Systems and methods for threat visualization with signature composure, spatial scale and temporal expansion
A network security system collects event data over a long duration and mines the event data to identify unique conversations between each unique pair of a source network address and a destination network address. Events in each unique conversation are associated with signature identifiers that identify different types of attacks. Each signature thus identified is assigned with a unique visual clue. The unique visual clue has a particular visual character that reflects a number of occurrences of a particular event. For payload sizes associated with the event, a spatial scale representation is determined. The network security system generates a visualization relative to a conversation timeline for presentation on a user interface. The visualization contains unique visual clues for the different types of attacks associated with the signature identifiers and the spatial scale representation of the payload sizes associated with the events associated with the signature identifiers.
1. A method for threat visualization with signature composure, spatial scale, and temporal expansion, the method comprising:
collecting, by a network security system executing on a computer, network security event data over a time period;
performing a data mining operation on the network security event data collected over the time period, the data mining operation comprising:
extracting characteristics from the network security event data collected over the time period, the characteristics including a computer network identifier, a source network address, and a destination network address, the destination network address in a computer network monitored by the network security system,
wherein the characteristics further comprise event time, signature identifier, request size, and response size;
identifying, by the network security system, unique conversations in the network security event data between each unique pair of a source network address and a destination network address, the identifying utilizing the characteristics extracted from the network security event data collected over the time period, each unique conversation in the network security event data having an event time for each event occurring in the unique conversation;
sorting, by the network security system, network security events in the unique conversation according to the event time for each event, the network security events associated with signature identifiers that identify different types of attacks;
determining a spectral signature of the sorted network security events, the spectral signature representing a temporal behavior pattern of attacks to the destination network address;
assigning, by the network security system, each spectral signature with a unique visual clue;
determining, by the network security system, a character of the unique visual clue to reflect a number of occurrences of a particular network security event;
determining, by the network security system, a spatial scale representation of payload sizes associated with the network security events; and
generating, by the network security system, a visualization relative to a conversation timeline for the time period for presentation on a user interface, the visualization containing unique visual clues for the different types of attacks associated with the spectral signature and the spatial scale representation of the payload sizes associated with the network security events associated with the spectral signature.
2. The method according to claim 1 , wherein the visualization is scalable from months, weeks, days, hours, or minutes down to seconds.
3. The method according to claim 1 , wherein the visualization is scalable from seconds up to minutes, hours, days, weeks, or months.
4. The method according to claim 1 , wherein the time period comprises at least eight months.
5. The method according to claim 1 , wherein, for each network security event received by the network security system, the network security system extracts a source network address from which the network security event is originated, a destination network address to which the network security event is destined, a computer network identifier associated with a computer network where the destination network address belongs, a time when the network security event occurs, a signature identifier identifying a type of attack associated with the network security event, a request size associated with a request from the source network address from which the network security event is originated, and a response size associated with a response from the designation network address.
6. The method according to claim 1 , further comprising:
storing the network security event data in a data storage accessible by the network security system.
7. A network security system for threat visualization with signature composure, spatial scale, and temporal expansion, the network security system comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor to perform:
collecting network security event data over a time period;
performing a data mining operation on the network security event data collected over the time period, the data mining operation comprising:
extracting characteristics from the network security event data collected over the time period, the characteristics including a computer network identifier, a source network address, and a destination network address, the destination network address in a computer network monitored by the network security system,
wherein the characteristics further comprise event time, signature identifier, request size, and response size;
identifying unique conversations in the network security event data between each unique pair of a source network address and a destination network address, the identifying utilizing the characteristics extracted from the network security event data collected over the time period, each unique conversation in the network security event data having an event time for each event occurring in the unique conversation;
sorting network security events in the unique conversation according to the event time for each event,
determining a spectral signature of the sorted network security events, the spectral signature representing a temporal behavior pattern of attacks to the destination network address;
assigning each spectral signature with a unique visual clue;
determining a character of the unique visual clue to reflect a number of occurrences of a particular network security event;
determining a spatial scale representation of payload sizes associated with the network security events; and
generating a visualization relative to a conversation timeline for the time period for presentation on a user interface, the visualization containing unique visual clues for the different types of attacks associated with the spectral signature and the spatial scale representation of the payload sizes associated with the network security events associated with the spectral signature.
8. The network security system of claim 7 , wherein the visualization is scalable from months, weeks, days, hours, or minutes down to seconds.
9. The network security system of claim 7 , wherein the visualization is scalable from seconds up to minutes, hours, days, weeks, or months.
10. The network security system of claim 7 , wherein the time period comprises at least eight months.
11. The network security system of claim 7 , wherein, for each network security event received by the network security system, the network security system extracts a source network address from which the network security event is originated, a destination network address to which the network security event is destined, a computer network identifier associated with a computer network where the destination network address belongs, a time when the network security event occurs, a signature identifier identifying a type of attack associated with the network security event, a request size associated with a request from the source network address from which the network security event is originated, and a response size associated with a response from the designation network address.
12. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of a network security system to perform:
collecting network security event data over a time period;
performing a data mining operation on the network security event data collected over the time period, the data mining operation comprising:
extracting characteristics from the network security event data collected over the time period, the characteristics including a computer network identifier, a source network address, and a destination network address, the destination network address in a computer network monitored by the network security system,
wherein the characteristics further comprise event time, signature identifier, request size, and response size;
identifying unique conversations in the network security event data between each unique pair of a source network address and a destination network address, the identifying utilizing the characteristics extracted from the network security event data collected over the time period, each unique conversation in the network security event data having an event time for each event occurring in the unique conversation;
sorting network security events in the unique conversation according to the event time for each event, the network security events associated with signature identifiers that identify different types of attacks;
determining a spectral signature of the sorted network security events, the spectral signature representing a temporal behavior pattern of attacks to the destination network address;
assigning, by the network security system, each spectral signature with a unique visual clue;
determining a character of the unique visual clue to reflect a number of occurrences of a particular network security event;
determining a spatial scale representation of payload sizes associated with the network security events; and
generating a visualization relative to a conversation timeline for the time period for presentation on a user interface, the visualization containing unique visual clues for the different types of attacks associated with the spectral signature and the spatial scale representation of the payload sizes associated with the network security events associated with the spectral signature.
13. The computer program product of claim 12 , wherein the visualization is scalable from months, weeks, days, hours, or minutes down to seconds.
14. The computer program product of claim 12 , wherein the visualization is scalable from seconds up to minutes, hours, days, weeks, or months.
15. The computer program product of claim 12 , wherein the time period comprises at least eight months.
16. The computer program product of claim 12 , wherein, for each network security event received by the network security system, the network security system extracts a source network address from which the network security event is originated, a destination network address to which the network security event is destined, a computer network identifier associated with a computer network where the destination network address belongs, a time when the network security event occurs, a signature identifier identifying a type of attack associated with the network security event, a request size associated with a request from the source network address from which the network security event is originated, and a response size associated with a response from the designation network address.
17. The computer program product of claim 12 , wherein the instructions are further translatable by the processor to perform:
storing the network security event data in a data storage accessible by the network security system.