. Organizations commonly use Security Information and Event Management software solutions to gather security events from various systems and logs, by deploying real-time alert tools optimized to do event-driven signature matching for a subset of the overall gathered data. As attacks are more sophisticated these days, threats are more difficult to detect with signature-based systems.

The aim of the project is to help organizations identify high-level security threats and attacks by analyzing large amounts of security data (i.e. event logs) we have collected, such that security analysts are able to deal with such threats and attacks with the findings without being required to have strong data science proficiency.

Background Survey of Related Works

Visualizations	Explaination
550px Data source: http://www.digitalattackmap.com/	Digital Attack Map is a live data visualization of DDoS attacks around the globe, built through a collaboration between Google Ideas and Arbor Networks. The tool surfaces anonymous attack traffic data to let users explore historic trends and find reports of outages happening on a given day.
550px Data source: http://www.trendmicro.com.sg/sg/security-intelligence/current-threat-activity/global-botnet-map/index.html	Global botnet threat activity map by Trend Micro shows the monitored malicious network activity to identify command-and-control servers. It enables security analyst to identify which computers are being attack how many often over the past 2 weeks.
550px Data source: https://www.akamai.com/us/en/solutions/intelligent-platform/visualizing-akamai/real-time-web-monitor.jsp	Global Internet conditions map by Akamai. With this real-time data they identify the global regions target of the greatest web attack traffic, cities with the slowest web connections (latency) and geographic areas with the most web traffic (traffic density).

Tools / Libraries

• Tableau
• Github
• Microsoft Excel
• Adobe Creative Suites
• Sketch
• Javascript: sigma.js, vis.js, three.js, D3.js
• Python

Technical Challenges

Key Technical Challenges	Detailed Description	Proposed Solution
Unfamiliar with D3.js libraries	D3.js is a JavaScript library for producing dynamic, interactive data visualizations in web browsers.	Go for the d3 workshop Self learning Peer Learning
Data Cleaning and Transformation	The data set are in text format and many other different format. Integration are challenging as there are a lot of manual work to be done.	Delegate workload for cleaning datasets
Data Unavailability	Many actual security attacks and defense data are paid version.	Research databases using school links through the library portal
Determining the Most Optimal Interactive Elements	In order to enable users to understand the data sets, interactive elements needs to be suitable for this project	Develop storyboard Research on security visualization

Roles & Milestones

Project Timeline

References

• Databases: http://vizsec.org/data/
• Botnet Dataset: https://www.uvic.ca/engineering/ece/isot/datasets/
• D3.js: https://d3js.org/
• Detect virus: https://www.virustotal.com

Comments

Please leave comments here.