Combining Exploratory Analysis and Automated Analysis for Anomaly Detection in Real-Time Data Streams
A prototype monitors live BGP traffic, pairing automated anomaly alerts with visualization for hijack and denial-of-service context.
The paper studies how exploratory visualization complements automated analysis when analysts monitor real-time security data and risk missing linked events. Its prototype computes indicators and threat alerts on live Border Gateway Protocol traffic and visualizes the context of each alert. The authors note BGP can be hijacked to propagate spam or launch denial-of-service attacks, and that some attack scenarios are too elaborate to fully automate. The discussion is aimed at students, researchers, and developers of real-time monitoring systems.
- Prototype computes BGP indicators and threat alerts in real time.
- Visualization supplies context that automated alerts alone omit.
- BGP hijacks can spread spam or enable denial-of-service.
- Elaborate BGP attacks are difficult to detect fully automatically.
From the original article
1 min read at arxiv.orgSecurity analysts can become overwhelmed with monitoring real-time security information that is important to help them defend their network. They also tend to focus on a limited portion of the alerts, and therefore risk missing important events and links between them. At the heart of the problem is the system that analysts use to detect, explore, and respond to cyber-attacks.
By Ahmed Shah · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.