Real-time visualization of network attacks on high-speed links

Hyogon Kim; Inhye Kang; Saewoong Bahk

doi:10.1109/MNET.2004.1337733

Real-time visualization of network attacks on high-speed links

Hyogon Kim, Inhye Kang, Saewoong Bahk

Department of Computer Science and Engineering

Research output: Contribution to journal › Article › peer-review

20 Citations (Scopus)

Abstract

This article shows that malicious traffic flows such as denial-of-service attacks and various scanning activities can be visualized in an intuitive manner. A simple but novel idea of plotting a packet using its source IP address, destination IP address, and the destination port in a 3-dimensional space graphically reveals ongoing attacks. Leveraging this property, combined with the fact that only three header fields per each packet need to be examined, a fast attack detection and classification algorithm can be devised.

Original language	English
Pages (from-to)	30-39
Number of pages	10
Journal	IEEE Network
Volume	18
Issue number	5
DOIs	https://doi.org/10.1109/MNET.2004.1337733
Publication status	Published - 2004 Sept

Bibliographical note

Funding Information:
The original idea of classifying the attacks using the three-packet header values is attributed to Heejung Sohn. We thank Jin-Ho Kim and Byung-Seung Kim for their effort in running the RADAR code on live Seoul National University backbone network traffic. We also thank the anonymous reviewers who helped improve the presentation of the article. This work was supported in part by a Korea University Grant and a NRL program of KISTEP, Korea.

ASJC Scopus subject areas

Software
Information Systems
Hardware and Architecture
Computer Networks and Communications

Access to Document

10.1109/MNET.2004.1337733

Cite this

@article{3073e4696d804617b0bf4ded1447a0c9,

title = "Real-time visualization of network attacks on high-speed links",

abstract = "This article shows that malicious traffic flows such as denial-of-service attacks and various scanning activities can be visualized in an intuitive manner. A simple but novel idea of plotting a packet using its source IP address, destination IP address, and the destination port in a 3-dimensional space graphically reveals ongoing attacks. Leveraging this property, combined with the fact that only three header fields per each packet need to be examined, a fast attack detection and classification algorithm can be devised.",

author = "Hyogon Kim and Inhye Kang and Saewoong Bahk",

note = "Funding Information: The original idea of classifying the attacks using the three-packet header values is attributed to Heejung Sohn. We thank Jin-Ho Kim and Byung-Seung Kim for their effort in running the RADAR code on live Seoul National University backbone network traffic. We also thank the anonymous reviewers who helped improve the presentation of the article. This work was supported in part by a Korea University Grant and a NRL program of KISTEP, Korea.",

year = "2004",

month = sep,

doi = "10.1109/MNET.2004.1337733",

language = "English",

volume = "18",

pages = "30--39",

journal = "IEEE Network",

issn = "0890-8044",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

number = "5",

}

TY - JOUR

T1 - Real-time visualization of network attacks on high-speed links

AU - Kim, Hyogon

AU - Kang, Inhye

AU - Bahk, Saewoong

N1 - Funding Information: The original idea of classifying the attacks using the three-packet header values is attributed to Heejung Sohn. We thank Jin-Ho Kim and Byung-Seung Kim for their effort in running the RADAR code on live Seoul National University backbone network traffic. We also thank the anonymous reviewers who helped improve the presentation of the article. This work was supported in part by a Korea University Grant and a NRL program of KISTEP, Korea.

PY - 2004/9

Y1 - 2004/9

N2 - This article shows that malicious traffic flows such as denial-of-service attacks and various scanning activities can be visualized in an intuitive manner. A simple but novel idea of plotting a packet using its source IP address, destination IP address, and the destination port in a 3-dimensional space graphically reveals ongoing attacks. Leveraging this property, combined with the fact that only three header fields per each packet need to be examined, a fast attack detection and classification algorithm can be devised.

AB - This article shows that malicious traffic flows such as denial-of-service attacks and various scanning activities can be visualized in an intuitive manner. A simple but novel idea of plotting a packet using its source IP address, destination IP address, and the destination port in a 3-dimensional space graphically reveals ongoing attacks. Leveraging this property, combined with the fact that only three header fields per each packet need to be examined, a fast attack detection and classification algorithm can be devised.

UR - http://www.scopus.com/inward/record.url?scp=6444229776&partnerID=8YFLogxK

U2 - 10.1109/MNET.2004.1337733

DO - 10.1109/MNET.2004.1337733

M3 - Article

AN - SCOPUS:6444229776

SN - 0890-8044

VL - 18

SP - 30

EP - 39

JO - IEEE Network

JF - IEEE Network

IS - 5

ER -

Real-time visualization of network attacks on high-speed links

Abstract

Bibliographical note

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this