Vis sense cluster meeting

www.vis-sense.euNo. 257495

Visual Analytic Representation of Large Datasets for Enhancing Network Security

James DaveyFraunhofer Institute for Computer Graphics Research IGDFraunhoferstraße 564283 Darmstadt

Phone +49 6151 155-655 | Fax [email protected]/igd-a3


VIS-SENSE Organisation

6 partners from 4 countries:

� Fraunhofer IGD (Germany) – Coordinator

� CERTH / ITI (Greece)

� Institut EURECOM (France)

� Institut Telecom (France)

� Symantec Ltd. (Ireland)

� University of Konstanz (Germany)

Topic:

Grant Agreement:

Time Frame:

Budget:

Technology and Tools for Trustworthy ICT (2009.1.4)

STREP – 257495

01.10.2010 until 30.09.2013

3,32 million euro / 2.35 million euro EU contribution


Root-Cause Analysis

Use Case: Root-Cause AnalysisUse Case: Root-Cause Analysis

Overview over the Internet threat landscapeOverview over the Internet threat landscape

Zooming OutZooming Out


Overview – Zooming Out






Features in an interactive map:

�Position,

�Area,

�Street hierarchy,

�Etc.


Our Features:

�I.P. addresses,

�Server names,

�Email addresses,

�Keyword sets,

�Distributions,

�Timestamps,

�Etc.


Features in an interactive map:

�Grouping is easy and unambiguous


Our Features:

�Grouping is difficult

�Grouping is ambiguous

�We need some definition of distance or similarity

Similarity Models


The TRIAGE (1) approach

� Clustering based on Multi-Criteria Decision Analysis (MCDA)

� Automatic grouping of elements likely to share the same root causes

Σ

Per feature

Graph-based representation

Multi-criteria

Aggregation

(data fusion)

Multi-Dimensional

Clusters (MDC’s)

Events

Features

Selection

1) Triage (med.): process of prioritizing patients based on the severity of their condition

9

9


Definitions

Entities

Features


Similarity – Models for Similarity


Per Feature Similarity Example – Real Numbers


Grouping with respect to different features


Aggregate Similarity Example


An example of Rogue AV campaign

Registration date

750 domains registered over a span of 8 months

/24 network of web server

Domain name

Registrant email


- domain name patterns- use of whois privacy

protection services


Rustock

Unclassified

Grum

Cutwail

Subject keywords

Spam event

Bot name

Spam BotnetsInter-relationships

Mega-D


Thanks for Your Attention

IGD

_Fol

ienv

orla

ge_v

2010

.10.

ppt

James DaveyFraunhofer IGDFraunhoferstraße 564283 Darmstadt

Tel +49 6151 155 – 655 | Fax – [email protected]/igd-a3

Education

Vis sense cluster meeting