Article

Tool update: high alarm count issues in IDS rainstorm

Authors:

Kulsoom Abdullah,

John A. CopelandAuthors Info & Claims

VizSEC '06: Proceedings of the 3rd international workshop on Visualization for computer security

Pages 61 - 62

https://doi.org/10.1145/1179576.1179587

Published: 03 November 2006 Publication History

Get Access

Abstract

We developed a tool to help network administrators deal with the large amount of alarms generated from network security appliances. It efficiently uses screen space representing a high number of IP addresses along with time sequence so that general alarm activity for a network can be visualized along with details, if desired. The tool was useful but encountered problems when there was a significant increase in the amount of alarms. The issues that resulted are addressed in this paper along with methods to ease them.

References

[1]

K. Abdullah, C. Lee, G. Conti, J. Copeland, and J. Stasko. Ids rainstorm: Visualizing ids alarms. In IEEE Symposium on Information Visualization's Workshop on Visualization for Computer Security (VizSEC), pages 1--10, 2005.

Digital Library

Google Scholar

[2]

G. Conti, K. Abdullah, J. Grizzard, J. Stasko, J.A. Copeland, M. Ahamad, H.L. Owen, and C. Lee. Countering security information overload through alert and packet visualization. IEEE Computer Graphics and Applications, 2006.

Digital Library

Google Scholar

[3]

G. Conti, M. Ahamad, and J. Stasko. Attacking information visualization system usability: Overloading and deceiving the human. In Symposium on Usable Privacy and Security (SOUPS), July 2005.

Digital Library

Google Scholar

Cited By

View all

Guimaraes VFreitas CSadre RTarouco LGranville L(2016)A Survey on Information Visualization for Network and Service ManagementIEEE Communications Surveys & Tutorials10.1109/COMST.2015.245053818:1(285-323)Online publication date: Sep-2017
https://doi.org/10.1109/COMST.2015.2450538
Katipally RGasior WCui XYang L(2010)Multistage attack detection system for network administrators using data miningProceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research10.1145/1852666.1852722(1-4)Online publication date: 21-Apr-2010
https://dl.acm.org/doi/10.1145/1852666.1852722
Dasireddy SGasior WCui XYang L(2010)Alerts visualization and clustering in network-based intrusion detectionProceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research10.1145/1852666.1852712(1-4)Online publication date: 21-Apr-2010
https://dl.acm.org/doi/10.1145/1852666.1852712
Show More Cited By

Index Terms

Tool update: high alarm count issues in IDS rainstorm
1. Computing methodologies
  1. Computer graphics
    1. Graphics systems and interfaces
2. Human-centered computing
  1. Human computer interaction (HCI)
    1. Interaction devices
      1. Graphics input devices

Recommendations

IDS RainStorm: Visualizing IDS Alarms
VIZSEC '05: Proceedings of the IEEE Workshops on Visualization for Computer Security

The massive amount of alarm data generated from intrusion detection systems is cumbersome for network system administrators to analyze. Often, important details are overlooked and it is difficult to get an overall picture of what is occurring in the ...
Using Time Series 3D AlertGraph and False Alert Classification to Analyse Snort Alerts
VizSec '08: Proceedings of the 5th international workshop on Visualization for Computer Security

A top-level overview of Snort alerts using 3D visual and alert classification is discussed. This paper describes the top-level view (time series 3D AlertGraph) with the integration of alert classification to visualise Snort alerts. The advantages of ...
Tool update: NVisionIP improvements (difference view, sparklines, and shapes)
VizSEC '06: Proceedings of the 3rd international workshop on Visualization for computer security

This paper highlights major enhancements made to the security visualization tool -- NVisionIP -- since it was first presented at the VizSEC/DMSEC 2004 Workshop.

Comments

Information & Contributors

Information

Published In

VizSEC '06: Proceedings of the 3rd international workshop on Visualization for computer security

November 2006

138 pages

ISBN:1595935495

DOI:10.1145/1179576

General Chair:
Bill Yurcik
NCSA
,
Program Chairs:
Stefan Axelsson
Chalmers University, Sweden
,
Kiran Lakkaraju
University of Illinois
,
Soon Tee Teoh
San Jose State University

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 03 November 2006

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Article

Conference

CCS06

Sponsor:

CCS06: 13th ACM Conference on Computer and Communications Security 2006

November 3, 2006

Virginia, Alexandria, USA

Upcoming Conference

CCS '25

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 13 - 17, 2025

Taipei , Taiwan

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

4
Total Citations
View Citations
296
Total Downloads

Downloads (Last 12 months)1
Downloads (Last 6 weeks)0

Reflects downloads up to 01 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

View all

Guimaraes VFreitas CSadre RTarouco LGranville L(2016)A Survey on Information Visualization for Network and Service ManagementIEEE Communications Surveys & Tutorials10.1109/COMST.2015.245053818:1(285-323)Online publication date: Sep-2017
https://doi.org/10.1109/COMST.2015.2450538
Katipally RGasior WCui XYang L(2010)Multistage attack detection system for network administrators using data miningProceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research10.1145/1852666.1852722(1-4)Online publication date: 21-Apr-2010
https://dl.acm.org/doi/10.1145/1852666.1852722
Dasireddy SGasior WCui XYang L(2010)Alerts visualization and clustering in network-based intrusion detectionProceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research10.1145/1852666.1852712(1-4)Online publication date: 21-Apr-2010
https://dl.acm.org/doi/10.1145/1852666.1852712
Yang LGasior WKatipally RCui X(2010)Alerts Analysis and Visualization in Network-based Intrusion Detection SystemsProceedings of the 2010 IEEE Second International Conference on Social Computing10.1109/SocialCom.2010.120(785-790)Online publication date: 20-Aug-2010
https://dl.acm.org/doi/10.1109/SocialCom.2010.120

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Cited By

Index Terms

Recommendations

IDS RainStorm: Visualizing IDS Alarms

Using Time Series 3D AlertGraph and False Alert Classification to Analyse Snort Alerts

Tool update: NVisionIP improvements (difference view, sparklines, and shapes)

Comments

Published In

Sponsors

Publisher

Publication History

Permissions

Check for updates

Author Tags

Qualifiers

Conference

Upcoming Conference

Other Metrics

Article Metrics

Other Metrics

Cited By

Login options

Full Access

PDF

eReader

Abstract

References

Cited By

Index Terms

Recommendations

IDS RainStorm: Visualizing IDS Alarms

Using Time Series 3D AlertGraph and False Alert Classification to Analyse Snort Alerts

Tool update: NVisionIP improvements (difference view, sparklines, and shapes)

Comments

Information

Published In

Sponsors

Publisher

Publication History

Permissions

Check for updates

Author Tags

Qualifiers

Conference

Upcoming Conference

Contributors

Other Metrics

Bibliometrics

Article Metrics

Other Metrics

Citations

Cited By

Login options

Full Access

View options

PDF

eReader

Share

Share this Publication link

Share on social media

Affiliations