关键词: 时变网络, 安全可视化, 异常检测, 交互分析

Abstract: Cyber security is complex and variable, visualization is a practical method for monitoring the change of communication state. Visualization can help analyst efficient grasp the cyber incident and situation. However, the existing visualization study lacks effective display methods for the connection and connection relationships at time dimension. Furthermore, normal visualization methods can’t help user intuitively manages the discrete characteristics when analysis, to summarize the rules and find anomaly. For this two points, an interactive multi-view visualization system is designed. User can get context in overviews, can found more features at in-depth analysis view, can manage and mark feature in this visualization system. By comparing and analyzing the network security log data set that contained several network exceptions, this study verifies the effectiveness of this design.

Key words: time-varying network, security visualization, anomaly detection, interactive analysis