ENTVis: A visual analytic tool for entropy-based network traffic anomaly detection

F Zhou, W Huang, Y Zhao, Y Shi… - … computer graphics and …, 2015 - ieeexplore.ieee.org
F Zhou, W Huang, Y Zhao, Y Shi, X Liang, X Fan
IEEE computer graphics and applications, 2015ieeexplore.ieee.org
Entropy-based traffic metrics have received substantial attention in network traffic anomaly
detection because entropy can provide fine-grained metrics of traffic distribution
characteristics. However, some practical issues--such as ambiguity, lack of detailed
distribution information, and a large number of false positives--affect the application of
entropy-based traffic anomaly detection. In this work, we introduce a visual analytic tool
called ENTVis to help users understand entropy-based traffic metrics and achieve accurate …
Entropy-based traffic metrics have received substantial attention in network traffic anomaly detection because entropy can provide fine-grained metrics of traffic distribution characteristics. However, some practical issues--such as ambiguity, lack of detailed distribution information, and a large number of false positives--affect the application of entropy-based traffic anomaly detection. In this work, we introduce a visual analytic tool called ENTVis to help users understand entropy-based traffic metrics and achieve accurate traffic anomaly detection. ENTVis provides three coordinated views and rich interactions to support a coherent visual analysis on multiple perspectives: the timeline group view for perceiving situations and finding hints of anomalies, the Radviz view for clustering similar anomalies in a period, and the matrix view for understanding traffic distributions and diagnosing anomalies in detail. Several case studies have been performed to verify the usability and effectiveness of our method. A further evaluation was conducted via expert review.
ieeexplore.ieee.org
以上显示的是最相近的搜索结果。 查看全部搜索结果